Static task
static1
Behavioral task
behavioral1
Sample
b3b8433b8322d3884a24aa66d423bb386bd2d26edc86f09f5409a7a30b52bcfb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b3b8433b8322d3884a24aa66d423bb386bd2d26edc86f09f5409a7a30b52bcfb.exe
Resource
win10v2004-20220812-en
General
-
Target
b3b8433b8322d3884a24aa66d423bb386bd2d26edc86f09f5409a7a30b52bcfb
-
Size
296KB
-
MD5
0f4a3710b28ebbf430bc765f9b9e9740
-
SHA1
362460f5f63c8cf844dc089454f72cb974046c07
-
SHA256
b3b8433b8322d3884a24aa66d423bb386bd2d26edc86f09f5409a7a30b52bcfb
-
SHA512
fdfa471259ecb69f64b749b485e9cb9d2be2227113117dc19facce9daba4f86f19dbe34fa36379e89ecc0ddaf42aaa69a275c15d78b50b6a80777001e4b4839c
-
SSDEEP
6144:BSu1zvPvYDyLpj5weLCVrk0WRm/wpnN5Oie6xjMPt9eZiC3:gu1znL8k0WdNre6h+t9k
Malware Config
Signatures
Files
-
b3b8433b8322d3884a24aa66d423bb386bd2d26edc86f09f5409a7a30b52bcfb.exe windows x86
28c3c8c5c567eb3e5059cc4b5ab876fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winspool.drv
EnumPrinterDataW
DeleteMonitorA
EnumPrinterDriversA
SetJobA
StartDocPrinterW
PrinterMessageBoxW
DeletePortA
EnumMonitorsA
SetJobW
GetPrintProcessorDirectoryW
EnumFormsA
DeletePrinterConnectionW
ResetPrinterA
AddPortW
EndPagePrinter
DeletePrinterDriverW
GetPrinterDriverDirectoryW
DeletePrinterDataExW
AddPrintProcessorA
AddPrinterDriverExA
AddJobA
PrinterProperties
OpenPrinterA
AddPrintProvidorA
FreePrinterNotifyInfo
EnumPrinterDataExW
EnumPrintersA
EnumPrintProcessorsA
ConfigurePortW
AddFormW
AddJobW
GetPrinterDriverW
XcvDataW
DeletePrinterDataA
SetPrinterW
ReadPrinter
AddPrinterConnectionW
GetPrinterDataW
EnumPortsA
GetJobA
ResetPrinterW
GetPrinterDataExW
EnumPrintProcessorsW
DeletePrinter
GetPrinterDataA
DeletePrintProvidorW
EnumMonitorsW
GetPrintProcessorDirectoryA
SetPrinterDataW
PrinterMessageBoxA
DeleteMonitorW
GetJobW
DeletePrintProvidorA
AddMonitorA
DeletePrinterConnectionA
AddPortA
AddPrinterW
EnumPrinterKeyA
DeletePrinterKeyA
EnumPrinterDriversW
DeviceCapabilitiesW
GetPrinterW
AddPrinterA
SetFormA
AddMonitorW
ClosePrinter
EnumPortsW
GetFormA
StartDocPrinterA
DeletePrinterDriverExW
EnumPrinterKeyW
DeleteFormA
DocumentPropertiesA
DeletePrintProcessorA
EnumFormsW
GetPrinterDataExA
WritePrinter
EnumPrintProcessorDatatypesW
DeletePortW
EnumPrinterDataExA
AddPrinterDriverA
GetPrinterDriverDirectoryA
FindNextPrinterChangeNotification
AddPrinterConnectionA
EndDocPrinter
DeletePrinterDataW
ConnectToPrinterDlg
DeviceCapabilitiesA
FindFirstPrinterChangeNotification
AdvancedDocumentPropertiesA
SetPrinterDataExW
AddPrinterDriverExW
AddPrintProvidorW
SetPortA
AddFormA
SetPrinterDataExA
SetPrinterDataA
GetFormW
EnumPrinterDataA
DeletePrinterDriverA
AddPrintProcessorW
OpenPrinterW
DeletePrinterDataExA
AbortPrinter
StartPagePrinter
EnumJobsW
SetPrinterA
ScheduleJob
SetFormW
FindClosePrinterChangeNotification
GetPrinterDriverA
EnumJobsA
kernel32
GetStartupInfoA
GetModuleHandleA
GetPrivateProfileStructW
imagehlp
ImageLoad
msvcrt
__p__fmode
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
_except_handler3
_controlfp
__set_app_type
__setusermatherr
__p__commode
_adjust_fdiv
_exit
version
VerInstallFileA
GetFileVersionInfoA
oleacc
AccessibleChildren
GetRoleTextA
GetStateTextW
advapi32
GetSecurityDescriptorGroup
GetTrusteeTypeA
RegConnectRegistryW
GetSecurityDescriptorLength
RegEnumValueW
RegisterServiceCtrlHandlerA
RegSetValueA
BuildImpersonateTrusteeA
SetThreadToken
CloseEventLog
GetTrusteeNameW
StartServiceCtrlDispatcherW
EncryptFileW
EnumDependentServicesW
SetServiceStatus
ObjectCloseAuditAlarmW
RegOpenKeyW
LsaCreateTrustedDomainEx
SetEntriesInAclW
MapGenericMask
AddAce
GetNamedSecurityInfoW
GetUserNameW
CreateRestrictedToken
GetTrusteeFormW
LsaEnumerateTrustedDomains
RegSaveKeyA
GetSecurityInfo
ChangeServiceConfigA
GetExplicitEntriesFromAclW
RegQueryValueExA
LsaLookupNames
GetSidLengthRequired
RegOverridePredefKey
StartServiceCtrlDispatcherA
OpenBackupEventLogW
LookupAccountNameW
GetKernelObjectSecurity
RegReplaceKeyW
DeleteService
InitiateSystemShutdownW
MakeSelfRelativeSD
ChangeServiceConfigW
SetNamedSecurityInfoW
AddAccessAllowedAce
AbortSystemShutdownW
QueryServiceStatus
BuildTrusteeWithNameW
SetTokenInformation
GetServiceKeyNameW
RegDeleteValueW
CreateServiceA
GetExplicitEntriesFromAclA
PrivilegedServiceAuditAlarmW
RegSetValueExW
AreAnyAccessesGranted
LsaSetDomainInformationPolicy
SetSecurityDescriptorDacl
GetSidIdentifierAuthority
RegCloseKey
AllocateAndInitializeSid
BackupEventLogA
RegConnectRegistryA
RegisterEventSourceW
RegRestoreKeyW
GetMultipleTrusteeA
CreatePrivateObjectSecurity
RegOpenKeyExA
LookupSecurityDescriptorPartsA
AdjustTokenGroups
ObjectOpenAuditAlarmW
ReadEventLogW
RegGetKeySecurity
GetFileSecurityA
SetFileSecurityA
BuildTrusteeWithSidA
AllocateLocallyUniqueId
GetTrusteeFormA
RegQueryInfoKeyW
LsaClose
AccessCheck
BuildImpersonateExplicitAccessWithNameA
RegEnumKeyExW
BuildImpersonateExplicitAccessWithNameW
LookupPrivilegeDisplayNameA
RegQueryValueA
ReadEventLogA
QueryServiceConfigA
RegDeleteValueA
EncryptFileA
ReportEventA
GetAuditedPermissionsFromAclA
RegDeleteKeyA
LookupSecurityDescriptorPartsW
LsaSetInformationPolicy
RegNotifyChangeKeyValue
AddAccessDeniedAce
RevertToSelf
GetAce
ObjectCloseAuditAlarmA
RegOpenKeyA
LsaEnumerateTrustedDomainsEx
EqualPrefixSid
IsValidAcl
EnumServicesStatusA
ClearEventLogW
DuplicateTokenEx
RegCreateKeyExW
FreeSid
GetAuditedPermissionsFromAclW
DecryptFileW
RegUnLoadKeyA
RegCreateKeyExA
OpenSCManagerW
LookupPrivilegeValueW
InitializeSecurityDescriptor
OpenProcessToken
GetPrivateObjectSecurity
RegCreateKeyW
UnlockServiceDatabase
QueryServiceLockStatusW
LsaEnumerateAccountRights
LookupAccountNameA
ImpersonateLoggedOnUser
RegSetValueExA
RegCreateKeyA
QueryServiceConfig2A
user32
DdePostAdvise
GetActiveWindow
winmm
waveOutGetVolume
mmioOpenA
timeGetSystemTime
mmioAdvance
mciGetErrorStringW
joyGetDevCapsA
waveInReset
mciSendCommandA
mciGetDeviceIDFromElementIDW
mixerGetLineInfoW
midiInAddBuffer
midiInGetID
joyGetPos
mciGetErrorStringA
PlaySoundA
midiInPrepareHeader
mciGetCreatorTask
mmioInstallIOProcW
mciGetDeviceIDA
joyReleaseCapture
midiInStop
waveOutGetErrorTextW
mmioStringToFOURCCA
joyGetNumDevs
mmioStringToFOURCCW
midiOutCacheDrumPatches
midiStreamOpen
OpenDriver
waveInStart
waveOutGetDevCapsW
waveInMessage
midiInReset
mixerGetControlDetailsA
mmioRenameA
DrvGetModuleHandle
joyGetPosEx
mixerSetControlDetails
auxOutMessage
auxSetVolume
GetDriverModuleHandle
mixerGetLineControlsW
waveOutMessage
midiInGetDevCapsA
midiOutClose
Sections
.text Size: 252KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ