Static task
static1
Behavioral task
behavioral1
Sample
1e3486911d55191987b544bfda5e22ffd2b769d58f70b61ef72149e8a8cfbf41.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1e3486911d55191987b544bfda5e22ffd2b769d58f70b61ef72149e8a8cfbf41.exe
Resource
win10v2004-20220901-en
General
-
Target
1e3486911d55191987b544bfda5e22ffd2b769d58f70b61ef72149e8a8cfbf41
-
Size
108KB
-
MD5
3b1c352cce489343496394722bd0d070
-
SHA1
cef8f1620f077aa0c05d44b332f1962d69b541d2
-
SHA256
1e3486911d55191987b544bfda5e22ffd2b769d58f70b61ef72149e8a8cfbf41
-
SHA512
ef984b43fd66ed230ae5854f61b70a3f788e5723f631fd2ee560069610cf4150a44c214e79b8b219114ce65126f8419bdd0fb7c367c69090e341f442900e1923
-
SSDEEP
3072:7tEzlttGnXpLDixn9+tOgC+3zoI7h+aS1Gg:7tEoXYneOt+3zo0naGg
Malware Config
Signatures
Files
-
1e3486911d55191987b544bfda5e22ffd2b769d58f70b61ef72149e8a8cfbf41.exe windows x86
e902aa177a11a88ac99991d303c2085b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryW
GetLastError
GetProcAddress
FreeLibrary
IsDebuggerPresent
SetErrorMode
GetCommandLineW
LocalFree
GetCurrentProcessId
CreateFileW
GetCurrentThreadId
GetCurrentProcess
CloseHandle
TerminateProcess
RaiseException
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
user32
MessageBoxW
shell32
CommandLineToArgvW
module
??1CXmlConfig@sqr@@QAE@XZ
?LoadConfig@CXmlConfig@sqr@@QAE_NPBD0@Z
?EnableFindLeakageOnPool@CSqrAllocPoolMgr@sqr@@AAEXPBD@Z
?EnableCatchError@sqr@@YAX_N@Z
?Inst@CSqrAllocPoolMgr@sqr@@SAAAV12@XZ
?SetErrLogEncrypt@sqr@@YAX_N@Z
?SetLogFileInterval@sqr@@YAXI@Z
?Unit@CThreadWatcherMap@sqr@@SAXXZ
??0CJmpBuf@sqr@@QAE@XZ
??1CJmpBuf@sqr@@QAE@XZ
?LongJmp@CJmpStack@sqr@@QAEXPBD0@Z
?GetBuf@CJmpBuf@sqr@@QAEPAY0BA@HXZ
?WatchLeakage_Begin@sqr@@YAXH@Z
?LowerCurThreadPriority@sqr@@YA_NXZ
?GetNode@CXmlConfig@sqr@@ABEPAVTiXmlElement@@ABV?$vector@PBDV?$allocator@PBD@std@@@std@@_N@Z
?GetHDProcessTime@sqr@@YA_KXZ
?CreateGuid@sqr@@YAXQAE@Z
?SetProcessGUID@sqr@@YAXQAE@Z
?SetProcessInitTime@sqr@@YAXXZ
?ErrLogHeadMsg@sqr@@YAXPBD0@Z
?GetProcessStringGUID@sqr@@YAPBDXZ
?GenErr@sqr@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?FetchCurrentRevision@sqr@@YAXPB_W@Z
?FetchCurrentVersion@sqr@@YAXPB_W@Z
??$CStrToValue@_N@@YA_NPBD@Z
?WatchLeakage_End@sqr@@YAXXZ
?GetCurrentRevision@sqr@@YAIXZ
?Reset@CJmpBuf@sqr@@QAEXXZ
??0CError@sqr@@QAE@ABV01@@Z
?GetError@CJmpStack@sqr@@QAEAAVCError@2@XZ
?Inst@CJmpStack@sqr@@SAAAV12@XZ
?HandleMapFile@CMapFileMgr@sqr@@QAEXPB_WI@Z
??1CError@sqr@@QAE@XZ
?Inst@CMapFileMgr@sqr@@SAAAV12@XZ
?AppendInfo@CError@sqr@@QAEXPBD@Z
?U8_to_U16@sqr@@YAPA_WPBD@Z
?SetLogPath@sqr@@YAXPB_W@Z
?ErrorTitle@CError@sqr@@QBEPBDXZ
?U16_to_MB@sqr@@YAPADPB_W@Z
?SetDeCompressFun@sqr@@YAXP6GHPADPAI0IHH@Z@Z
??0CXmlConfig@sqr@@QAE@XZ
?SqrDelete@sqr@@YAXPAXPAVCSqrAllocPool@1@@Z
?SqrNew@sqr@@YAPAXIPAVCSqrAllocPool@1@@Z
?Init@CThreadWatcherMap@sqr@@SAXXZ
?SetCompressFun@sqr@@YAXP6GHPADPAI0IHHH@Z@Z
?FreeUtfCvsDest@sqr@@YAXPAX@Z
?SetErrLogFileName@sqr@@YAXPB_W@Z
msvcp80
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?uncaught_exception@std@@YA_NXZ
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
msvcr80
_wfopen
_setjmp3
_CxxThrowException
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_invalid_parameter_noinfo
fopen
fgets
atol
memmove_s
fclose
puts
_controlfp_s
_wgetcwd
_wchdir
??0exception@std@@QAE@XZ
sprintf
??0exception@std@@QAE@ABQBD@Z
_vswprintf_c_l
??0exception@std@@QAE@ABV01@@Z
_snprintf_s
_wcsdup
??1exception@std@@UAE@XZ
free
?what@exception@std@@UBEPBDXZ
swprintf_s
exit
_set_invalid_parameter_handler
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_set_purecall_handler
__CxxLongjmpUnwind
fprintf
malloc
memset
__iob_func
__CxxFrameHandler3
dbghelp
MiniDumpWriteDump
Sections
.text Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ