Static task
static1
Behavioral task
behavioral1
Sample
7d3103ff0f3219a21b2ca2f1a123f7a450d2f67e4cd1ddf773466c35c2f0fdb5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7d3103ff0f3219a21b2ca2f1a123f7a450d2f67e4cd1ddf773466c35c2f0fdb5.exe
Resource
win10v2004-20221111-en
General
-
Target
7d3103ff0f3219a21b2ca2f1a123f7a450d2f67e4cd1ddf773466c35c2f0fdb5
-
Size
597KB
-
MD5
229c6f089c5c90d7d0296571b463cb30
-
SHA1
f3ad973e5a0517566d62ea42a6da5de3b24da275
-
SHA256
7d3103ff0f3219a21b2ca2f1a123f7a450d2f67e4cd1ddf773466c35c2f0fdb5
-
SHA512
270e57cca207af95a6deb659210d639b3995f4069a5d3bb71ef5f29d8250cfa7d772560b086133b542b9a73e76b1a2e184ef7a1f2ec223cb906ee03d6bed1e57
-
SSDEEP
6144:93HjHqT+9IPcn78nudnOmQS8g06Q+38EmNfiIN2Ia24vQzQLvj2jvqsO20a0sndE:FOTDPc7IudTc67BmN6IN2Irz0vu+agx
Malware Config
Signatures
Files
-
7d3103ff0f3219a21b2ca2f1a123f7a450d2f67e4cd1ddf773466c35c2f0fdb5.exe windows x86
d3d5e92c368207f09791dd9c5c572a03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
wcslen
_wcsicmp
_wcsupr
NtClose
NtSetInformationFile
NtOpenFile
NtDelayExecution
_stricmp
NtLoadDriver
RtlInitUnicodeString
RtlAdjustPrivilege
NtTerminateProcess
RtlUnhandledExceptionFilter
RtlUnwind
NtQueryVirtualMemory
DbgBreakPoint
RtlAllocateHeap
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams
isprint
swprintf
RtlOemToUnicodeN
RtlMultiByteToUnicodeN
RtlUnicodeToOemN
RtlUnicodeToMultiByteN
sprintf
memmove
_wcslwr
wcscmp
_chkstk
_allmul
_alldiv
RtlFreeUnicodeString
RtlDosPathNameToNtPathName_U
NtShutdownSystem
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQuerySystemTime
NtQuerySystemInformation
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
NtQueryInformationFile
NtWriteFile
NtCreateFile
NtFsControlFile
RtlValidRelativeSecurityDescriptor
RtlExpandEnvironmentStrings_U
NtQueryAttributesFile
NtSetThreadExecutionState
_aulldiv
NtReadFile
NtDeviceIoControlFile
NtQueryVolumeInformationFile
RtlPrefixUnicodeString
NtQueryValueKey
NtOpenKey
NtDisplayString
NtWaitForMultipleObjects
NtCreateEvent
RtlFreeHeap
RtlSizeHeap
RtlFormatMessage
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFindMessage
wcscpy
wcsncmp
RtlQueryRegistryValues
RtlWriteRegistryValue
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlAddAce
RtlCopySid
RtlLengthSid
RtlQueryInformationAcl
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
RtlNewSecurityObject
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlCreateSecurityDescriptor
RtlLocalTimeToSystemTime
_allrem
RtlTimeFieldsToTime
RtlTimeToTimeFields
RtlSystemTimeToLocalTime
NtTerminateThread
NtSetEvent
NtWaitForSingleObject
NtQueryInformationThread
RtlCreateUserThread
RtlUpcaseUnicodeString
RtlComputeCrc32
DbgPrint
RtlRaiseStatus
RtlDecompressBuffer
RtlDeleteElementGenericTable
RtlFindSetBits
RtlClearBits
RtlInitializeBitMap
RtlLookupElementGenericTable
RtlNumberOfSetBits
RtlEnumerateGenericTableWithoutSplaying
RtlSetBits
RtlInsertElementGenericTable
RtlInitializeGenericTable
qsort
NtQueryPerformanceCounter
Sections
.text Size: 379KB - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.TOT Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE