?LoadDefaultLanguage@@YA?AVCString@@XZ
Static task
static1
Behavioral task
behavioral1
Sample
450ce7157287efcfafd9d6af8dc965bf507d04a693af0c861edac95dd0612f69.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
450ce7157287efcfafd9d6af8dc965bf507d04a693af0c861edac95dd0612f69.exe
Resource
win10v2004-20220901-en
General
-
Target
450ce7157287efcfafd9d6af8dc965bf507d04a693af0c861edac95dd0612f69
-
Size
505KB
-
MD5
31b88e362cd660280b2b36626fd5bdd0
-
SHA1
6e6fb7af3d224fcba25632f079f2e19132ad902c
-
SHA256
450ce7157287efcfafd9d6af8dc965bf507d04a693af0c861edac95dd0612f69
-
SHA512
47a689e4be2dd710937052c82cd128bff641f38d32f9c132610833af7771b1d1cfb91979f3aa0728c4e9a927041d8a735238a186b36b04282338048b81c6bc34
-
SSDEEP
6144:IsyuVx0g33vyo75G1pXIYOG2GhAv50aBVziNkFNNWCIOZ+4eR86:IsyuVx0gHKl/IwlhQBpskXWCTNeRR
Malware Config
Signatures
Files
-
450ce7157287efcfafd9d6af8dc965bf507d04a693af0c861edac95dd0612f69.exe windows x86
20c0a91478185681751260e4fb913fc8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
ntohl
inet_addr
htons
htonl
WSAGetLastError
ntohs
aunzip32
ord15
ord4
ord2
ord19
ord20
ord9
ord23
azip32
ord17
shlwapi
SHDeleteKeyW
mfc42u
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5276
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord3257
ord4621
ord4419
ord3592
ord324
ord641
ord4229
ord4370
ord4847
ord2371
ord290
ord614
ord4221
ord3998
ord2719
ord6466
ord2722
ord2721
ord1112
ord3253
ord1113
ord6051
ord1768
ord5286
ord3397
ord3716
ord699
ord795
ord397
ord567
ord3785
ord537
ord5706
ord4197
ord6868
ord2606
ord6381
ord3175
ord353
ord912
ord5589
ord2756
ord3433
ord6867
ord4667
ord860
ord3313
ord4269
ord6371
ord4480
ord2546
ord2504
ord5727
ord3917
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord2717
ord4074
ord4692
ord5303
ord5285
ord5710
ord3733
ord815
ord561
ord6211
ord2078
ord2859
ord2613
ord1131
ord4704
ord1244
ord1202
ord3871
ord4199
ord2755
ord3566
ord3693
ord2574
ord1767
ord3365
ord3635
ord796
ord693
ord765
ord1143
ord529
ord3621
ord2406
ord2294
ord1634
ord3991
ord2857
ord2088
ord384
ord6195
ord2634
ord3087
ord6065
ord5651
ord6063
ord5996
ord6616
ord2858
ord755
ord640
ord5781
ord1633
ord323
ord470
ord1662
ord6451
ord5977
ord6896
ord2644
ord6330
ord6667
ord4219
ord2631
ord4215
ord2576
ord3649
ord2430
ord6266
ord1637
ord6879
ord6003
ord6898
ord3993
ord2813
ord4394
ord3625
ord682
ord4270
ord3701
ord2442
ord5674
ord4128
ord4292
ord5784
ord472
ord283
ord5782
ord5732
ord2732
ord2793
ord1569
ord6238
ord6688
ord4155
ord4273
ord6654
ord3281
ord703
ord603
ord1961
ord273
ord404
ord3515
ord3084
ord6397
ord2446
ord403
ord3737
ord818
ord2144
ord1230
ord1172
ord550
ord5647
ord3122
ord3611
ord350
ord6149
ord3806
ord501
ord773
ord1083
ord5603
ord2754
ord1824
ord3121
ord349
ord4073
ord6048
ord4396
ord4992
ord5261
ord922
ord356
ord2762
ord668
ord1971
ord2910
ord5568
ord4124
ord5180
ord5438
ord1165
ord665
ord925
ord858
ord940
ord2385
ord354
ord861
ord3574
ord4418
ord4616
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3131
ord4459
ord3254
ord3142
ord2977
ord535
ord942
ord6390
ord5446
ord6379
ord5436
ord823
ord538
ord5679
ord540
ord2810
ord3658
ord800
ord825
ord2506
ord1196
ord4238
msvcrt
memchr
strstr
strncmp
strchr
_snprintf
fwrite
fopen
fseek
_wtol
memmove
_vsnwprintf
wcsncat
setlocale
ftell
_wrename
_wfopen
__p___wargv
__p___argc
strncpy
_wtoi
iswdigit
free
rand
_wcsicoll
wcscoll
calloc
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__dllonexit
_onexit
_controlfp
fread
__CxxFrameHandler
_snwprintf
_purecall
wcslen
wcsncpy
fwprintf
fflush
time
localtime
fclose
_wcsicmp
wcstol
wcscmp
_CxxThrowException
kernel32
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
InitializeCriticalSection
DeleteCriticalSection
CreateDirectoryW
EnterCriticalSection
SetFileAttributesW
GetLongPathNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
FreeLibrary
GetProcAddress
MoveFileW
GetLastError
CreateMutexW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetVersionExW
MultiByteToWideChar
lstrlenA
lstrcpynW
lstrcmpW
GetModuleHandleW
GetStartupInfoW
CopyFileW
CreateFileW
GetFileSize
CloseHandle
LocalFree
InterlockedDecrement
Sleep
LoadLibraryW
GetModuleFileNameW
LeaveCriticalSection
WideCharToMultiByte
lstrlenW
user32
CopyRect
SetTimer
KillTimer
GetDoubleClickTime
GetSysColor
FillRect
DrawTextW
GetCursorPos
GetSubMenu
LoadImageW
InvalidateRect
UpdateWindow
IsIconic
GetSystemMetrics
DrawIcon
GetSystemMenu
AppendMenuW
GetClientRect
SendMessageW
GetWindowRect
LoadBitmapW
GetWindowLongW
SetWindowLongW
LoadIconW
EnumWindows
GetWindowThreadProcessId
IsWindow
SetForegroundWindow
BringWindowToTop
GetDesktopWindow
MessageBoxW
EnableWindow
LoadMenuW
gdi32
GetObjectW
CreateCompatibleDC
CreateRectRgnIndirect
StretchBlt
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
Shell_NotifyIconW
ShellExecuteW
comctl32
ImageList_ReplaceIcon
ole32
OleRun
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
VariantCopy
VariantChangeType
SysStringLen
CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantClear
VariantInit
SysFreeString
localization
?Localization_SetLanguage@@YAHPBG@Z
?Localization_Start@@YAHXZ
?Localization_Constant_GetString@@YAHPBG0PAGI@Z
helperu
?GetRootPath@@YA?AVCString@@XZ
?LimitFileFind@@YA?AVCString@@PBG@Z
?CreateObjectFromFile@@YAJPAGPAUIUnknown@@ABU_GUID@@2PAPAX@Z
msvcp60
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Xlen@std@@YAXXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@std@@YAXXZ
outsupportnw
CreateOutSupNW
bqqzip
Compress
UnCompress
Exports
Exports
Sections
.text Size: 208KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 148KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE