Static task
static1
Behavioral task
behavioral1
Sample
7b4387545081a4fa56ae03efdebee5218eb30a3db22796747d749ec2d66c5620.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7b4387545081a4fa56ae03efdebee5218eb30a3db22796747d749ec2d66c5620.exe
Resource
win10v2004-20220812-en
General
-
Target
7b4387545081a4fa56ae03efdebee5218eb30a3db22796747d749ec2d66c5620
-
Size
1.2MB
-
MD5
372e376b2b58eaba7ba7dcceb29d5cf0
-
SHA1
b087cdf8d777595506a0c7af9172aafcc6eceb9a
-
SHA256
7b4387545081a4fa56ae03efdebee5218eb30a3db22796747d749ec2d66c5620
-
SHA512
7e1387936481a1dba95353d95cea2c2d557ee28184c4e281cde053662fe3f0755f76a056b22bbff6aff8d2ec7f57d2b6f0bb496be223f7fd932a94e7894513ab
-
SSDEEP
12288:EMpTbFUnXe4l3x2P/f71pYDC6fYPrc/gOFAu6kCbvDWGn/9peXB:EMpTbFoj2v7TAnoOFAu6kCDDWGn/WB
Malware Config
Signatures
Files
-
7b4387545081a4fa56ae03efdebee5218eb30a3db22796747d749ec2d66c5620.exe windows x86
02f96b56af09a0d038ef506999c6a776
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ngscm
??0CNbuuSplashScreen@@QAE@PAUHINSTANCE__@@I@Z
??1CNbuuSplashScreen@@UAE@XZ
?Show@CNbuuSplashScreen@@QAEHI@Z
?Hide@CNbuuSplashScreen@@QAEHI@Z
??0CCommonAboutDlg@@QAE@XZ
??1CCommonAboutDlg@@UAE@XZ
?DoModal@CCommonAboutDlg@@QAEHXZ
?SetAboutBoxParams@CCommonAboutDlg@@QAEXPAUtagABOUTBOXPARAMS@@@Z
?PcsInitializeWER@@YAHXZ
??0CNbuuTabCtrl@@QAE@XZ
??1CNbuuTabCtrl@@UAE@XZ
??0CNbuuTabSkin@@QAE@XZ
??1CNbuuTabSkin@@UAE@XZ
??0CNbuuStepBarCtrl@@QAE@XZ
??1CNbuuStepBarCtrl@@UAE@XZ
?SetLayout@CNbuuLib@@SAKK@Z
?TranslateMenuAccelerator@CNbuuWindowBackgroundCtrl@@QAEHPAUtagMSG@@@Z
?SetResourceInstance@CNbuuLib@@SAXPAUHINSTANCE__@@@Z
?SetTooltip@?$CNbuuButtonImpl@VCNbuuCommonButtonSkin@@@@QAEXPAG@Z
?SetSkinDef@?$CNbuuBaseSkinImpl@VCNbuuStaticBitmapSkin@@VCNbuuStaticBitmapSkinDef@@@@UAEXVCNbuuStaticBitmapSkinDef@@@Z
?IsValid@?$CNbuuBaseSkinImpl@VCNbuuStaticBitmapSkin@@VCNbuuStaticBitmapSkinDef@@@@UAE_NXZ
?SetTextColor@CNbuuStaticCtrl@@QAEXK@Z
??0CNbuuStaticCtrl@@QAE@XZ
??1CNbuuStaticCtrl@@UAE@XZ
??0CNbuuWindowBackgroundSkin@@QAE@XZ
??1CNbuuWindowBackgroundSkin@@UAE@XZ
??0CNbuuCommonButtonCtrl@@QAE@XZ
??1CNbuuCommonButtonCtrl@@UAE@XZ
??0CNbuuCheckButtonCtrl@@QAE@XZ
??1CNbuuCheckButtonCtrl@@UAE@XZ
?NGSCM_GetCommonNGR@@YAPAUHINSTANCE__@@XZ
?CreateBackBuffer@CNbuuBackBuffer@@UAEXHHPAVCNbuuGraphics@@@Z
?DeleteBackBuffer@CNbuuBackBuffer@@UAEXXZ
?DrawBackBuffer@CNbuuBackBuffer@@UAEXPAUHDC__@@UtagRECT@@1@Z
?DrawBackBufferPart@CNbuuBackBuffer@@UAEXPAUHDC__@@UtagRECT@@11@Z
?DrawParentBackBuffer@CNbuuBackBuffer@@UAEXPAUHDC__@@UtagRECT@@@Z
??0CNbuuStaticBitmapSkin@@QAE@XZ
??1CNbuuStaticBitmapSkin@@UAE@XZ
?Load@CNbuuStaticBitmapSkin@@UAEXXZ
?Unload@CNbuuStaticBitmapSkin@@UAEXXZ
?Validate@CNbuuStaticBitmapSkin@@UAEXXZ
?Draw@CNbuuStaticBitmapSkin@@UAEXPAVCNbuuWindow@@PAVCNbuuGraphics@@HH@Z
?Init@CNbuuLib@@SAXPAUHINSTANCE__@@0@Z
??0CNbuuComboBoxCtrl@@QAE@XZ
??1CNbuuComboBoxCtrl@@UAE@XZ
?PcsLoadFont@@YAXPAUtagLOGFONTW@@@Z
??0CNbuuWindowBackgroundCtrl@@QAE@XZ
??1CNbuuWindowBackgroundCtrl@@UAE@XZ
??0CPCSL2InfoReader@@QAE@XZ
??1CPCSL2InfoReader@@QAE@XZ
?ReadPCSL@CPCSL2InfoReader@@QAEHPAG@Z
?PCSL_GetVariantID@CPCSL2InfoReader@@QAEGXZ
?GetUIManufacturer@CPCSL2InfoReader@@QAEPBGXZ
?GetFirstPhoneManufacturer@CPCSL2InfoReader@@QAEPBGXZ
?GetNextPhoneManufacturer@CPCSL2InfoReader@@QAEPBGXZ
?GetNumberOfPhoneManufacturers@CPCSL2InfoReader@@QAEHXZ
?Show@CNbuuCommonMessageBox@@SAHPAUHWND__@@PBG1I@Z
??0CCSDWrapperListener@@QAE@XZ
??0CCSDWrapper@@QAE@XZ
??1CCSDWrapper@@UAE@XZ
?Initialize@CCSDWrapper@@QAEJPAUHWND__@@@Z
?Terminate@CCSDWrapper@@QAEXXZ
?AddListener@CCSDWrapper@@QAEXPAVCCSDWrapperListener@@@Z
?RemoveListener@CCSDWrapper@@QAEXPAVCCSDWrapperListener@@@Z
?SetSelectionMode@CCSDWrapper@@QAEXK@Z
?SelectDevice@CCSDWrapper@@QAEJKH@Z
?SelectDevice@CCSDWrapper@@QAEJH@Z
?GetSupportedDeviceCount@CCSDWrapper@@QAEHXZ
?SetSupportedDevices@CCSDWrapper@@QAEXPBG@Z
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
connapi
ord506
ord553
ord10
ord500
ord502
ord503
ord505
ord507
ord550
ord205
ord200
ord204
ord206
ord201
ord212
ord213
ord504
ord552
ord551
ord11
ord501
psapi
GetModuleFileNameExW
EnumProcessModules
gdiplus
GdiplusStartup
GdiplusShutdown
mfc90u
ord2447
ord3670
ord6018
ord5663
ord5680
ord4996
ord4347
ord5676
ord5674
ord2087
ord4213
ord5830
ord6741
ord4179
ord6035
ord2251
ord6803
ord4173
ord6801
ord4423
ord4448
ord1149
ord5592
ord5635
ord3794
ord1184
ord1262
ord6666
ord2596
ord6022
ord636
ord2263
ord6547
ord6187
ord6183
ord6096
ord2097
ord367
ord1353
ord2592
ord3486
ord2593
ord3082
ord3953
ord2155
ord4248
ord3494
ord581
ord652
ord6167
ord6511
ord390
ord2537
ord1675
ord5685
ord5683
ord2615
ord2625
ord2623
ord2621
ord2617
ord2640
ord2628
ord1792
ord1791
ord1727
ord1599
ord4442
ord5939
ord935
ord813
ord811
ord600
ord286
ord280
ord296
ord4324
ord2326
ord909
ord2057
ord2955
ord2490
ord2953
ord5535
ord4405
ord4518
ord4494
ord2479
ord2478
ord1603
ord938
ord287
ord290
ord933
ord936
ord291
ord5851
ord3185
ord2702
ord2676
ord3220
ord285
ord1607
ord6630
ord582
ord293
ord6554
ord1235
ord1183
ord1298
ord6171
ord6170
ord4519
ord5979
ord6697
ord499
ord4131
ord6013
ord6692
ord6698
ord4490
ord6691
ord2536
ord3399
ord405
ord6579
ord4235
ord277
ord4251
ord814
ord1759
ord899
ord1665
ord1719
ord2946
ord4270
ord3167
ord3736
ord6349
ord1243
ord589
ord5548
ord1048
ord2206
ord4747
ord3231
ord1108
ord1222
ord2695
ord2694
ord2572
ord6686
ord1043
ord5931
ord294
ord2451
ord2449
ord2452
ord3110
ord5640
ord2455
ord2366
ord3375
ord1622
ord5831
ord3630
ord553
ord6513
ord6169
ord1650
ord5893
ord757
ord784
ord3500
ord1064
ord1254
ord1250
ord3235
ord5859
ord3115
ord3773
ord338
ord2337
ord4905
ord614
ord3993
ord3959
ord3966
ord6158
ord2654
ord6311
ord775
ord595
ord797
ord3651
ord4681
ord3286
ord6777
ord1493
ord6411
ord3355
ord1716
ord1783
ord6166
ord1319
ord1646
ord3588
ord463
ord6512
ord711
ord6130
ord580
ord782
ord404
ord5770
ord6813
ord1552
ord663
ord3589
ord4351
ord400
ord5943
ord406
ord665
ord3534
ord1248
ord3490
ord335
ord6510
ord2574
ord612
ord6121
ord1261
ord266
ord320
ord265
ord5510
ord5509
ord5231
ord5277
ord5168
ord5152
ord5047
ord6385
ord4608
ord6760
ord1937
ord1938
ord2038
ord3907
ord1145
ord2069
ord799
ord5650
ord2139
ord5625
ord1442
ord2904
ord3226
ord6376
ord4543
ord6065
ord6604
ord5404
ord2360
ord3682
ord6804
ord4174
ord6802
ord1641
ord2368
ord3140
ord2375
ord2630
ord2612
ord2610
ord2633
ord2638
ord2619
ord2635
ord971
ord967
ord969
ord965
ord960
ord6466
ord1728
ord4702
ord5154
ord3743
ord4603
ord6800
ord5512
ord2074
ord5602
ord4664
ord4345
ord4910
ord1751
ord1754
ord3515
ord1809
ord1810
ord2208
ord5324
ord5167
ord4682
ord1492
ord6408
ord3353
ord5632
ord4348
ord1098
ord1186
ord794
ord4043
ord3217
ord5767
ord6811
ord5778
ord6822
ord4400
ord2595
ord1063
ord1688
ord3146
ord686
ord436
ord1138
ord4322
ord2501
ord3665
ord3282
ord791
ord1533
ord3628
ord539
ord4632
ord5301
ord5508
ord5511
ord753
ord5661
ord4026
ord3627
ord1708
ord1779
ord750
ord3654
ord2283
ord778
ord4660
ord3908
ord551
ord1709
ord2653
ord6157
ord2224
ord1018
ord5925
ord5011
ord756
ord5662
ord1405
ord4700
ord1640
ord4692
ord4027
ord2470
ord3489
ord2274
ord4652
ord374
ord5008
ord4631
ord639
ord5653
ord4000
ord3577
ord2130
ord1357
ord2146
ord2282
ord4512
ord3543
ord1354
ord2106
ord3537
ord2354
ord2891
ord4071
ord4081
ord4080
ord2764
ord2893
ord2774
ord2966
ord4728
ord3112
ord2983
ord2771
ord2597
ord2901
ord4127
ord6575
ord801
ord6020
ord5664
ord6021
ord2364
ord524
ord744
ord4250
ord6515
ord5897
ord5895
ord2525
ord3868
ord1070
ord587
ord6172
ord792
ord485
ord1272
ord802
ord322
ord1233
ord4294
ord3741
ord2971
ord664
ord2209
ord1383
ord2372
ord3674
ord4044
ord6577
ord611
ord3456
ord1370
ord1486
ord4530
ord736
ord1204
ord1188
ord1137
ord6168
ord5891
ord6514
ord1117
ord836
ord321
ord1144
ord1088
ord605
ord1274
ord783
msvcr90
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_CxxThrowException
_exit
_cexit
__wgetmainargs
_amsg_exit
__CxxFrameHandler3
_localtime64
_tzset
_gmtime64
sprintf
strncpy
wcsncpy
_unlock
floor
free
wcscat
strtoul
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
memcpy_s
_wsetlocale
wcscmp
wcsftime
iswpunct
iswascii
towupper
iswspace
strcpy
strlen
_time64
_localtime64_s
wcslen
_wmakepath
wcscpy
wcstol
ceil
_purecall
_wsplitpath
wcstoul
memcpy
_wcsdup
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
memset
kernel32
lstrcpyW
MapViewOfFile
UnmapViewOfFile
SetEnvironmentVariableW
CreateFileMappingW
GetEnvironmentVariableW
SetLastError
CreateMutexW
GetTimeZoneInformation
FileTimeToLocalFileTime
GetLongPathNameW
WaitForSingleObject
ExitThread
OpenEventA
CreateThread
LocalFree
LocalAlloc
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
GetUserDefaultLangID
CopyFileW
FileTimeToSystemTime
GetModuleHandleW
SystemTimeToFileTime
DeleteFileW
MoveFileW
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
GetTickCount
OpenEventW
CreateEventW
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
Sleep
FreeResource
UnhandledExceptionFilter
LockResource
LoadLibraryA
SizeofResource
LoadLibraryW
LoadResource
FreeLibrary
FindResourceW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForMultipleObjects
ResetEvent
SetEvent
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetLastError
OpenProcess
GetPrivateProfileStringW
CreateEventA
IsDebuggerPresent
CreateDirectoryW
user32
GetWindowRect
EnableWindow
GetDoubleClickTime
ClientToScreen
SetCapture
GetDC
InflateRect
ReleaseDC
GetMenuState
GetSysColor
ReleaseCapture
SetActiveWindow
PostQuitMessage
NotifyWinEvent
GetSubMenu
GetFocus
GetMenuDefaultItem
GetWindowInfo
IsWindowEnabled
EnumChildWindows
LoadMenuW
SendMessageCallbackW
GetActiveWindow
IsWindow
InsertMenuW
GetSystemMetrics
IsWindowVisible
EndMenu
CheckMenuItem
RegisterWindowMessageW
SetCursor
LoadCursorW
PtInRect
SystemParametersInfoW
IsIconic
GetMenuItemID
IsZoomed
GetClientRect
GetWindowLongW
EnableMenuItem
GetMenuItemCount
SetMenuDefaultItem
GetWindowTextLengthW
SetFocus
LockWindowUpdate
GetDlgItem
MapWindowPoints
SetWindowTextW
PeekMessageW
GetCursorPos
WinHelpW
LoadStringW
DestroyIcon
GetNextDlgTabItem
MessageBeep
SetForegroundWindow
LoadIconW
ShowWindow
MsgWaitForMultipleObjects
wvsprintfW
GetWindowTextW
MessageBoxW
GetDesktopWindow
ScreenToClient
GetParent
InvalidateRect
MoveWindow
TranslateMessage
DispatchMessageW
SendMessageW
PostMessageW
GetClassNameW
GetWindowThreadProcessId
KillTimer
SetTimer
gdi32
BitBlt
GetTextExtentPoint32W
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
Ellipse
GetObjectW
GetStockObject
CreateFontIndirectW
advapi32
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetMalloc
SHGetFolderLocation
Shell_NotifyIconW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
SHGetDesktopFolder
shlwapi
PathIsNetworkPathW
StrRetToBufW
ole32
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CLSIDFromString
CoGetInterfaceAndReleaseStream
CoCreateInstance
OleUninitialize
OleInitialize
oleaut32
VarUdateFromDate
VariantClear
VariantTimeToSystemTime
VariantCopy
SafeArrayGetUBound
SafeArrayGetElement
SysAllocStringLen
SafeArrayDestroy
SafeArrayGetLBound
SysStringLen
SysAllocString
SysFreeString
SystemTimeToVariantTime
msvcp90
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
Sections
.text Size: 853KB - Virtual size: 852KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 259KB - Virtual size: 259KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 9KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 85KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE