Static task
static1
Behavioral task
behavioral1
Sample
3361542dd9fdfd60f1665346db1f61001e5e0b184ae1a161aa79759a7885ae3f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3361542dd9fdfd60f1665346db1f61001e5e0b184ae1a161aa79759a7885ae3f.exe
Resource
win10v2004-20220812-en
General
-
Target
3361542dd9fdfd60f1665346db1f61001e5e0b184ae1a161aa79759a7885ae3f
-
Size
290KB
-
MD5
327bb3403709f1a26a79e0445350d046
-
SHA1
137a88208359fce2c884b02f3d8d623ccae16a7b
-
SHA256
3361542dd9fdfd60f1665346db1f61001e5e0b184ae1a161aa79759a7885ae3f
-
SHA512
74b2c6e65e88df998ee5f2105335c33c6b1a3e6c3f07be9e218c9abef0446862eb64a03a6f836c59ab54c91bd9cf0b6536bf4c7a6cd0109e9c7501e65b56818f
-
SSDEEP
6144:zufsjfQfNe9Uy+VAuut2rIXuBmGfZKG7hTz6mq4r/PA1e3bxE9mKcy:zrQfNe+1Y2lx57R+mqc/IsLKcy
Malware Config
Signatures
Files
-
3361542dd9fdfd60f1665346db1f61001e5e0b184ae1a161aa79759a7885ae3f.exe windows x86
ac70d9695a45958c5f2f85664b99a523
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord2567
ord4390
ord3569
ord2403
ord2015
ord4213
ord2570
ord4392
ord3577
ord616
ord2578
ord4399
ord3718
ord797
ord3562
ord602
ord6303
ord3579
ord543
ord803
ord4847
ord5276
ord3592
ord521
ord4162
ord2110
ord6193
ord6375
ord6266
ord6279
ord6278
ord3867
ord4370
ord2857
ord5977
ord1197
ord3871
ord324
ord641
ord4229
ord2293
ord6211
ord686
ord2445
ord384
ord3296
ord3084
ord1635
ord5949
ord5852
ord4273
ord6655
ord3092
ord941
ord2776
ord1683
ord2371
ord4433
ord2046
ord4425
ord3695
ord496
ord771
ord4254
ord4709
ord3798
ord3870
ord4253
ord768
ord489
ord2729
ord1196
ord2281
ord1258
ord1899
ord3621
ord2406
ord3614
ord1634
ord2854
ord491
ord600
ord1240
ord1173
ord1571
ord1250
ord1248
ord1563
ord1194
ord342
ord1179
ord1570
ord1568
ord1115
ord269
ord826
ord1165
ord6466
ord2294
ord1764
ord6362
ord2405
ord3133
ord4294
ord1143
ord1637
ord2858
ord2430
ord3649
ord2576
ord4215
ord1262
ord2016
ord4214
ord2362
ord2291
ord4272
ord927
ord4198
ord2756
ord1008
ord2520
ord1565
ord5855
ord3979
ord5706
ord2755
ord4124
ord6868
ord2910
ord1644
ord2455
ord818
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord3397
ord609
ord4199
ord6137
ord713
ord414
ord3657
ord5817
ord6379
ord5436
ord6390
ord5446
ord5603
ord5293
ord5617
ord1083
ord998
ord1145
ord3658
ord2820
ord2810
ord2385
ord1128
ord2717
ord4418
ord3948
ord925
ord922
ord2914
ord5568
ord561
ord3733
ord4616
ord3396
ord5710
ord5285
ord5303
ord4692
ord4074
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord815
ord538
ord2821
ord2606
ord5798
ord3087
ord2634
ord6024
ord535
ord1001
ord542
ord802
ord6896
ord6330
ord4219
ord942
ord940
ord6451
ord3281
ord501
ord3697
ord773
ord4970
ord6898
ord861
ord3991
ord3635
ord3365
ord4396
ord2574
ord2644
ord1662
ord3716
ord2859
ord823
ord795
ord693
ord4704
ord540
ord4155
ord6195
ord800
ord858
ord3694
ord4419
ord4829
ord5283
ord1767
ord6048
ord2506
ord4992
ord4848
ord4371
ord5261
ord4352
ord4942
ord4736
ord4899
ord5154
ord5156
ord5155
ord656
ord3605
ord4401
ord692
ord567
ord3634
ord5284
ord2573
ord6051
ord4073
ord1768
ord4395
ord5237
ord2377
ord5157
ord6370
ord4347
ord5286
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord825
msvcrt
malloc
free
wcscoll
wcstol
wcsncmp
_wcsnicmp
_endthread
_beginthread
wcschr
iswspace
_ltow
wcsrchr
wcstoul
_CxxThrowException
_initterm
_adjust_fdiv
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__dllonexit
_onexit
_purecall
__CxxFrameHandler
wcscpy
_itow
__RTDynamicCast
_except_handler3
wcsncpy
_wcsupr
wcsstr
wcscspn
mbstowcs
_wcsicmp
wcscmp
wcscat
wcslen
_stricmp
atl
ord32
ord15
ord22
ord18
ord21
ord16
certcli
CAFreeCertTypeProperty
CAGetCertTypeProperty
CAGetCertTypeExtensions
CAFreeCAProperty
CAGetCAProperty
CAGetCACertificate
CACloseCertType
CAEnumNextCertType
CAGetCertTypePropertyEx
CAGetCertTypeFlags
CAEnumCertTypes
CAFindCertTypeByName
CACountCAs
CAEnumFirstCA
CACloseCA
CAEnumNextCA
kernel32
IsBadWritePtr
LoadLibraryA
lstrcmpiW
CloseHandle
GetSystemWindowsDirectoryW
FormatMessageW
OutputDebugStringA
GetModuleFileNameW
SetLastError
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
CompareStringW
lstrcpyW
lstrlenW
GetVersionExW
MultiByteToWideChar
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetProcAddress
GetCommandLineW
GetModuleHandleW
GetModuleHandleA
GetSystemTime
SystemTimeToFileTime
LocalAlloc
GetSystemTimeAsFileTime
LocalFree
GetLastError
GetCurrentProcess
GlobalFree
SetEvent
OpenEventW
GetComputerNameW
GlobalAlloc
ReadFile
GetFileSize
CreateFileW
GlobalUnlock
GlobalLock
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
CreateEventW
WaitForSingleObject
ResetEvent
UnmapViewOfFile
LoadResource
FindResourceW
MapViewOfFileEx
CreateFileMappingW
GetUserDefaultLangID
GetFileTime
GetFileSizeEx
MapViewOfFile
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsBadReadPtr
GetShortPathNameW
GetWindowsDirectoryW
lstrcpynW
GetComputerNameExW
CompareFileTime
user32
SystemParametersInfoW
ReleaseDC
ShowWindow
GetDlgItem
SetWindowTextW
SendDlgItemMessageW
DestroyIcon
SetMenu
GetDlgCtrlID
GetCursorPos
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
GetDC
GetMenu
GetSystemMetrics
ChildWindowFromPointEx
InvalidateRect
ScreenToClient
GetWindowRect
LoadMenuW
EnableMenuItem
GetWindowLongW
SetWindowLongW
GetSysColor
GetClientRect
LoadStringW
MessageBoxW
wsprintfW
RegisterClipboardFormatW
GetParent
PostMessageW
WinHelpW
SendMessageW
EnableWindow
LoadBitmapW
LoadIconW
GetSubMenu
oleaut32
SafeArrayAccessData
SafeArrayUnaccessData
BstrFromVector
VariantClear
SysAllocString
SysFreeString
ole32
CoInitialize
ReleaseStgMedium
GetHGlobalFromStream
CreateStreamOnHGlobal
CoCreateInstance
CoCreateGuid
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
CLSIDFromString
StringFromCLSID
advapi32
SaferiChangeRegistryScope
SaferiPopulateDefaultsInRegistry
GetLengthSid
CopySid
OpenSCManagerW
EnumServicesStatusW
CloseServiceHandle
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
SaferSetLevelInformation
SaferSetPolicyInformation
LookupAccountNameW
RegDeleteValueW
SaferGetPolicyInformation
SaferGetLevelInformation
GetUserNameW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
SaferCreateLevel
SaferCloseLevel
CryptAcquireContextW
OpenProcessToken
GetTokenInformation
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
cryptui
CryptUIGetCertificatePropertiesPagesW
CryptUIDlgViewCRLW
CryptUIDlgViewCertificateW
CryptUIDlgViewCertificatePropertiesW
CryptUIWizImport
CryptUIDlgViewCTLW
CryptUIWizBuildCTL
CryptUIWizExport
CryptUIWizCertRequest
crypt32
CertDeleteCTLFromStore
CertFreeCertificateChain
CertGetCertificateChain
CryptEnumOIDInfo
CertAddCertificateContextToStore
CertFreeCTLContext
CertEnumPhysicalStore
CertEnumCertificatesInStore
CertAddEncodedCTLToStore
CertControlStore
CryptMsgEncodeAndSignCTL
CertFreeCertificateContext
CertGetCertificateContextProperty
CryptDecodeObject
CertFindExtension
CertDuplicateCertificateContext
CertFindCertificateInStore
CertSetCertificateContextProperty
CertGetEnhancedKeyUsage
CertDeleteCertificateFromStore
CertNameToStrW
CryptFindOIDInfo
CertGetNameStringW
CryptUnregisterOIDInfo
CertEnumSystemStore
CertCloseStore
CertOpenStore
CertGetStoreProperty
CryptFindLocalizedName
CertGetSubjectCertificateFromStore
CertCompareCertificate
CryptFindCertificateKeyProvInfo
CryptMsgOpenToDecode
CryptMsgUpdate
CryptMsgGetParam
CryptMsgClose
CertGetCTLContextProperty
CertFindCTLInStore
CertDuplicateCTLContext
CertDeleteCRLFromStore
CertDuplicateCRLContext
CertAddStoreToCollection
CertAddCRLContextToStore
CertAddCTLContextToStore
CertFreeCRLContext
CertAddSerializedElementToStore
CryptQueryObject
CertGetCRLFromStore
CertEnumCRLsInStore
CertEnumCTLsInStore
gdi32
CreateFontIndirectW
DeleteObject
GetDeviceCaps
ntdsapi
DsUnBindW
DsFreeNameResultW
DsCrackNamesW
DsBindW
wintrust
WTHelperGetFileHash
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
wldap32
ord13
ord18
ord73
ord14
ord16
ord145
ord210
ord208
ord26
ord127
ord140
ord224
ord167
ord41
Sections
.text Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 277KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ