Static task
static1
Behavioral task
behavioral1
Sample
6c57eb96a5b866834527de0950d4a1c3e3e671925d553188873c89eabdde6736.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6c57eb96a5b866834527de0950d4a1c3e3e671925d553188873c89eabdde6736.exe
Resource
win10v2004-20220901-en
General
-
Target
6c57eb96a5b866834527de0950d4a1c3e3e671925d553188873c89eabdde6736
-
Size
584KB
-
MD5
20ecf3768da796cf6beed0cc772d6491
-
SHA1
814e1ab21aa05ab2f99646f55c68583f1d3a8e80
-
SHA256
6c57eb96a5b866834527de0950d4a1c3e3e671925d553188873c89eabdde6736
-
SHA512
d9f9aeb9e5b6d8502e52f0d2cf9cdec2e3972ca2182ddebacc99dacedece482ce1b11f8d54a0d1edeb4ecdc155abc302477137609a477627eff27db1e0b1e86c
-
SSDEEP
6144:1n8Up6NjHmhwk8pNX3b76bMN47J55RVokEEjUoy5B9HPw3Mmtl4JtutswtVhHuNi:Qlm5Ilr7SD7JjRV3EEjUogBVF0XHuk
Malware Config
Signatures
Files
-
6c57eb96a5b866834527de0950d4a1c3e3e671925d553188873c89eabdde6736.exe windows x86
86dc0edc2316855910bb10af3d8fe8da
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
wcslen
_wcsicmp
wcsstr
NtClose
NtQueryValueKey
NtOpenKey
RtlInitUnicodeString
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlPrefixUnicodeString
RtlEqualUnicodeString
NtQueryDirectoryObject
NtOpenDirectoryObject
NtTerminateProcess
RtlUnhandledExceptionFilter
RtlUnwind
NtQueryVirtualMemory
DbgBreakPoint
RtlAllocateHeap
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams
NtDelayExecution
isprint
swprintf
_allmul
_alldiv
NtReadFile
NtDeviceIoControlFile
_chkstk
NtFsControlFile
NtOpenFile
NtQueryInformationFile
NtWriteFile
memmove
NtQueryVolumeInformationFile
RtlOemToUnicodeN
RtlMultiByteToUnicodeN
RtlUnicodeToOemN
RtlUnicodeToMultiByteN
sprintf
_wcsupr
_wcslwr
wcscmp
wcsspn
atol
RtlFreeUnicodeString
RtlDosPathNameToNtPathName_U
NtShutdownSystem
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQuerySystemTime
NtQuerySystemInformation
NtSetInformationFile
NtCreateFile
RtlValidRelativeSecurityDescriptor
RtlExpandEnvironmentStrings_U
NtSetThreadExecutionState
_aulldiv
RtlFreeHeap
RtlSizeHeap
qsort
NtDisplayString
NtWaitForMultipleObjects
NtCreateEvent
RtlFormatMessage
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFindMessage
wcscpy
wcsncmp
RtlQueryRegistryValues
RtlWriteRegistryValue
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlAddAce
RtlCopySid
RtlLengthSid
RtlQueryInformationAcl
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
RtlNewSecurityObject
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlCreateSecurityDescriptor
RtlTimeToTimeFields
RtlSystemTimeToLocalTime
_allrem
RtlDecompressBuffer
RtlUpcaseUnicodeString
RtlRaiseStatus
NtTerminateThread
NtSetEvent
NtWaitForSingleObject
NtQueryInformationThread
RtlCreateUserThread
RtlComputeCrc32
DbgPrint
RtlDeleteElementGenericTable
RtlFindSetBits
RtlClearBits
RtlInitializeBitMap
RtlLookupElementGenericTable
RtlNumberOfSetBits
RtlEnumerateGenericTableWithoutSplaying
RtlSetBits
RtlInsertElementGenericTable
RtlInitializeGenericTable
NtQueryPerformanceCounter
Sections
.text Size: 366KB - Virtual size: 365KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.TOT Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE