Static task
static1
Behavioral task
behavioral1
Sample
426da4c1346f0e16e52d9b168407015fa5777b14c1f3fd9e6f27421da69e8b2f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
426da4c1346f0e16e52d9b168407015fa5777b14c1f3fd9e6f27421da69e8b2f.exe
Resource
win10v2004-20221111-en
General
-
Target
426da4c1346f0e16e52d9b168407015fa5777b14c1f3fd9e6f27421da69e8b2f
-
Size
618KB
-
MD5
1865b6671a0acadbaef2f522c938b5b0
-
SHA1
d55e9b5d5c5b03b5e5399a5a4b2424f1990127b2
-
SHA256
426da4c1346f0e16e52d9b168407015fa5777b14c1f3fd9e6f27421da69e8b2f
-
SHA512
bea5386509038228ec2dc6ad4e993806f8381ad23b68dc721deac03f460e0e1f579c71de4ad8dd8d0ab6134a5cddcc5ab0ceaa39b08e3bec1fd2bac34de9e063
-
SSDEEP
12288:c89gw7oT+Kv/Tj11CSbCqMPFROvw8Y8KRFe4CO+uJyx/VX6WbODqcFsD2K9:chw7Y+gTjn/VNbONq19
Malware Config
Signatures
Files
-
426da4c1346f0e16e52d9b168407015fa5777b14c1f3fd9e6f27421da69e8b2f.exe windows x86
1011dba1d5a8fb933278fcce5aba1a38
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dbghelp
SymGetSymFromAddr
SymCleanup
SymGetLineFromAddr64
SymGetModuleInfo
SymGetModuleInfoW
SymInitialize
SymSetOptions
SymLoadModule
psapi
GetModuleFileNameExA
GetModuleFileNameExW
wininet
InternetCloseHandle
comctl32
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx
bdlogicutils
?BDLogicUtilsLibrary_Unit@BDLogicUtils@@YAHXZ
?BDLogicUtilsLibrary_Init@BDLogicUtils@@YAHXZ
?GetBDMReportMgr@BDLogicUtils@@YAPAVIBDMReportMgr@1@XZ
bdmbase
CreateZip
_BDMMd5ToStringA@8
CloseZip
?BDMGetWindowsVersion@BDMMisc@@YAHAAKPA_WH@Z
?BDMRegSmartGetValue@BDMRegisterUtils@@YAHPB_W0AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@H@Z
?SafeLoadLibrary@BDMSafeLoadLibrary@@YGPAUHINSTANCE__@@PB_WH@Z
?BDMRegQueryStringValue_DLL@BDMRegisterUtils@@YAHPB_W0PA_WPAK@Z
ZipCompress
Compress
_BDMGetFileMD5@8
bdmstringutils
?GetWindowsDirectory_DLL@BDMStringUtils@@YA_NPA_WH@Z
?GetSystemDirectory_DLL@BDMStringUtils@@YA_NPA_WH@Z
kernel32
InterlockedCompareExchange
GetStartupInfoW
TerminateProcess
VirtualQueryEx
GetThreadSelectorEntry
ReadProcessMemory
FindNextFileW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
GetTickCount
GetCurrentThreadId
CreateFileW
GetTempPathW
SetFilePointer
CloseHandle
CreateDirectoryW
DeleteFileW
GetCurrentProcessId
ReadFile
SizeofResource
lstrcpynW
OpenThread
GetLastError
UnhandledExceptionFilter
WideCharToMultiByte
LocalAlloc
SystemTimeToFileTime
GetModuleHandleW
GetProcAddress
CreateFileA
FindResourceExW
GetFileSize
FindResourceW
GetVersionExW
MultiByteToWideChar
LocalFree
LockResource
LoadResource
WriteProcessMemory
GetModuleFileNameW
CreateProcessW
HeapAlloc
SetLastError
WaitForSingleObject
SetDllDirectoryW
CreateEventW
SetEvent
SetCurrentDirectoryW
InterlockedIncrement
GetProcessHeap
HeapFree
WriteFile
OpenProcess
SetUnhandledExceptionFilter
VirtualProtect
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
Sleep
FreeLibrary
LoadLibraryW
HeapDestroy
HeapReAlloc
HeapSize
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcess
IsDebuggerPresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetProcessId
InterlockedDecrement
user32
CloseClipboard
CallWindowProcW
DrawIconEx
ShowWindow
SendDlgItemMessageW
UnregisterClassA
SetWindowPos
EmptyClipboard
SetWindowTextW
LoadImageW
RegisterClipboardFormatW
GetWindowRect
OpenClipboard
GetDlgItem
GetWindow
SetDlgItemTextW
SendMessageW
SetWindowLongW
EndPaint
LoadIconW
BeginPaint
FillRect
ClientToScreen
GetKeyState
SetClipboardData
DialogBoxParamW
EndDialog
GetWindowThreadProcessId
GetGuiResources
GetParent
EnumChildWindows
GetClassNameW
EnumWindows
ScreenToClient
gdi32
SetBkColor
CreateSolidBrush
DeleteObject
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
ShellExecuteW
ord155
SHGetDesktopFolder
SHBindToParent
SHGetFileInfoW
ole32
DoDragDrop
OleUninitialize
OleInitialize
oleaut32
SysFreeString
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
msvcr80
_CxxThrowException
memcpy
__iob_func
__CxxFrameHandler3
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
??3@YAXPAX@Z
??_U@YAPAXI@Z
memcpy_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
wcschr
memmove_s
??_V@YAXPAX@Z
_invalid_parameter_noinfo
??2@YAPAXI@Z
_purecall
_vscwprintf
_snwprintf
_gmtime32
wcsrchr
vswprintf_s
vsprintf_s
wcsncpy
_wtol
_wfopen
_vscprintf
_snprintf
_mbslwr_s
fread
_mbscmp
fclose
wcsncmp
__argc
swscanf
_beginthreadex
__wargv
_wcsnicmp
srand
sprintf_s
free
malloc
strcpy_s
fflush
fprintf
atoi
strstr
fgets
toupper
memset
wcsncpy_s
_time64
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
shlwapi
PathFileExistsW
PathRemoveFileSpecW
msvcp80
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
Sections
.text Size: 120KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 340KB - Virtual size: 338KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE