Static task
static1
Behavioral task
behavioral1
Sample
551b6fec132a2006d85dc4016a68091483fa997db32a448b85893c37d436e14e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
551b6fec132a2006d85dc4016a68091483fa997db32a448b85893c37d436e14e.exe
Resource
win10v2004-20221111-en
General
-
Target
551b6fec132a2006d85dc4016a68091483fa997db32a448b85893c37d436e14e
-
Size
444KB
-
MD5
0a45dacdb1bb13416b192475da949e9e
-
SHA1
2433333596df567b8ed342d19797a6b5322de45b
-
SHA256
551b6fec132a2006d85dc4016a68091483fa997db32a448b85893c37d436e14e
-
SHA512
d0251aaf011e93c0ca82b2a841fbe09a9f339d5efcdf53fe9b60d13a83671e85dd8325888eb445c9793952686b1293be911fe686919a3ef3dcd37a87cbd78539
-
SSDEEP
12288:LjNWbGXmfSsw4dmg4jKh6xTzRx6PZNLXqs76P:JWKA4+h6xTlx6PZRR76P
Malware Config
Signatures
Files
-
551b6fec132a2006d85dc4016a68091483fa997db32a448b85893c37d436e14e.exe windows x86
44c7539d486171fa39a27d22c0583eb1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSARecv
WSAGetOverlappedResult
WSAResetEvent
getsockname
listen
WSASocketA
gethostname
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAGetLastError
WSAEventSelect
getsockopt
WSAStartup
WSACloseEvent
shutdown
closesocket
ioctlsocket
recvfrom
select
sendto
setsockopt
bind
socket
ntohs
htonl
ntohl
WSACreateEvent
inet_addr
accept
gethostbyname
connect
WSASend
htons
iphlpapi
GetAdaptersInfo
kernel32
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LocalFree
GetOverlappedResult
LoadLibraryA
GetProcAddress
FreeLibrary
CreateEventA
CloseHandle
SetEvent
WaitForSingleObject
ResetEvent
InitializeCriticalSection
DeleteCriticalSection
CreateSemaphoreA
GetVersionExA
MultiByteToWideChar
GetLastError
GetVersion
lstrlenA
TerminateProcess
GetCurrentProcess
CreateMutexA
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
ExitProcess
GetFileAttributesExA
InterlockedDecrement
SetProcessPriorityBoost
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
Sleep
GetCurrentThreadId
GetFileSize
CreateFileA
GetTickCount
CreateDirectoryA
ResumeThread
TerminateThread
DeleteFileA
WriteFile
ReadFile
SetFilePointer
user32
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
DefWindowProcA
CreateWindowExA
FindWindowA
RegisterClassExA
SendMessageTimeoutA
advapi32
QueryServiceStatus
InitializeSecurityDescriptor
DeleteService
ControlService
CloseServiceHandle
OpenServiceA
OpenSCManagerA
SetServiceStatus
RegisterServiceCtrlHandlerA
ChangeServiceConfigA
CreateServiceA
StartServiceCtrlDispatcherA
SetSecurityDescriptorDacl
shell32
SHGetFolderPathA
oleaut32
SysFreeString
SysAllocString
VariantClear
kwlogsvr
?Init@CKwLogSvr@@QAEJPAG0@Z
?LogMsg@CKwLogSvr@@QAEJPAG0@Z
??1CKwLogSvr@@QAE@XZ
??0CKwLogSvr@@QAE@XZ
msvcp71
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?_Nomemory@std@@YAXXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@V312@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?clear@ios_base@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
msvcr71
memmove
ceil
sprintf
atoi
strstr
strncmp
fseek
ftell
fflush
vsprintf
fwrite
sscanf
atof
strtoul
_stricmp
printf
_callnewh
memset
??1type_info@@UAE@XZ
__security_error_handler
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__CxxFrameHandler
??3@YAXPAX@Z
??_V@YAXPAX@Z
strncpy
_purecall
_CxxThrowException
_beginthreadex
malloc
free
_except_handler3
??0exception@@QAE@ABV0@@Z
fclose
fread
fopen
_unlink
_snprintf
time
exit
Sections
.text Size: 184KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tc Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE