Static task
static1
Behavioral task
behavioral1
Sample
17da8dcf9d4af627285d54b8454d68b33f9674a44e804dd36aec31bd1ce41575.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
17da8dcf9d4af627285d54b8454d68b33f9674a44e804dd36aec31bd1ce41575.exe
Resource
win10v2004-20220812-en
General
-
Target
17da8dcf9d4af627285d54b8454d68b33f9674a44e804dd36aec31bd1ce41575
-
Size
256KB
-
MD5
f2057ff1ce7cb57e8534f369c42421e0
-
SHA1
190b38ccb1cd10a87295e3cbab43adf132475c70
-
SHA256
17da8dcf9d4af627285d54b8454d68b33f9674a44e804dd36aec31bd1ce41575
-
SHA512
aaf339cb2a13e9f1b4e17f3694a9dee64a2c8c017dc362431e864e21f5887e5c3628e248546696f3ef00a5728950cc69115967976730f8e8e40d92d3849be83d
-
SSDEEP
6144:fiheDaUQT3zYJywUW3YRZwBmR7s9eJI5sA7kqvP:q7UE388xa6Imds9eJcsR+
Malware Config
Signatures
Files
-
17da8dcf9d4af627285d54b8454d68b33f9674a44e804dd36aec31bd1ce41575.exe windows x86
edbbb2c454daf8236f9b91ffa9f8dad3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcns4
RpcIfIdVectorFree
imagehlp
ImageNtHeader
setupapi
SetupAddToDiskSpaceListA
SetupAddToDiskSpaceListW
SetupAddSectionToDiskSpaceListW
SetupAddToSourceListA
SetupCopyErrorW
SetupAdjustDiskSpaceListW
SetupCopyErrorA
SetupCopyOEMInfA
SetupAddInstallSectionToDiskSpaceListW
SetupAddToSourceListW
SetupCancelTemporarySourceList
SetupCommitFileQueueW
kernel32
GetModuleHandleA
GlobalAlloc
VirtualProtect
GetStartupInfoA
gdi32
GetBkColor
msvcrt
_controlfp
_except_handler3
__dllonexit
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_onexit
exit
_acmdln
__set_app_type
_exit
_XcptFilter
__getmainargs
user32
RegisterClassExA
CreateWindowExW
rpcrt4
NdrInterfacePointerFree
NdrVaryingArrayMemorySize
RpcServerUseProtseqEpA
NdrNonConformantStringMemorySize
NdrSendReceive
RpcServerTestCancel
RpcTestCancel
RpcSsDestroyClientContext
NdrSimpleStructFree
RpcStringFreeW
RpcSsSetThreadHandle
RpcSmSetThreadHandle
RpcServerRegisterAuthInfoA
double_array_from_ndr
RpcServerUseProtseqA
RpcServerUseProtseqW
short_array_from_ndr
RpcSmDestroyClientContext
RpcServerInqDefaultPrincNameW
RpcBindingSetAuthInfoW
RpcMgmtIsServerListening
UuidToStringW
NdrEncapsulatedUnionUnmarshall
NdrComplexStructMarshall
UuidCompare
RpcServerRegisterIf
NdrConformantVaryingArrayMemorySize
NdrConformantVaryingStructMemorySize
NdrVaryingArrayFree
short_from_ndr_temp
RpcMgmtEpEltInqNextW
RpcStringBindingParseW
RpcStringFreeA
RpcRevertToSelfEx
NdrConformantArrayMemorySize
RpcSsEnableAllocate
RpcBindingFromStringBindingA
data_into_ndr
NdrFullPointerQueryPointer
RpcStringBindingComposeW
NdrConformantVaryingArrayUnmarshall
RpcStringBindingParseA
NdrServerInitializePartial
long_from_ndr_temp
NdrFixedArrayMemorySize
RpcServerUseProtseqEpExA
RpcMgmtInqStats
tree_size_ndr
NdrConformantArrayFree
NdrServerMarshall
RpcEpRegisterW
NdrXmitOrRepAsFree
NdrConformantVaryingStructBufferSize
NdrNonEncapsulatedUnionBufferSize
RpcMgmtSetCancelTimeout
NdrConformantStructFree
RpcAsyncGetCallStatus
RpcObjectSetType
RpcServerUseProtseqIfExA
NdrEncapsulatedUnionMarshall
RpcAsyncInitializeHandle
RpcAsyncAbortCall
RpcMgmtEnableIdleCleanup
NdrServerCall2
NdrVaryingArrayMarshall
RpcServerInqDefaultPrincNameA
NdrConformantVaryingArrayFree
NdrConformantVaryingStructMarshall
NdrSimpleTypeUnmarshall
NdrInterfacePointerBufferSize
RpcServerUseProtseqIfW
short_from_ndr
RpcServerUseAllProtseqsIf
NdrVaryingArrayBufferSize
RpcNetworkIsProtseqValidW
RpcAsyncCompleteCall
NdrMesTypeAlignSize
NdrFullPointerXlatFree
RpcMgmtInqIfIds
RpcObjectInqType
RpcBindingInqAuthInfoExW
NdrConformantArrayUnmarshall
RpcServerRegisterIfEx
NdrEncapsulatedUnionMemorySize
RpcEpResolveBinding
RpcServerRegisterAuthInfoW
NdrRpcSsDefaultFree
NdrOleFree
NdrRpcSsDisableAllocate
RpcMgmtEpEltInqDone
NdrGetBuffer
RpcNetworkInqProtseqsA
UuidCreateNil
NdrPointerUnmarshall
NdrConformantStringBufferSize
NdrInterfacePointerMarshall
NdrInterfacePointerUnmarshall
data_from_ndr
NdrFreeBuffer
NdrRpcSmSetClientToOsf
NdrSimpleStructUnmarshall
RpcBindingSetAuthInfoExW
RpcBindingInqAuthInfoW
UuidFromStringA
RpcAsyncRegisterInfo
NdrServerContextMarshall
NdrConformantVaryingStructUnmarshall
RpcBindingInqAuthClientA
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ