Static task
static1
Behavioral task
behavioral1
Sample
ba0450738024a32ab375ae1ebb2d1bb28b50c915511d0481dc611983fabb8492.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ba0450738024a32ab375ae1ebb2d1bb28b50c915511d0481dc611983fabb8492.exe
Resource
win10v2004-20220901-en
General
-
Target
ba0450738024a32ab375ae1ebb2d1bb28b50c915511d0481dc611983fabb8492
-
Size
29KB
-
MD5
134e69d514221a873f9b78d4aa444360
-
SHA1
2115a9015d3b40825c052957fa8f478e102e5ed0
-
SHA256
ba0450738024a32ab375ae1ebb2d1bb28b50c915511d0481dc611983fabb8492
-
SHA512
570e81d35ee4a4bdf9403c930731e6edf51698f20f36ae38ceb77cf74d76eb081f0842664b506f84ceff87d0de129ea58cb8f02885130eac14c9dcb6a13a3679
-
SSDEEP
384:jUSLbXhO0zKjgTSzmZSN//bPBWK6x0vSquxvUw59NOxYMTnXcL6j4oobpSQzURKH:JO0+0nIrIGSqSvUw535kXc6dQ9
Malware Config
Signatures
Files
-
ba0450738024a32ab375ae1ebb2d1bb28b50c915511d0481dc611983fabb8492.exe windows x86
a8f4a470ae1e84839cd625eb9c40027a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
arkfs
arkMountPath
arkfsbase
arkCreateDirectory
arkipc
arkIPCCleanup
arkIPCInit
arkhttp
arkHttpSetCachePath
arkHttpSetProxy
arkHttpStartup
jgengine
jgExitApplication
jgGetScriptState
jgSetErrorHandler
jgRunApplication
lua
lua_settop
lua_pcall
lua_getfield
lua_toboolean
lua_setfield
lua_pushcclosure
lua_call
lua_type
lua_tolstring
lua_pushboolean
lua_pushvalue
lua_pushstring
kernel32
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
OutputDebugStringW
TerminateProcess
WaitForSingleObject
SearchPathW
CreateEventW
HeapFree
GetCurrentProcess
WriteProcessMemory
VirtualAllocEx
GetCurrentProcessId
EnterCriticalSection
CloseHandle
SetUnhandledExceptionFilter
InitializeCriticalSection
HeapAlloc
DuplicateHandle
GetModuleFileNameW
GetModuleHandleW
GetProcessHeap
VirtualQuery
SetErrorMode
GetProcAddress
GetCurrentThreadId
CreateProcessW
user32
PeekMessageW
DispatchMessageW
WaitMessage
TranslateMessage
msvcr80
__CxxFrameHandler3
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
_waccess
strlen
strncpy
strncat
sscanf
strcmp
_wsplitpath
wcslen
_snwprintf
memcpy
memset
_invalid_parameter_noinfo
msvcp80
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?5DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Bios_base@std@@QBEPAXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ