Static task
static1
Behavioral task
behavioral1
Sample
4a429f6176b21450d4ed681ee525db0514daea4c1917993cb42aca39db80cc81.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4a429f6176b21450d4ed681ee525db0514daea4c1917993cb42aca39db80cc81.exe
Resource
win10v2004-20220901-en
General
-
Target
4a429f6176b21450d4ed681ee525db0514daea4c1917993cb42aca39db80cc81
-
Size
716KB
-
MD5
0a665e8a145f6a8013198288a1a83910
-
SHA1
d484dada64f78ba1601da450106f7ff93f489b8e
-
SHA256
4a429f6176b21450d4ed681ee525db0514daea4c1917993cb42aca39db80cc81
-
SHA512
9748ef3b8271842102a9a5b193cccc740db227daf28ab23973f749f4f77b2b80a8212243a642c6ec64333cb83eaf4ba64091b3cc4feaf7b3cea4006ae28b4157
-
SSDEEP
12288:g2GWTtmAtNhaM9Fa913gDM0kag3jPOYyPE5MBniq/at7p9kGvl4BD59AerG://xRNhn7a913gDbka6PVq/23vl4FfAM
Malware Config
Signatures
Files
-
4a429f6176b21450d4ed681ee525db0514daea4c1917993cb42aca39db80cc81.exe windows x86
a1ed0a0e7b321a2b20cd7f4418140922
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SetUnhandledExceptionFilter
IsWow64Process
GetCurrentProcess
GetVersionExW
LoadLibraryW
GetSystemDirectoryW
SetProcessWorkingSetSize
HeapCompact
GetProcessHeap
CloseHandle
WaitForSingleObject
CreateProcessW
FreeLibrary
GetProcAddress
GetLastError
CreateFileMappingW
GlobalLock
GlobalUnlock
FindClose
FindNextFileW
MoveFileW
FindFirstFileW
FindCloseChangeNotification
FindNextChangeNotification
FindFirstChangeNotificationW
CreateDirectoryW
GlobalFree
GlobalAlloc
OpenProcess
GetModuleHandleW
CreateEventW
lstrlenW
EnterCriticalSection
LeaveCriticalSection
SetEvent
GetModuleFileNameW
Sleep
GetCommandLineW
GetCurrentThreadId
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
CreateMutexW
OpenFileMappingW
HeapAlloc
HeapFree
CompareStringW
GetStringTypeW
GetLocaleInfoW
LocalAlloc
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
LoadLibraryA
user32
CreatePopupMenu
AppendMenuW
EnableMenuItem
SetMenuDefaultItem
CheckMenuItem
SetRect
GetCursorPos
TrackPopupMenu
DestroyMenu
SendMessageW
RedrawWindow
EnumDisplayMonitors
FillRect
SetFocus
SetCapture
SetRectEmpty
LoadCursorW
SetCursor
DefWindowProcW
ShowWindow
WindowFromPoint
IsChild
RegisterWindowMessageW
LoadIconW
RegisterClassExW
CreateWindowExW
SetForegroundWindow
GetDC
OpenClipboard
EmptyClipboard
RegisterClipboardFormatW
IsRectEmpty
CloseClipboard
ReleaseDC
DestroyWindow
PostQuitMessage
LoadImageW
RegisterHotKey
GetMessageW
UnregisterHotKey
DispatchMessageW
PeekMessageW
TranslateMessage
MsgWaitForMultipleObjects
InvalidateRect
GetSysColorBrush
FrameRect
InflateRect
BeginPaint
EndPaint
UnionRect
GetWindowThreadProcessId
AllowSetForegroundWindow
SendMessageTimeoutW
LoadStringW
MessageBoxW
PostMessageW
SystemParametersInfoW
SetClipboardData
msvcr90
__CxxFrameHandler3
_controlfp_s
_invoke_watson
_crt_debugger_hook
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
vswprintf_s
wcscpy_s
??_U@YAPAXI@Z
free
_CxxThrowException
memcpy
_snwprintf_s
wcsstr
swprintf_s
wcscat_s
memset
?_type_info_dtor_internal_method@type_info@@QAEXXZ
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 169KB - Virtual size: 169KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 500KB - Virtual size: 1.6MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE