Static task
static1
Behavioral task
behavioral1
Sample
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe
Resource
win10v2004-20221111-en
General
-
Target
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db
-
Size
180KB
-
MD5
597667895aedbcaa4c6f77b90e9e2994
-
SHA1
681232c7a6f08da5652c775b77f739a8273a96b3
-
SHA256
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db
-
SHA512
6464a0d666a21fdef70bb42cc5d101301353a76c01ad0177dfb0af4f852d706196eda0a5569ad7810070a8a573da0a0cac357e5320b5c232ca18b8519eea7cd0
-
SSDEEP
3072:nyEhVg7DPPiyJajXzsyxwiFdZz2iJHlSRcMgfBRbL:yEhS7DFa8P6dxpl4I
Malware Config
Signatures
Files
-
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe windows x86
4fdb1ae823ab4db0e22308333ee908ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EraseTape
GetProcessIoCounters
TlsGetValue
FindFirstFileExW
CreateJobSet
GetProcessTimes
MulDiv
ResetEvent
GetNamedPipeHandleStateA
LockResource
LocalShrink
UnlockFileEx
GetWriteWatch
SetSystemTimeAdjustment
QueryMemoryResourceNotification
AssignProcessToJobObject
GetProcessHeap
CreateFiberEx
ReplaceFileW
FlushInstructionCache
CreateMemoryResourceNotification
GetModuleFileNameA
ReleaseSemaphore
GetCommandLineW
GetNamedPipeInfo
IsWow64Process
GetThreadPriority
GetFileTime
SetFilePointerEx
GetFileInformationByHandle
ReplaceFileA
TlsSetValue
GetPriorityClass
DecodePointer
GetProcessAffinityMask
InitAtomTable
GetThreadContext
GetThreadSelectorEntry
SetLastError
FreeResource
GlobalCompact
LocalUnlock
GetVersion
SetSystemPowerState
SetHandleCount
CreateIoCompletionPort
SetProcessPriorityBoost
FlushViewOfFile
GlobalUnWire
ClearCommBreak
GetAtomNameW
GetExitCodeThread
CreateFiber
GetProcessId
GetFileSizeEx
PulseEvent
FindVolumeClose
GetHandleInformation
LockFile
FindNextChangeNotification
SetMessageWaitingIndicator
GetTapeParameters
SetProcessWorkingSetSize
SetMailslotInfo
DeleteAtom
GetFileType
CheckRemoteDebuggerPresent
GetCommModemStatus
WTSGetActiveConsoleSessionId
SetInformationJobObject
TransmitCommChar
DisconnectNamedPipe
GetCurrentProcess
GlobalDeleteAtom
ResetWriteWatch
SetProcessShutdownParameters
CreateFileMappingW
FindCloseChangeNotification
GetThreadTimes
OpenProcess
GetFileAttributesExW
GetCommTimeouts
DisableThreadLibraryCalls
ConvertThreadToFiber
GetNamedPipeHandleStateW
GetCurrentThreadId
SetStdHandle
ReleaseMutex
QueueUserAPC
SetTapeParameters
PrepareTape
RequestWakeupLatency
SetCommState
GetStdHandle
GetCurrentThread
PeekNamedPipe
GetProcessHandleCount
GetThreadPriorityBoost
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsAlloc
TlsFree
GetLastError
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WideCharToMultiByte
DeleteCriticalSection
Sleep
HeapFree
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
VirtualAlloc
LoadLibraryA
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
CloseHandle
CreateFileA
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ