Static task
static1
Behavioral task
behavioral1
Sample
af2e68ce5c0393d3438ecb4533b3df4d89c129ee95dffd2d3c2e45ca1300b4e7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
af2e68ce5c0393d3438ecb4533b3df4d89c129ee95dffd2d3c2e45ca1300b4e7.exe
Resource
win10v2004-20220812-en
General
-
Target
af2e68ce5c0393d3438ecb4533b3df4d89c129ee95dffd2d3c2e45ca1300b4e7
-
Size
847KB
-
MD5
795b2433a0b89de56e4104ae32a4039c
-
SHA1
96660d6d6ea986935279a9edece2dc131d58e242
-
SHA256
af2e68ce5c0393d3438ecb4533b3df4d89c129ee95dffd2d3c2e45ca1300b4e7
-
SHA512
d4b2079bdff8cf1493d130ca0083c7a05f192bb91fd21f2613b98f02e428d4dfc26959f0f55d5ef5c3d2fe41866136c9a15f9f1c014dcf6f37042209acfd35d7
-
SSDEEP
24576:eRZY6u2GBBFYg9693HBJvaHdNOhYnoxAfwpyC+HWCTvL2:gZY6u/BBFYg9u3HfvaHmBxKi+HWCTvL
Malware Config
Signatures
Files
-
af2e68ce5c0393d3438ecb4533b3df4d89c129ee95dffd2d3c2e45ca1300b4e7.exe windows x86
b9fe47b31da1b7991c0bf91cce725c41
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteProcessMemory
FindVolumeMountPointClose
GetCalendarInfoW
GetCommState
GetCommMask
BeginUpdateResourceA
VirtualAlloc
SetWaitableTimer
LoadLibraryA
GetCommandLineA
RtlCaptureStackBackTrace
RemoveDirectoryW
VerSetConditionMask
SetCommBreak
EnumSystemCodePagesW
IsValidCodePage
GetConsoleTitleW
GetSystemDefaultUILanguage
GetQueuedCompletionStatus
InitializeCriticalSection
ConvertFiberToThread
winmm
midiOutOpen
joyGetDevCapsA
mxd32Message
tid32Message
SendDriverMessage
waveInReset
midiDisconnect
mmsystemGetVersion
waveOutPrepareHeader
timeSetEvent
mixerClose
midiOutPrepareHeader
PlaySoundA
mod32Message
midiConnect
mmTaskSignal
midiInGetErrorTextA
waveOutRestart
midiInGetNumDevs
mmDrvInstall
mciLoadCommandResource
midiOutUnprepareHeader
crypt32
CryptSIPRemoveProvider
CryptMemRealloc
I_CryptGetOssGlobal
CryptMemFree
CertVerifySubjectCertificateContext
CryptMsgGetParam
CertComparePublicKeyInfo
RegCreateHKCUKeyExU
CertDuplicateCertificateContext
I_CryptUnregisterSmartCardStore
CertVerifyCertificateChainPolicy
CertDeleteCRLFromStore
CryptStringToBinaryA
CertEnumSystemStore
CertCreateContext
CertSetCRLContextProperty
CryptInstallDefaultContext
samlib
SamSetInformationDomain
SamCreateAliasInDomain
SamCreateGroupInDomain
SamAddMemberToGroup
SamSetMemberAttributesOfGroup
SamQuerySecurityObject
SamRemoveMemberFromAlias
SamOpenGroup
SamQueryInformationDomain
SamQueryInformationGroup
SamTestPrivateFunctionsUser
SamFreeMemory
SamiEncryptPasswords
SamDeleteAlias
SamShutdownSamServer
Sections
.text Size: 741KB - Virtual size: 740KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ