Static task
static1
Behavioral task
behavioral1
Sample
94ded745d0b48a3bf8780bcae870165c218bff23f5916d08c9ef15312a8ed98c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
94ded745d0b48a3bf8780bcae870165c218bff23f5916d08c9ef15312a8ed98c.exe
Resource
win10v2004-20221111-en
General
-
Target
94ded745d0b48a3bf8780bcae870165c218bff23f5916d08c9ef15312a8ed98c
-
Size
1.2MB
-
MD5
bdf14c6cfbe64365d12d1c8ef78e46be
-
SHA1
3bd3ccf8c3697c59153ab7d8497260d7d05f42ff
-
SHA256
94ded745d0b48a3bf8780bcae870165c218bff23f5916d08c9ef15312a8ed98c
-
SHA512
b632ab38c65ffb1773952ffab0f92060c0bbd5d2937f5142db240e4d93bb8f78bc13fbeb00798e3f8210893023140c7bd82254b1c43ee866c23116fb933279bb
-
SSDEEP
12288:gGfy6LqpPxyjc9kbmlpdMKMvsrjgiRHKi4r8/D4ujRFtQeJXC1klSrMfoudM:1a6upxyIzPM3yRHsG0ud/BXZS
Malware Config
Signatures
Files
-
94ded745d0b48a3bf8780bcae870165c218bff23f5916d08c9ef15312a8ed98c.exe windows x86
7623943f9e25814d79c7583f9ebc1216
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDriveTypeA
GetDiskFreeSpaceExW
ExpandEnvironmentStringsW
GetPrivateProfileSectionA
DeleteFileA
GetEnvironmentVariableA
SetCurrentDirectoryA
SetEnvironmentVariableA
OutputDebugStringA
GetLastError
CreateDirectoryA
GetFileAttributesA
LocalReAlloc
GetCurrentDirectoryA
GetOverlappedResult
WaitForMultipleObjects
ReadFile
CreateEventA
CreateNamedPipeA
CreateProcessA
WaitForSingleObject
GetSystemDirectoryA
LoadLibraryA
FreeLibrary
LocalAlloc
CloseHandle
CreateFileA
RtlUnwind
IsProcessorFeaturePresent
GetCommandLineA
HeapAlloc
IsDebuggerPresent
HeapCreate
GetModuleHandleW
WriteFile
GetFileAttributesW
GetModuleFileNameW
TlsGetValue
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
Sleep
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetModuleFileNameA
WideCharToMultiByte
GetEnvironmentStringsW
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW
GetProcAddress
MapViewOfFileEx
UnmapViewOfFile
RaiseException
GetProcessHeap
HeapFree
SetFilePointer
InterlockedExchange
InterlockedCompareExchange
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
VirtualFree
GetLogicalDrives
GetModuleHandleA
GetVolumePathNameW
ReadDirectoryChangesW
ResetEvent
VerSetConditionMask
VerifyVersionInfoA
GetStdHandle
RemoveDirectoryA
advapi32
RegSetValueA
RegCloseKey
GetFileSecurityW
GetSecurityDescriptorGroup
RegEnumValueW
RegOpenKeyExW
RegQueryValueExA
RegCreateKeyA
shell32
SHGetFileInfoW
SHFileOperationW
ShellExecuteExW
msvcrt
puts
wcslen
wcscat
strncmp
malloc
strstr
strchr
memset
free
isspace
calloc
mbtowc
localeconv
realloc
strrchr
tolower
isleadbyte
wcstombs
getenv
atoi
memchr
strlen
strncpy
shlwapi
AssocQueryKeyW
AssocQueryStringW
ws2_32
shutdown
WSAAddressToStringA
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSARecvFrom
WSASend
WSASendTo
WSAStringToAddressA
WSAWaitForMultipleEvents
accept
closesocket
connect
freeaddrinfo
getnameinfo
getpeername
getservbyname
getsockname
getsockopt
ioctlsocket
listen
send
socket
setsockopt
Sections
.text Size: 136KB - Virtual size: 134KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ