Static task
static1
Behavioral task
behavioral1
Sample
30fd0e9e99afde661d6b463ef09fdf669003e68d5c1fab1adbb03cbc164b4aef.exe
Resource
win7-20221111-en
General
-
Target
30fd0e9e99afde661d6b463ef09fdf669003e68d5c1fab1adbb03cbc164b4aef
-
Size
221KB
-
MD5
378c5a0febe9f5fd771c1f9e43f148f1
-
SHA1
5034b7aa33b0fe7106835efd6630b98f14f86448
-
SHA256
30fd0e9e99afde661d6b463ef09fdf669003e68d5c1fab1adbb03cbc164b4aef
-
SHA512
c3499de71a2db291110e5f528618061d694949fd421eb33985d99784f4e90f964545f3e6abcdd010234bf8f603cc02130818a0b5c8c273607ef01eb86c4ffd8b
-
SSDEEP
6144:zhEXQMKZbL21sXRAvJQQirMssssssssUuhPSfMAQ0xhS:zh7H21sX6OQirBsssssssUoSE8hS
Malware Config
Signatures
Files
-
30fd0e9e99afde661d6b463ef09fdf669003e68d5c1fab1adbb03cbc164b4aef.exe windows x86
5d0b7774000cc5a52d9d5400185cf0b9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ResetEvent
GetTempFileNameA
GetTempPathA
SetWaitableTimer
CreateWaitableTimerA
SystemTimeToFileTime
SetEndOfFile
SetFilePointer
CreateFileA
GetDiskFreeSpaceExA
SetFileTime
ReadFile
WriteFile
TlsFree
TlsAlloc
MultiByteToWideChar
lstrlenA
GetShortPathNameA
FindClose
FindNextFileA
RemoveDirectoryA
SetFileAttributesA
GetFileAttributesA
FindFirstFileA
GetFileSize
CreateDirectoryA
SearchPathA
InterlockedDecrement
GetProcAddress
GetModuleHandleA
GetSystemTimeAsFileTime
GetProcessTimes
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLastError
CompareFileTime
GlobalMemoryStatusEx
lstrcmpA
lstrcmpiA
SetErrorMode
LoadLibraryA
InterlockedIncrement
SetProcessWorkingSetSize
ExitProcess
GetPrivateProfileStringA
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
VirtualQuery
MoveFileExA
GetWindowsDirectoryA
CopyFileA
GetFileTime
FreeLibrary
LoadLibraryExA
HeapFree
HeapAlloc
GetProcessHeap
DuplicateHandle
GetThreadTimes
LocalFree
LocalAlloc
CreateFileW
GetCurrentThreadId
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
CancelWaitableTimer
GetTickCount
IsBadReadPtr
GetStartupInfoA
IsBadWritePtr
lstrlenW
WideCharToMultiByte
TlsSetValue
Sleep
SetEvent
CreateEventA
DeviceIoControl
GetCurrentProcess
VirtualAlloc
GetSystemTime
VirtualFree
CreateToolhelp32Snapshot
Thread32First
OpenThread
Thread32Next
GetSystemInfo
OpenProcess
CloseHandle
DeleteFileA
WaitForSingleObject
ResumeThread
GetVersionExA
GetCommandLineA
GetModuleFileNameA
TerminateProcess
GetPrivateProfileIntA
user32
GetParent
EmptyClipboard
GetWindowThreadProcessId
IsWindowVisible
GetClassNameA
SendMessageTimeoutA
IsHungAppWindow
IsWindow
MsgWaitForMultipleObjects
GetWindowRect
TranslateMessage
PeekMessageA
CreateWindowExA
PostQuitMessage
DefWindowProcA
RegisterClassExA
LoadCursorA
LoadIconA
GetKeyNameTextA
MapVirtualKeyA
ReleaseDC
DrawTextA
GetDC
LoadStringA
CloseClipboard
GetClipboardData
GetSystemMetrics
SetWindowPos
PostMessageA
OpenClipboard
IsClipboardFormatAvailable
SetClipboardData
IsZoomed
GetWindowLongA
TrackMouseEvent
SetWindowLongA
UnregisterClassA
GetDesktopWindow
SubtractRect
FindWindowExA
InvalidateRect
SetRect
FillRect
SendMessageA
ShowWindow
FindWindowA
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoA
CopyRect
DispatchMessageA
gdi32
DeleteObject
CreateSolidBrush
comdlg32
GetOpenFileNameA
GetSaveFileNameA
advapi32
InitializeSecurityDescriptor
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
RegGetKeySecurity
FreeSid
SetSecurityDescriptorDacl
CopySid
AddAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumKeyA
RegQueryInfoKeyA
RegSetKeySecurity
shell32
SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
ord680
SHBrowseForFolderA
SHGetPathFromIDListA
SHAppBarMessage
SHFileOperationA
SHGetFolderPathA
SHFreeNameMappings
SHGetFileInfoA
ole32
OleInitialize
CoTaskMemFree
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoInitialize
CoCreateInstance
CoUninitialize
OleUninitialize
oleaut32
SysAllocString
SysFreeString
VariantClear
msvcp60
??1_Lockit@std@@QAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0_Lockit@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
wininet
FtpCommandA
InternetQueryOptionA
InternetSetOptionA
InternetCrackUrlA
InternetGetLastResponseInfoA
FtpGetFileSize
HttpQueryInfoA
HttpOpenRequestA
HttpSendRequestExA
InternetOpenA
InternetSetStatusCallback
InternetCloseHandle
InternetReadFileExA
InternetReadFile
HttpEndRequestA
FtpOpenFileA
InternetWriteFile
InternetConnectA
psapi
EnumProcesses
GetModuleBaseNameA
GetProcessMemoryInfo
EnumProcessModules
wintrust
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
urlmon
ObtainUserAgentString
msvcrt
_mbsnbcpy
_ui64toa
strcpy
_except_handler3
_mbsstr
atol
tolower
isspace
isprint
time
srand
rand
__CxxFrameHandler
??2@YAPAXI@Z
_mbsicmp
_beginthreadex
_snprintf
_mbsrchr
memset
strlen
memcpy
strstr
_ftol
fprintf
_strnicmp
fgets
rewind
_mbstok
sprintf
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_mbsnbcat
_atoi64
_mbscmp
wcscmp
wcslen
memcmp
_wcsicmp
strcat
_mbspbrk
_mbschr
_mbsnbicmp
mktime
_vsnprintf
strncpy
free
malloc
_strlwr
strncat
atoi
fclose
_ismbslead
fread
ftell
fseek
fopen
memmove
_ismbcspace
_mbctolower
_mbctoupper
abs
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
shlwapi
PathGetDriveNumberA
PathFindFileNameA
PathFileExistsA
StrToIntExW
PathFindExtensionA
SHGetValueA
PathIsURLA
PathIsRootA
StrStrIA
PathCombineA
netapi32
Netbios
comctl32
ImageList_Duplicate
InitCommonControlsEx
ImageList_Remove
Sections
.text Size: 88KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.crdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE