Static task
static1
Behavioral task
behavioral1
Sample
261a682ec44080826d43992c70d9832924b94b7418525e5afa00ddadec33677d.exe
Resource
win7-20221111-en
General
-
Target
261a682ec44080826d43992c70d9832924b94b7418525e5afa00ddadec33677d
-
Size
714KB
-
MD5
203b64a446dcef79c947c38d98e85180
-
SHA1
53ee17f47ccd1bdae53d91136eae52b451118fde
-
SHA256
261a682ec44080826d43992c70d9832924b94b7418525e5afa00ddadec33677d
-
SHA512
bf5883b81800f00999bc27f108c9034bd2dd5b22075c8b87cf4a4fa44827d70e26e3de39754afdad282f00a962ecc2e0de5d66f6e45245f3510c873e18122d55
-
SSDEEP
12288:k+1vUK5O8wycNelOOl9irfMZUw+SpHLi+XPGjtv0C9TTWx1YK98DOjLfwBPZoF:k+afNelEopHLi+OZv79TT+98DOHwdI
Malware Config
Signatures
Files
-
261a682ec44080826d43992c70d9832924b94b7418525e5afa00ddadec33677d.exe windows x86
752d07152c8f11e9a4c0f5b0ac054edc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winhttp
WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpSetOption
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpSetStatusCallback
WinHttpWriteData
kernel32
SetUnhandledExceptionFilter
Sleep
CreateEventW
WaitForSingleObject
SetEvent
CloseHandle
CreateThread
GetTickCount
CreateDirectoryW
GetTempPathW
GetTempFileNameW
MoveFileW
CreateProcessW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GlobalFree
WaitForMultipleObjects
WriteFile
ReadFile
SetFilePointerEx
SetEndOfFile
CreateFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
WTSGetActiveConsoleSessionId
GetModuleFileNameW
LocalFree
GetModuleHandleW
GetCurrentProcess
GetCurrentProcessId
CreateMutexW
WideCharToMultiByte
MultiByteToWideChar
SetFilePointer
FindClose
FindFirstFileW
GetDriveTypeW
SetErrorMode
GetVersionExW
DeleteFileA
lstrlenW
CreateFileA
GetLocalTime
OutputDebugStringA
ReleaseMutex
DeviceIoControl
SetPriorityClass
InterlockedDecrement
GetCurrentThreadId
SetLastError
TlsFree
lstrlenA
TlsSetValue
FreeLibrary
GetProcAddress
OutputDebugStringW
TlsGetValue
GetLastError
LoadLibraryW
GetLocaleInfoW
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
SetStdHandle
GetProcessHeap
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RaiseException
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetSystemTimeAsFileTime
HeapReAlloc
HeapAlloc
HeapFree
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InterlockedIncrement
InterlockedCompareExchange
user32
MessageBoxA
wsprintfW
advapi32
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
OpenProcessToken
GetTokenInformation
LookupAccountSidW
shell32
SHGetFolderLocation
SHGetPathFromIDListW
ord155
ShellExecuteW
ord680
ole32
CoInitialize
CoCreateInstance
CoSetProxyBlanket
CoTaskMemFree
CoInitializeSecurity
CoUninitialize
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
shlwapi
UrlUnescapeW
PathFileExistsW
wtsapi32
WTSQueryUserToken
psapi
GetModuleFileNameExW
iphlpapi
GetAdaptersInfo
Sections
.text Size: 357KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 195KB - Virtual size: 194KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 10KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE