Static task
static1
Behavioral task
behavioral1
Sample
293430a373e0e5f552a8791c2ba42f2ff75e48d5e07036095fa57ce266050816.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
293430a373e0e5f552a8791c2ba42f2ff75e48d5e07036095fa57ce266050816.exe
Resource
win10v2004-20220812-en
General
-
Target
293430a373e0e5f552a8791c2ba42f2ff75e48d5e07036095fa57ce266050816
-
Size
180KB
-
MD5
c6f134b71467b6fdfbe311f0422f659c
-
SHA1
9b882b5dddd125d3f670eca3c13658b7252afcda
-
SHA256
293430a373e0e5f552a8791c2ba42f2ff75e48d5e07036095fa57ce266050816
-
SHA512
3ba87e4eb049debe420804438415cd007d1faf9d997be327834addf4c492545d29ea04dd74cfdea95eb335e4a8252d89228d1e410a00748428736c230dd0c488
-
SSDEEP
3072:2yshVg7DPPiyUKs/OIXMhx3zZYKOUrX/n+eOrD+fBRbZ:BshS7DGiuUj/+vrDK
Malware Config
Signatures
Files
-
293430a373e0e5f552a8791c2ba42f2ff75e48d5e07036095fa57ce266050816.exe windows x86
4fdb1ae823ab4db0e22308333ee908ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EraseTape
GetProcessIoCounters
TlsGetValue
FindFirstFileExW
CreateJobSet
GetProcessTimes
MulDiv
ResetEvent
GetNamedPipeHandleStateA
LockResource
LocalShrink
UnlockFileEx
GetWriteWatch
SetSystemTimeAdjustment
QueryMemoryResourceNotification
AssignProcessToJobObject
GetProcessHeap
CreateFiberEx
ReplaceFileW
FlushInstructionCache
CreateMemoryResourceNotification
GetModuleFileNameA
ReleaseSemaphore
GetCommandLineW
GetNamedPipeInfo
IsWow64Process
GetThreadPriority
GetFileTime
SetFilePointerEx
GetFileInformationByHandle
ReplaceFileA
TlsSetValue
GetPriorityClass
DecodePointer
GetProcessAffinityMask
InitAtomTable
GetThreadContext
GetThreadSelectorEntry
SetLastError
FreeResource
GlobalCompact
LocalUnlock
GetVersion
SetSystemPowerState
SetHandleCount
CreateIoCompletionPort
SetProcessPriorityBoost
FlushViewOfFile
GlobalUnWire
ClearCommBreak
GetAtomNameW
GetExitCodeThread
CreateFiber
GetProcessId
GetFileSizeEx
PulseEvent
FindVolumeClose
GetHandleInformation
LockFile
FindNextChangeNotification
SetMessageWaitingIndicator
GetTapeParameters
SetProcessWorkingSetSize
SetMailslotInfo
DeleteAtom
GetFileType
CheckRemoteDebuggerPresent
GetCommModemStatus
WTSGetActiveConsoleSessionId
SetInformationJobObject
TransmitCommChar
DisconnectNamedPipe
GetCurrentProcess
GlobalDeleteAtom
ResetWriteWatch
SetProcessShutdownParameters
CreateFileMappingW
FindCloseChangeNotification
GetThreadTimes
OpenProcess
GetFileAttributesExW
GetCommTimeouts
DisableThreadLibraryCalls
ConvertThreadToFiber
GetNamedPipeHandleStateW
GetCurrentThreadId
SetStdHandle
ReleaseMutex
QueueUserAPC
SetTapeParameters
PrepareTape
RequestWakeupLatency
SetCommState
GetStdHandle
GetCurrentThread
PeekNamedPipe
GetProcessHandleCount
GetThreadPriorityBoost
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsAlloc
TlsFree
GetLastError
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
DeleteCriticalSection
Sleep
HeapFree
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
VirtualAlloc
LoadLibraryA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CloseHandle
CreateFileA
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ