Static task
static1
Behavioral task
behavioral1
Sample
52a66f900716fc57a5b0abe0b83ac88c6f05465757fac2c636648d6ad52ef9a4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
52a66f900716fc57a5b0abe0b83ac88c6f05465757fac2c636648d6ad52ef9a4.exe
Resource
win10v2004-20220812-en
General
-
Target
52a66f900716fc57a5b0abe0b83ac88c6f05465757fac2c636648d6ad52ef9a4
-
Size
316KB
-
MD5
0e5ee008bbfe2fd04dc6257b6681fb20
-
SHA1
550fac734484de7d5922cf395317bb1f9524d5ba
-
SHA256
52a66f900716fc57a5b0abe0b83ac88c6f05465757fac2c636648d6ad52ef9a4
-
SHA512
df1387209af0a62fe9c8eb84b9f098e18ec4813bc546346f0e68f1bcc671fba9f1788d7ed85a7df1e8888874710ba71e849ff8a8af4ebead64c980e2b6ca6096
-
SSDEEP
6144:YfdRB2mLvqpX0KvUWDw6iW0dzuFlBwpcyw40N6jqKsF3F:2VPuvUWDwzzuFbyb0N6GBF
Malware Config
Signatures
Files
-
52a66f900716fc57a5b0abe0b83ac88c6f05465757fac2c636648d6ad52ef9a4.exe windows x86
bac5d7044e93d80c78053d9ed6c15d3b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
HttpQueryInfoW
HttpEndRequestA
InternetGetConnectedState
InternetGetCookieW
HttpEndRequestW
FtpCreateDirectoryA
GetUrlCacheEntryInfoExW
FindNextUrlCacheEntryExA
InternetReadFileExA
GetUrlCacheEntryInfoW
FtpOpenFileW
FindFirstUrlCacheEntryExW
UnlockUrlCacheEntryFile
HttpAddRequestHeadersA
FtpPutFileW
InternetOpenUrlA
InternetGoOnline
InternetReadFile
InternetTimeToSystemTime
GopherGetAttributeW
FindNextUrlCacheEntryA
InternetCanonicalizeUrlA
InternetTimeFromSystemTime
gdi32
RectVisible
SetICMProfileA
SetAbortProc
CreateHalftonePalette
TextOutA
shell32
SHBrowseForFolderW
oleaut32
VarI1FromR8
VarBstrFromUI4
SafeArrayDestroyDescriptor
VarI2FromR4
VarDateFromUdate
VarR8FromDec
VarAnd
SysStringLen
DispGetParam
VarDateFromUI1
VarDateFromI2
VarCyFromDisp
VarI4FromI1
VarBstrFromDec
VarBoolFromUI4
VarUI4FromI4
VarR4FromI2
SafeArrayGetElemsize
LHashValOfNameSys
imm32
ImmNotifyIME
ImmGetIMEFileNameW
ImmGetRegisterWordStyleA
ImmGetConversionListA
ImmGetCandidateListA
ImmRegisterWordW
ImmInstallIMEW
ImmGetCompositionWindow
setupapi
SetupDiDrawMiniIcon
SetupDiClassGuidsFromNameExA
SetupDiSelectDevice
SetupDiCreateDeviceInterfaceW
SetupDiBuildClassInfoListExA
SetupDiGetSelectedDriverW
SetupDiGetDeviceInterfaceDetailA
SetupDiBuildClassInfoList
SetupQueueRenameW
SetupAdjustDiskSpaceListW
SetupGetMultiSzFieldA
SetupDiInstallClassW
SetupDiGetClassDevsExA
SetupQueueDeleteW
SetupDiGetClassDescriptionW
SetupDiCreateDeviceInfoListExW
SetupDiAskForOEMDisk
SetupDefaultQueueCallbackA
SetupDiClassNameFromGuidA
SetupRemoveFromDiskSpaceListA
SetupDiClassNameFromGuidW
SetupDiSetSelectedDevice
SetupDiClassGuidsFromNameA
SetupGetSourceFileLocationA
SetupCommitFileQueueW
SetupGetIntField
SetupGetLineByIndexW
SetupDiGetDeviceInfoListDetailA
SetupGetStringFieldW
SetupDiRemoveDevice
SetupQueueRenameSectionA
ole32
OleNoteObjectVisible
CoUnmarshalInterface
CoCreateFreeThreadedMarshaler
FmtIdToPropStgName
OleGetIconOfClass
PropVariantClear
CoBuildVersion
CoAddRefServerProcess
StgCreateDocfileOnILockBytes
CoRegisterMallocSpy
CoFreeLibrary
HACCEL_UserMarshal
OleConvertOLESTREAMToIStorageEx
user32
EndPaint
RedrawWindow
CallNextHookEx
DefMDIChildProcW
GetDialogBaseUnits
BringWindowToTop
GetCursorPos
GetWindowRect
SetCaretBlinkTime
GetTopWindow
nddeapi
ord501
ord506
ord611
ord504
ord500
ord606
ord510
ord507
ord509
ord511
ord609
msi
ord41
ord55
ord7
ord27
ord22
ord11
ord65
ord36
ord39
ord34
ord49
ord37
rpcrt4
data_from_ndr
RpcBindingInqObject
MesInqProcEncodingId
NdrConformantStringMemorySize
RpcTestCancel
RpcBindingInqAuthInfoExW
I_RpcAllocate
NdrComplexStructMarshall
UuidIsNil
RpcBindingVectorFree
RpcServerInqIf
NdrVaryingArrayMemorySize
NdrVaryingArrayFree
NdrSimpleStructMemorySize
I_RpcGetBuffer
NdrConformantVaryingArrayMemorySize
NDRSContextUnmarshallEx
RpcServerInqDefaultPrincNameA
NdrComplexArrayMarshall
RpcMgmtEpEltInqBegin
NdrConformantArrayFree
RpcSmSwapClientAllocFree
RpcServerUseProtseqEpExA
RpcMgmtEpUnregister
RpcAsyncInitializeHandle
NdrClientInitialize
tree_peek_ndr
NdrUserMarshalBufferSize
RpcStringBindingComposeW
RpcNetworkInqProtseqsW
RpcBindingServerFromClient
RpcMgmtInqDefaultProtectLevel
RpcServerRegisterAuthInfoA
NdrClientContextMarshall
NdrConformantArrayBufferSize
NdrConformantVaryingArrayUnmarshall
RpcProtseqVectorFreeW
RpcBindingInqAuthInfoW
NdrServerInitializeUnmarshall
char_array_from_ndr
NdrFullPointerQueryPointer
RpcMgmtWaitServerListen
RpcBindingSetOption
RpcSmSetClientAllocFree
NdrByteCountPointerFree
NdrNonEncapsulatedUnionUnmarshall
NdrFullPointerXlatFree
I_RpcBindingCopy
RpcMgmtInqStats
NdrComplexArrayMemorySize
NDRCContextUnmarshall
DceErrorInqTextW
RpcServerUseProtseqExW
RpcServerUseAllProtseqsEx
RpcEpRegisterA
RpcServerUseProtseqEpA
RpcNsBindingInqEntryNameA
NdrConformantStringMarshall
RpcServerUseProtseqEpW
NdrSimpleStructUnmarshall
NdrFullPointerQueryRefId
RpcServerUseProtseqA
RpcSmDisableAllocate
tree_size_ndr
NdrEncapsulatedUnionMemorySize
RpcBindingSetAuthInfoExW
NdrXmitOrRepAsUnmarshall
NdrVaryingArrayUnmarshall
I_RpcFree
NdrServerCall
RpcNetworkIsProtseqValidW
RpcServerUseProtseqIfW
MesHandleFree
NdrFullPointerFree
NdrClientContextUnmarshall
NdrInterfacePointerUnmarshall
RpcAsyncCompleteCall
NdrEncapsulatedUnionMarshall
RpcStringFreeA
I_RpcMapWin32Status
UuidToStringA
RpcAsyncCancelCall
long_from_ndr
NdrServerMarshall
I_RpcNsBindingSetEntryNameA
char_from_ndr
RpcEpUnregister
RpcNetworkInqProtseqsA
NdrComplexArrayBufferSize
NdrUserMarshalMarshall
NdrMesTypeDecode
NdrSimpleTypeMarshall
RpcStringBindingParseA
RpcBindingFromStringBindingW
RpcBindingToStringBindingW
NdrServerInitialize
NdrSimpleStructFree
RpcBindingInqAuthInfoA
NdrMesSimpleTypeAlignSize
NdrMesTypeAlignSize
NdrConformantVaryingStructMarshall
NdrStubCall2
NdrServerInitializeMarshall
NdrAsyncServerCall
I_RpcBindingInqDynamicEndpointA
RpcServerUseProtseqW
RpcObjectSetInqFn
NDRSContextUnmarshall
RpcStringBindingParseW
NdrNsGetBuffer
I_RpcDeleteMutex
RpcSsDontSerializeContext
RpcSsFree
NdrFixedArrayUnmarshall
NDRSContextMarshall
long_from_ndr_temp
NdrNsSendReceive
I_RpcSend
MesEncodeIncrementalHandleCreate
UuidHash
NdrServerUnmarshall
UuidEqual
short_from_ndr_temp
UuidCreate
NdrNonEncapsulatedUnionFree
RpcSsEnableAllocate
NdrComplexArrayUnmarshall
NdrServerCall2
NdrVaryingArrayMarshall
IUnknown_QueryInterface_Proxy
RpcBindingInqAuthClientW
RpcMgmtEpEltInqNextA
NdrPointerUnmarshall
RpcSmFree
RpcBindingInqAuthClientA
NdrPointerMarshall
RpcSsSetClientAllocFree
NdrPointerFree
NdrSimpleStructBufferSize
I_RpcFreePipeBuffer
RpcAsyncAbortCall
IUnknown_Release_Proxy
RpcBindingInqOption
RpcServerRegisterIfEx
NdrByteCountPointerMarshall
RpcSmEnableAllocate
NdrConformantVaryingArrayMarshall
NDRcopy
I_RpcBindingIsClientLocal
NdrRpcSsEnableAllocate
RpcSmDestroyClientContext
NdrComplexStructMemorySize
NdrEncapsulatedUnionFree
RpcSmGetThreadHandle
RpcServerUnregisterIf
RpcMgmtStopServerListening
RpcStringFreeW
I_RpcServerRegisterForwardFunction
RpcEpRegisterNoReplaceA
NDRCContextMarshall
netapi32
NetFileGetInfo
NetServerSetInfo
NetShareDelSticky
NetServerComputerNameDel
NetServerDiskEnum
kernel32
ExitThread
EnumSystemCodePagesW
GetSystemTimeAsFileTime
DefineDosDeviceA
GetModuleFileNameW
FindResourceExW
CompareStringW
FatalAppExitA
AllocConsole
CreateEventW
GetThreadSelectorEntry
VerLanguageNameA
GlobalGetAtomNameW
GetThreadContext
GetCommandLineW
CompareStringA
FlushConsoleInputBuffer
EnumTimeFormatsA
GetShortPathNameW
FoldStringW
GetWindowsDirectoryW
EscapeCommFunction
EnumResourceLanguagesA
GetShortPathNameA
GetCurrentProcess
EnumDateFormatsW
GlobalFindAtomW
BuildCommDCBW
CreateEventA
GetTapePosition
GetStringTypeExA
GetPriorityClass
FileTimeToLocalFileTime
FlushFileBuffers
CreateFileMappingW
GetCurrentThread
GetDriveTypeW
GetStartupInfoA
GetModuleHandleA
GetPrivateProfileIntA
GetDiskFreeSpaceExW
mpr
WNetDisconnectDialog1A
WNetGetUniversalNameW
WNetCloseEnum
shlwapi
PathQuoteSpacesA
PathIsFileSpecA
StrTrimW
SHRegEnumUSKeyW
PathIsDirectoryW
SHOpenRegStreamA
SHSetValueW
SHRegGetBoolUSValueW
PathSearchAndQualifyA
SHQueryInfoKeyW
StrFromTimeIntervalA
PathRenameExtensionA
PathGetDriveNumberA
StrCSpnIA
PathIsFileSpecW
PathIsSystemFolderA
PathRemoveBackslashA
StrPBrkW
PathFindOnPathA
PathCompactPathExW
StrToIntExA
SHRegQueryUSValueW
StrCmpIW
SHGetValueW
SHRegEnumUSValueA
PathRelativePathToW
PathBuildRootA
SHRegQueryUSValueA
PathRemoveExtensionA
rasapi32
RasHangUpW
RasEditPhonebookEntryA
RasDialW
RasEditPhonebookEntryW
RasGetCountryInfoA
RasValidateEntryNameA
RasEnumEntriesW
RasCreatePhonebookEntryW
msvcrt
__getmainargs
_controlfp
_except_handler3
__set_app_type
_exit
_XcptFilter
exit
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_acmdln
oleacc
GetRoleTextA
AccessibleObjectFromPoint
LresultFromObject
GetStateTextA
winspool.drv
SetPrinterDataW
EnumPrintersA
AddJobW
EnumPrinterDataA
WritePrinter
EnumPrinterDriversA
AddPortW
GetPrinterDataW
DeleteFormW
AddPrintProcessorW
DeletePrinterKeyA
EnumPrinterDataW
SetPrinterDataExA
PrinterProperties
AddPrinterDriverExW
ResetPrinterA
AdvancedDocumentPropertiesW
EnumPrintProcessorsW
SetPrinterA
DocumentPropertiesA
StartPagePrinter
AddPrintProcessorA
DeletePrinter
advapi32
EncryptFileA
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ