Static task
static1
Behavioral task
behavioral1
Sample
5084b85914aadd227971490816b746af754b83855a9fc849dff07bd34e5dae08.exe
Resource
win7-20220901-en
General
-
Target
5084b85914aadd227971490816b746af754b83855a9fc849dff07bd34e5dae08
-
Size
280KB
-
MD5
319d838abe3c1825703544836b61d8d0
-
SHA1
d177df1a3d271870ea497eea25b61b46d0dbb164
-
SHA256
5084b85914aadd227971490816b746af754b83855a9fc849dff07bd34e5dae08
-
SHA512
23e204f9941793bf38732bc564ef493fd18ac7799a8a476b8dfd6a89ef5485e98178a8b9d80b6afdc2ad87a2583283759473066d73b6086269d3587ac096c237
-
SSDEEP
6144:HcJbxWDPihzKaRiXzhA6CzHR9TBEvsIxc7RMO5kShqFC2aOtwW:0bxWDPiIXzhA6CrR9TGvsIxc1iR2wT
Malware Config
Signatures
Files
-
5084b85914aadd227971490816b746af754b83855a9fc849dff07bd34e5dae08.exe windows x86
259fc75ed9728edd1241a1076f4ad551
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
HttpQueryInfoW
InternetReadFile
HttpSendRequestW
HttpSendRequestExW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetCrackUrlW
InternetCloseHandle
HttpEndRequestW
kernel32
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
FlushInstructionCache
GetCurrentProcess
ExitProcess
CreateProcessW
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
SetLastError
GetDriveTypeW
GlobalMemoryStatus
GetSystemInfo
GetComputerNameA
SetEvent
lstrcmpiA
ReadProcessMemory
OpenProcess
GetProcAddress
LoadLibraryW
WideCharToMultiByte
lstrcpynW
lstrlenW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetVersionExW
Sleep
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
FileTimeToSystemTime
GetFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
MoveFileW
DeleteFileW
ResetEvent
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetFileAttributesW
GetCommandLineW
CreateEventW
InterlockedExchangeAdd
GetLocalTime
GetFileSizeEx
HeapCreate
HeapAlloc
HeapFree
GetCurrentThreadId
FindFirstFileW
FindNextFileW
FindClose
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetFileSize
ReadFile
GetTempPathW
CreateDirectoryW
CreateFileW
SetFilePointer
WriteFile
CloseHandle
GetLastError
LoadLibraryA
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetProcessHeap
lstrcpyW
InterlockedCompareExchange
user32
SetCursor
CreateDialogParamW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterWindowMessageW
GetWindowTextLengthW
CreateAcceleratorTableW
GetSystemMetrics
LoadImageW
RegisterClassExW
LoadCursorW
GetClassInfoExW
GetFocus
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CallWindowProcW
FillRect
ReleaseCapture
GetClassNameW
IsChild
SetCapture
RedrawWindow
InvalidateRgn
PtInRect
ReleaseDC
GetDC
ClientToScreen
GetSysColor
IsWindow
GetParent
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
IsDialogMessageW
GetDlgItem
SetDlgItemTextW
IsDlgButtonChecked
GetDlgItemTextW
CheckDlgButton
ShowWindow
ScreenToClient
GetWindowRect
MoveWindow
GetWindowTextW
SetWindowTextW
SendMessageW
CreateWindowExW
GetWindowLongW
SetWindowLongW
GetDlgCtrlID
DefWindowProcW
MessageBoxW
DestroyWindow
CharNextW
UnregisterClassA
MsgWaitForMultipleObjects
wsprintfW
DestroyCursor
DrawTextW
InvalidateRect
gdi32
CreateCompatibleBitmap
DeleteObject
BitBlt
GetDeviceCaps
GetObjectW
CreateCompatibleDC
SelectObject
DeleteDC
CreateFontIndirectW
GetTextExtentPoint32W
SetBkMode
SetTextColor
CreateSolidBrush
GetStockObject
advapi32
RegOpenKeyExA
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
GetUserNameA
RegDeleteKeyW
RegQueryValueExA
shell32
ShellExecuteW
SHGetSpecialFolderPathW
SHFileOperationW
ole32
CoInitializeEx
OleUninitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
OleInitialize
oleaut32
VarUI4FromStr
SafeArrayCreate
SafeArrayAccessData
SafeArrayDestroy
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantClear
VariantInit
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
shlwapi
StrStrIW
comctl32
InitCommonControlsEx
msvcp90
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXIG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
msvcr90
strlen
_snprintf_s
memmove_s
memcmp
swprintf_s
_localtime64
strrchr
wcsrchr
wcsftime
fclose
strtok
fgets
fopen
strcat
_wcsicmp
strftime
_snprintf
strncpy_s
_purecall
_recalloc
wcsncpy_s
memcpy_s
malloc
strncat_s
_snwprintf
_localtime32
tolower
isdigit
isalnum
free
exit
wcscat
_swprintf
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??2@YAPAXI@Z
_wcstoi64
wcstoul
memset
wcsncat_s
wcslen
_snwprintf_s
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
wcscmp
sprintf
fread
fwrite
_ftelli64
_fseeki64
ferror
_beginthreadex
_wcslwr_s
rand
srand
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
??3@YAXPAX@Z
_time64
??_V@YAXPAX@Z
memcpy
wcschr
wcsstr
__CxxFrameHandler3
strstr
ws2_32
WSAStartup
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
psapi
GetProcessMemoryInfo
GetModuleInformation
GetModuleFileNameExA
GetModuleFileNameExW
EnumProcessModules
Sections
.text Size: 126KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE