Static task
static1
Behavioral task
behavioral1
Sample
c04b0dcc7b33cf69a3acbc060d122eb79d8a7aadd8caa71b834682439cec14d7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c04b0dcc7b33cf69a3acbc060d122eb79d8a7aadd8caa71b834682439cec14d7.exe
Resource
win10v2004-20221111-en
General
-
Target
c04b0dcc7b33cf69a3acbc060d122eb79d8a7aadd8caa71b834682439cec14d7
-
Size
87KB
-
MD5
d9e5ab349be22cc542bc297ffe8a69d1
-
SHA1
4aa1485d922e2d2dbbcad6e910dc20a86d359798
-
SHA256
c04b0dcc7b33cf69a3acbc060d122eb79d8a7aadd8caa71b834682439cec14d7
-
SHA512
394d21e74144b6cf24e907108a649163a4626c2946f8c0b87ad4ea4478170e17030417c1ee033c4fa4290d70c9559148360d37c3f297e20e5c8cdb4ea12d37da
-
SSDEEP
1536:pVU4KyI24z4CUU4AdJ4iILx6EedS67en1IkoMdFYH9lVa1Ak/Ea6FW6e2giV:4HyKTL4ADW6EINSiDMYHU1jerPj
Malware Config
Signatures
Files
-
c04b0dcc7b33cf69a3acbc060d122eb79d8a7aadd8caa71b834682439cec14d7.exe windows x86
2c87374f42cafb463be0d5fdc75fd0bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetWindowThreadProcessId
SetDeskWallpaper
EnableWindow
GetClassNameA
LoadBitmapW
LoadBitmapA
DestroyCaret
DrawTextExW
MapVirtualKeyA
TranslateAcceleratorW
SetProcessDefaultLayout
GetSystemMetrics
OpenIcon
IsCharAlphaA
GetProcessDefaultLayout
DialogBoxIndirectParamA
PostThreadMessageA
DdeQueryNextServer
GetPropA
InsertMenuW
GetKeyboardLayout
GetForegroundWindow
EnumPropsExW
CharToOemW
DrawEdge
PeekMessageW
LoadMenuIndirectW
ChangeDisplaySettingsExW
UnpackDDElParam
SetParent
GetProcessWindowStation
CreateCaret
CharToOemBuffA
GetWindowContextHelpId
SetMenuItemBitmaps
IsCharAlphaW
DestroyAcceleratorTable
RemovePropW
WindowFromDC
EnumChildWindows
ValidateRgn
GetActiveWindow
DdeSetUserHandle
RemovePropA
DdeDisconnectList
CharLowerBuffA
SwitchDesktop
RegisterClassExW
DdeCreateStringHandleA
CreateDesktopW
GetKeyboardLayoutNameW
SetClipboardData
SetWindowWord
GetKBCodePage
GetMenuDefaultItem
ScrollWindowEx
FreeDDElParam
RegisterClipboardFormatW
CopyImage
CharNextA
WinHelpA
DrawIcon
FindWindowA
MsgWaitForMultipleObjectsEx
GetOpenClipboardWindow
LoadAcceleratorsW
DdeFreeStringHandle
GetTabbedTextExtentA
IsMenu
GetMonitorInfoA
LoadIconW
SendDlgItemMessageA
GetMessageA
GetClassInfoA
DefFrameProcA
GetDlgItemTextW
GetMenuItemID
CreateMenu
EnumPropsW
GetDlgItem
DrawStateW
EnumDisplaySettingsExW
GetIconInfo
SetWindowLongA
DrawTextW
GetWindowInfo
VkKeyScanW
SetCursor
GetInputDesktop
IsWindowEnabled
LoadCursorFromFileA
DdePostAdvise
SetRect
EnumDesktopsW
OpenInputDesktop
IntersectRect
WindowFromPoint
IsWindowUnicode
ChildWindowFromPoint
ChangeDisplaySettingsW
FlashWindow
MapVirtualKeyExW
SetDlgItemTextW
DdeQueryStringA
DefFrameProcW
EnumClipboardFormats
EndDialog
SendNotifyMessageW
AdjustWindowRectEx
MessageBoxIndirectW
BroadcastSystemMessageA
PackDDElParam
DrawAnimatedRects
GetKeyNameTextW
DlgDirListComboBoxA
DdeInitializeA
SetUserObjectSecurity
DefWindowProcW
WinHelpW
VkKeyScanExW
GetClassInfoExW
DefMDIChildProcW
DdeQueryConvInfo
ToUnicodeEx
kernel32
VirtualAlloc
FindFirstFileW
FindResourceA
FreeEnvironmentStringsA
SetEnvironmentVariableW
OpenWaitableTimerW
Sleep
SetThreadContext
FillConsoleOutputAttribute
CreateEventW
GetSystemTimeAsFileTime
GetCurrencyFormatW
GetNumberFormatA
IsDBCSLeadByteEx
ExpandEnvironmentStringsA
GetProfileIntW
GetPrivateProfileStructA
SignalObjectAndWait
SetFileApisToANSI
WriteConsoleOutputCharacterA
ScrollConsoleScreenBufferW
RtlFillMemory
MapViewOfFile
GetSystemTimeAdjustment
PeekNamedPipe
QueueUserAPC
VirtualProtect
ResumeThread
ReadConsoleInputA
DefineDosDeviceA
AddAtomW
GetTapeParameters
ReadConsoleOutputAttribute
EnumResourceTypesA
CreateDirectoryExW
WaitForMultipleObjectsEx
HeapFree
lstrcpyA
GetEnvironmentStrings
LoadLibraryW
GenerateConsoleCtrlEvent
WriteConsoleOutputA
OpenEventA
VirtualQuery
FindResourceExW
CommConfigDialogW
HeapValidate
GetFileAttributesW
GetShortPathNameA
LocalFileTimeToFileTime
GetEnvironmentVariableA
EnumTimeFormatsA
GetDiskFreeSpaceW
FindCloseChangeNotification
BuildCommDCBW
GetTimeZoneInformation
DosDateTimeToFileTime
SetHandleCount
SetPriorityClass
FileTimeToDosDateTime
GlobalAddAtomA
GetCompressedFileSizeW
GetVersion
FindClose
GetCurrentProcess
lstrlen
GetUserDefaultLCID
WriteConsoleOutputCharacterW
FlushFileBuffers
BuildCommDCBAndTimeoutsA
GlobalDeleteAtom
CreateDirectoryA
GetComputerNameW
SetCurrentDirectoryA
SearchPathW
OpenSemaphoreA
CancelIo
GlobalFix
CopyFileA
WaitNamedPipeA
CreateNamedPipeA
SetTimeZoneInformation
GetProfileStringA
GetCommandLineA
GetConsoleTitleA
FillConsoleOutputCharacterW
GetDriveTypeW
FindFirstFileExW
lstrcmpiA
OpenEventW
GetCommState
GetExitCodeProcess
FindFirstFileA
EnumCalendarInfoExW
ReadConsoleOutputCharacterA
GetBinaryType
SetupComm
HeapUnlock
TransactNamedPipe
GetSystemDirectoryA
GetPrivateProfileSectionA
FoldStringW
EnumCalendarInfoW
IsBadCodePtr
FlushViewOfFile
SetCommTimeouts
FoldStringA
GetConsoleTitleW
TerminateProcess
lstrcatA
GetLocaleInfoA
WritePrivateProfileStructW
GetMailslotInfo
GetLocaleInfoW
GetFileTime
WritePrivateProfileStringA
SetEnvironmentVariableA
FatalAppExitW
VerLanguageNameW
RemoveDirectoryA
DeleteFileA
SwitchToThread
CompareStringA
GetTapePosition
GetPrivateProfileIntW
ole32
CoGetMarshalSizeMax
CoInitialize
OleSetContainedObject
OleLoad
OleSetAutoConvert
CoMarshalInterThreadInterfaceInStream
CoRevertToSelf
CoGetCurrentProcess
OleSaveToStream
OleRegGetUserType
OleSave
OleRegGetMiscStatus
CoGetClassObject
OleCreateLinkFromDataEx
CoGetObject
CoCreateInstanceEx
OleCreate
MonikerCommonPrefixWith
CreateDataCache
OleCreateDefaultHandler
CoCreateInstance
CoImpersonateClient
OleDuplicateData
OleCreateFromFile
CreateFileMoniker
IIDFromString
CoFileTimeNow
CoRegisterPSClsid
OleGetClipboard
CoCreateGuid
GetConvertStg
CreateStreamOnHGlobal
StgOpenAsyncDocfileOnIFillLockBytes
OleRegEnumVerbs
OleMetafilePictFromIconAndLabel
StgGetIFillLockBytesOnILockBytes
ReadFmtUserTypeStg
OleCreateMenuDescriptor
CoGetInstanceFromFile
WriteFmtUserTypeStg
CoUnmarshalInterface
StgSetTimes
CLSIDFromProgID
SetConvertStg
CoQueryProxyBlanket
StringFromGUID2
ReadClassStm
UtConvertDvtd16toDvtd32
OleGetIconOfClass
CoLoadLibrary
SetDocumentBitStg
CoTaskMemAlloc
CoReleaseMarshalData
OleCreateStaticFromData
CreateOleAdviseHolder
WriteClassStg
OleCreateFromData
DllDebugObjectRPCHook
CreateObjrefMoniker
UtGetDvtd16Info
GetHookInterface
OleCreateLinkToFileEx
StgCreateStorageEx
CoQueryAuthenticationServices
OleIsRunning
ReleaseStgMedium
GetHGlobalFromILockBytes
OleCreateLink
CoRegisterChannelHook
WriteClassStm
CreateItemMoniker
CoFreeLibrary
RevokeDragDrop
StgIsStorageFile
RegisterDragDrop
OleIsCurrentClipboard
OleCreateFromFileEx
CoResumeClassObjects
OleCreateLinkFromData
CoDisconnectObject
CoGetCurrentLogicalThreadId
OleCreateFromDataEx
OleLockRunning
OleDestroyMenuDescriptor
CoFreeAllLibraries
DoDragDrop
CoFreeUnusedLibraries
CreateGenericComposite
CoUnmarshalHresult
OleRun
IsAccelerator
CoQueryReleaseObject
CoBuildVersion
CoInitializeSecurity
CoGetMalloc
CoTaskMemFree
CoGetPSClsid
OleSetClipboard
OleUninitialize
CoMarshalHresult
advapi32
InitializeSid
BackupEventLogA
CryptHashData
ImpersonateLoggedOnUser
RegGetKeySecurity
OpenSCManagerW
QueryServiceLockStatusA
CryptEnumProviderTypesW
ImpersonateNamedPipeClient
GetEffectiveRightsFromAclW
SetSecurityInfoExA
QueryServiceConfigW
RegSaveKeyW
CryptAcquireContextW
GetCurrentHwProfileW
SetSecurityDescriptorSacl
ConvertSecurityDescriptorToAccessNamedW
AddAuditAccessAce
SetServiceObjectSecurity
SetAclInformation
IsValidSecurityDescriptor
PrivilegedServiceAuditAlarmW
RegEnumKeyA
BuildImpersonateExplicitAccessWithNameW
ConvertAccessToSecurityDescriptorA
RevertToSelf
CancelOverlappedAccess
CryptSetProviderExW
CreateServiceA
CryptSetProviderExA
CryptExportKey
RegCreateKeyA
AreAllAccessesGranted
CryptGetProvParam
AdjustTokenPrivileges
GetMultipleTrusteeOperationA
ChangeServiceConfigA
LookupSecurityDescriptorPartsA
SetEntriesInAclA
RegSetKeySecurity
RegUnLoadKeyA
EqualPrefixSid
QueryServiceLockStatusW
GetServiceKeyNameW
RegCreateKeyExW
AddAce
CryptGetDefaultProviderA
GetAclInformation
CryptCreateHash
CryptHashSessionKey
CryptGenKey
SetServiceBits
GetTrusteeTypeA
ObjectOpenAuditAlarmW
CloseServiceHandle
RegReplaceKeyW
AllocateLocallyUniqueId
RegSetValueExW
GetServiceDisplayNameA
CryptDeriveKey
ReportEventW
DeregisterEventSource
LookupPrivilegeValueA
GetSecurityDescriptorSacl
RegOpenKeyW
SetEntriesInAccessListW
BuildSecurityDescriptorA
RegRestoreKeyW
CryptDestroyKey
RegQueryValueA
GetAccessPermissionsForObjectW
LogonUserA
IsTextUnicode
CryptAcquireContextA
CryptSignHashW
CreateProcessAsUserW
RegReplaceKeyA
RegQueryValueW
BuildImpersonateTrusteeW
BuildTrusteeWithSidW
OpenBackupEventLogW
LookupPrivilegeValueW
OpenEventLogW
ReportEventA
BuildSecurityDescriptorW
RegQueryValueExA
BuildExplicitAccessWithNameW
RegDeleteKeyW
SetTokenInformation
FindFirstFreeAce
RegOpenKeyExA
RegRestoreKeyA
CryptImportKey
CryptSetProviderA
LookupPrivilegeNameA
GetSecurityDescriptorControl
RegUnLoadKeyW
QueryServiceStatus
GetFileSecurityA
DeleteService
CryptDuplicateKey
MakeAbsoluteSD
RegDeleteKeyA
GetTrusteeNameW
RegisterEventSourceW
RegCreateKeyExA
GetSecurityDescriptorDacl
LookupPrivilegeDisplayNameA
RegNotifyChangeKeyValue
ImpersonateSelf
OpenBackupEventLogA
CryptEnumProvidersW
SetServiceStatus
BuildTrusteeWithNameW
RegEnumKeyExW
AccessCheck
GetLengthSid
ReadEventLogW
AccessCheckAndAuditAlarmW
SetSecurityInfoExW
OpenServiceA
RegCloseKey
DuplicateToken
shlwapi
PathGetCharTypeW
PathIsRelativeW
StrToIntExA
SHGetValueA
SHSetValueW
PathIsDirectoryW
SHDeleteKeyA
SHRegEnumUSValueA
SHRegEnumUSKeyW
PathRelativePathToA
PathRemoveBackslashW
PathMakePrettyW
StrCmpNA
PathFindNextComponentA
PathFindOnPathA
UrlIsA
SHSkipJunction
StrRChrIW
PathMakePrettyA
StrFormatByteSize64A
SHCopyKeyW
UrlIsNoHistoryA
SHStrDupA
wvnsprintfA
PathIsSameRootA
PathIsDirectoryEmptyA
StrDupA
PathBuildRootW
UrlIsW
PathIsRootW
PathMatchSpecW
StrRetToBufW
PathCompactPathExA
SHOpenRegStream2A
SHSetValueA
ColorAdjustLuma
SHRegOpenUSKeyW
SHRegSetUSValueA
PathIsNetworkPathW
PathIsNetworkPathA
SHStrDupW
SHEnumValueW
ColorHLSToRGB
StrCatBuffW
PathSkipRootW
StrFormatKBSizeA
PathIsRelativeA
PathFindSuffixArrayW
StrCSpnW
StrCmpNIW
UrlEscapeA
StrSpnW
GetMenuPosFromID
SHRegCreateUSKeyW
UrlCanonicalizeA
SHDeleteKeyW
SHCopyKeyA
PathFindExtensionW
SHRegQueryInfoUSKeyW
PathRemoveFileSpecA
PathIsLFNFileSpecW
StrRStrIA
PathCommonPrefixW
UrlCombineW
StrCpyNW
StrFromTimeIntervalW
UrlHashA
PathIsURLW
PathUnquoteSpacesW
SHDeleteValueA
IntlStrEqWorkerA
PathIsContentTypeA
PathAppendA
StrCpyW
StrChrW
StrSpnA
PathRemoveArgsW
StrRetToStrW
UrlIsNoHistoryW
PathRemoveFileSpecW
wnsprintfW
SHEnumKeyExW
SHRegQueryUSValueA
SHRegSetUSValueW
PathGetDriveNumberW
SHDeleteEmptyKeyW
PathUnquoteSpacesA
PathAddExtensionW
StrFormatKBSizeW
PathMakeSystemFolderW
UrlUnescapeW
SHRegGetBoolUSValueA
StrChrIA
UrlCompareA
PathFindOnPathW
AssocQueryKeyA
PathCompactPathW
StrToIntA
SHRegGetUSValueA
PathIsPrefixA
PathIsDirectoryEmptyW
PathSearchAndQualifyA
PathSetDlgItemPathA
StrTrimW
SHRegCloseUSKey
StrDupW
PathIsUNCServerA
PathFindFileNameW
StrFormatByteSizeA
UrlCreateFromPathA
SHRegGetBoolUSValueW
SHAutoComplete
PathRemoveBlanksW
PathIsLFNFileSpecA
PathCreateFromUrlA
PathUndecorateA
PathMatchSpecA
PathIsURLA
PathAddBackslashA
PathParseIconLocationA
SHEnumKeyExA
StrNCatA
SHQueryInfoKeyW
StrStrIW
SHCreateStreamOnFileA
AssocQueryStringByKeyA
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 169B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE