Static task
static1
Behavioral task
behavioral1
Sample
5a87288db29c1127e3b2b4fc8717423579df1a27827acc88ae8817f0e35758e2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5a87288db29c1127e3b2b4fc8717423579df1a27827acc88ae8817f0e35758e2.exe
Resource
win10v2004-20220812-en
General
-
Target
5a87288db29c1127e3b2b4fc8717423579df1a27827acc88ae8817f0e35758e2
-
Size
174KB
-
MD5
40091423d993675f3987b1591acd6ad0
-
SHA1
282e3f3eb74818b36b396608198e6808776e7828
-
SHA256
5a87288db29c1127e3b2b4fc8717423579df1a27827acc88ae8817f0e35758e2
-
SHA512
fbe65e6abcda3a630344591727e7ee606875114709714a3f3286dc8c47e1db6fa9c5bc130258bd3e523922cc9eb49a989d7aa5092fd5cdb92cb2aa141ef7ba4b
-
SSDEEP
3072:pIv7ASL+JT/beh4lzmK75mOOhWIXCOYevSL+StZmUCRU34Qrj:OvL+JLZp7kOOhWIXseE9z0RK
Malware Config
Signatures
Files
-
5a87288db29c1127e3b2b4fc8717423579df1a27827acc88ae8817f0e35758e2.exe windows x86
cf54d88e7a2b747e1fd1b4902470014f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dbghelp
MiniDumpReadDumpStream
ws2_32
closesocket
setsockopt
socket
connect
htons
gethostbyname
inet_addr
send
recv
WSAStartup
WSACleanup
minizip
zipClose
zipOpen
zipCloseFileInZip
zipWriteInFileInZip
zipOpenNewFileInZip
kernel32
CopyFileW
FindClose
FindNextFileW
FindFirstFileW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
InterlockedIncrement
GlobalUnlock
GlobalLock
GlobalAlloc
OutputDebugStringW
SetErrorMode
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
FileTimeToLocalFileTime
ReadFile
FileTimeToDosDateTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetLastError
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
Sleep
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
InterlockedCompareExchange
WideCharToMultiByte
RaiseException
MultiByteToWideChar
lstrlenW
CloseHandle
MapViewOfFile
lstrlenA
InterlockedDecrement
CreateFileW
CreateFileMappingW
user32
LoadStringW
wsprintfW
UnregisterClassA
EndPaint
GetActiveWindow
MessageBeep
GetSystemMetrics
LoadImageW
LoadBitmapW
GetDlgItem
GetWindowTextW
EndDialog
EmptyClipboard
SetClipboardData
CloseClipboard
GetWindow
MonitorFromWindow
GetMonitorInfoW
OpenClipboard
MessageBoxW
SetDlgItemTextW
KillTimer
SetTimer
GetWindowTextLengthW
SetWindowTextW
SetCursor
ShowCursor
GetParent
MapWindowPoints
SendMessageW
IsWindowEnabled
GetCursorPos
SystemParametersInfoW
ShowWindow
GetWindowRect
SetWindowPos
GetDC
DrawTextW
ReleaseDC
CharNextW
BeginPaint
CallWindowProcW
GetClientRect
GetWindowLongW
InflateRect
GetSysColor
DestroyWindow
DefWindowProcW
DialogBoxParamW
IsWindow
InvalidateRect
SetWindowLongW
RegisterClassExW
RegisterClassExA
UnregisterClassW
LoadCursorW
GetClassInfoExW
LoadCursorA
GetClassInfoExA
gdi32
ExtSelectClipRgn
CreateRectRgnIndirect
GetWindowOrgEx
BitBlt
CreateCompatibleDC
OffsetWindowOrgEx
SetWindowOrgEx
SetTextColor
SetBkMode
GetStockObject
SelectObject
CreateFontIndirectW
DeleteObject
GetObjectW
ExtTextOutW
Rectangle
DeleteDC
SetBkColor
shell32
ShellExecuteW
SHCreateDirectoryExW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString
atl90
ord64
ord56
ord61
ord23
ord68
ord44
ord43
ord49
comctl32
InitCommonControlsEx
_TrackMouseEvent
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
msvcr90
wcscpy
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
__CxxFrameHandler3
wcsftime
memset
??_V@YAXPAX@Z
strlen
tolower
fclose
_atoi64
wcslen
_snwprintf
_localtime64
free
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??3@YAXPAX@Z
fread
_wfopen
sprintf
atoi
strncmp
memcpy
_wstat64i32
memcmp
sprintf_s
swprintf_s
_recalloc
_purecall
_vswprintf
fwrite
_time64
wcsrchr
memmove_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
wcsncpy_s
_strupr
??0exception@std@@QAE@ABQBD@Z
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 70KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE