Static task
static1
Behavioral task
behavioral1
Sample
de288a38b418eb289944afde51197df1c349bf208d9ccc1606d0183a8cadb9ea.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
de288a38b418eb289944afde51197df1c349bf208d9ccc1606d0183a8cadb9ea.exe
Resource
win10v2004-20220812-en
General
-
Target
de288a38b418eb289944afde51197df1c349bf208d9ccc1606d0183a8cadb9ea
-
Size
109KB
-
MD5
1dda8214479a5507bd5c11f676725950
-
SHA1
ea6067cb6a7986865c120caa2fbe9a8b6272203a
-
SHA256
de288a38b418eb289944afde51197df1c349bf208d9ccc1606d0183a8cadb9ea
-
SHA512
ee918b70e2b34447022e683aadf52634688ea7de9d9a76de7edf98840478cbb5499878e21ec215c4b60a42f803973c15e0427ac037f32ae241d1bf01289a87cd
-
SSDEEP
1536:nffZPlL+weaMm036Oy/n8uLR2QQsEy5IL47Vuwlyr8NpuzR:nZ9+wehJKOyUWR2HyTxzlyrupU
Malware Config
Signatures
Files
-
de288a38b418eb289944afde51197df1c349bf208d9ccc1606d0183a8cadb9ea.exe windows x86
0f6ea3b647002a4fdd59c09e1d66be73
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
common
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
??0CTXStringW@@QAE@PB_W@Z
??BCTXStringW@@QBEPB_WXZ
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?Find@CTXStringW@@QBEHPB_WH@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
??0CTXStringW@@QAE@ABV0@@Z
?TrimRight@CTXStringW@@QAEAAV1@PB_W@Z
??1CTXStringW@@QAE@XZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PB_W1HHH@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?OnUninitCom@Misc@Util@@YAXXZ
?ClearDeadQueue@Misc@Util@@YAXXZ
?TXAssert@@YAHPB_W0H@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@_WABV0@@Z
?RemoveFileSystem@FS@@YAHPB_W@Z
??0CTXStringW@@QAE@PA_W@Z
gf
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
kernel32
Process32FirstW
CloseHandle
SetLastError
Process32NextW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
CreateToolhelp32Snapshot
RaiseException
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
VirtualQuery
lstrlenW
GetProcAddress
CreateFileW
GetCurrentProcess
ReadFile
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileIntW
CreateFileA
ResetEvent
ReadFileEx
WaitForSingleObjectEx
VirtualLock
VirtualUnlock
SetCurrentDirectoryA
LoadLibraryExA
SetProcessWorkingSetSize
FreeLibrary
DeviceIoControl
SetEvent
HeapAlloc
HeapFree
GetLastError
GetVersionExW
HeapCreate
CreateEventW
CreateMutexW
TerminateProcess
lstrcmpW
SetEnvironmentVariableW
GetEnvironmentVariableW
FlushInstructionCache
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
Sleep
InterlockedExchange
HeapSize
HeapReAlloc
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
HeapDestroy
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
InterlockedCompareExchange
user32
SetWindowLongW
UnregisterClassA
CallWindowProcW
DefWindowProcW
GetWindowLongW
DestroyWindow
CreateWindowExW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetTimer
LoadCursorW
GetClassInfoExW
RegisterClassExW
KillTimer
PostQuitMessage
ole32
OleUninitialize
OleInitialize
oleaut32
SysAllocString
SysStringLen
SysAllocStringLen
SysFreeString
livelog
?GetNoRealStatInst@@YAJPAPAUINoRealStat@@_K@Z
?TestDNSConnection@@YAXXZ
?GetRealStatInst@@YAJPAPAUIRealGuidStat@@_K@Z
?FileCoCreateInstance@@YAJPB_WABU_GUID@@PAUIUnknown@@K1PAPAXPAUHINSTANCE__@@@Z
?IsDoLog@@YAHXZ
?LogToFile@@YAXPB_WZZ
?GetAppDataPath@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?GetModuleFolder@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PAUHINSTANCE__@@@Z
?GetChannelInfo@@YA?BV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?SetInstallStartupFlag@@YAX_N@Z
shlwapi
PathCombineW
PathCombineA
comctl32
InitCommonControlsEx
msvcp80
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
msvcr80
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_crt_debugger_hook
_CxxThrowException
_controlfp_s
??3@YAXPAX@Z
_recalloc
swprintf_s
memcpy_s
??2@YAPAXI@Z
??_V@YAXPAX@Z
_vsnprintf_s
memmove_s
_vsnwprintf_s
wcscpy_s
_set_invalid_parameter_handler
free
memset
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE