Static task
static1
Behavioral task
behavioral1
Sample
0481a67af4acae3cc2dd34a31a18116fe30f0e56004a9f63169c820fbef8d15a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0481a67af4acae3cc2dd34a31a18116fe30f0e56004a9f63169c820fbef8d15a.exe
Resource
win10v2004-20220812-en
General
-
Target
0481a67af4acae3cc2dd34a31a18116fe30f0e56004a9f63169c820fbef8d15a
-
Size
635KB
-
MD5
4def84550f9eb451d72fa6716e20c510
-
SHA1
fac09bb470fddf69625bb1cad67adbefb7e04002
-
SHA256
0481a67af4acae3cc2dd34a31a18116fe30f0e56004a9f63169c820fbef8d15a
-
SHA512
32c736ebc21ac21b67e8d88ba45ade703c25a648972612c8bd58e4cafe5e31843df87860cea08c23b5c753bf8383c2d2b25ed831298807aa1e3ff49e11a264b8
-
SSDEEP
6144:CdLjJ2M4qdiG6wKt6wVXHgQ3Zcfhfi4Che+/xmbas2E++P0PzJCwF4PimfhR/NvZ:/yV6wKtVXHl0h64Clxmbas2JG7hLFyoJ
Malware Config
Signatures
Files
-
0481a67af4acae3cc2dd34a31a18116fe30f0e56004a9f63169c820fbef8d15a.exe windows x86
73d5b99581b661c396f26b1627af4eca
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
_wcsicmp
_wcsupr
_allmul
_alldiv
NtDelayExecution
_stricmp
atoi
NtTerminateProcess
RtlUnhandledExceptionFilter
RtlUnwind
NtQueryVirtualMemory
DbgBreakPoint
RtlAllocateHeap
RtlUnicodeStringToAnsiString
RtlNormalizeProcessParams
wcslen
isprint
swprintf
RtlOemToUnicodeN
RtlMultiByteToUnicodeN
RtlUnicodeToOemN
RtlUnicodeToMultiByteN
sprintf
memmove
_wcslwr
wcscmp
_chkstk
RtlFreeUnicodeString
RtlDosPathNameToNtPathName_U
NtClose
NtShutdownSystem
NtAdjustPrivilegesToken
NtOpenProcessToken
NtQuerySystemTime
NtQuerySystemInformation
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
RtlInitUnicodeString
NtSetInformationFile
NtQueryInformationFile
NtOpenFile
NtWriteFile
NtCreateFile
NtFsControlFile
RtlValidRelativeSecurityDescriptor
RtlExpandEnvironmentStrings_U
NtSetThreadExecutionState
NtReadFile
NtDeviceIoControlFile
NtQueryVolumeInformationFile
NtDisplayString
NtWaitForMultipleObjects
NtCreateEvent
_aulldiv
RtlFreeHeap
RtlSizeHeap
RtlFormatMessage
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFindMessage
wcscpy
wcsncmp
RtlQueryRegistryValues
RtlWriteRegistryValue
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlAddAce
RtlCopySid
RtlLengthSid
RtlQueryInformationAcl
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthSecurityDescriptor
RtlValidSecurityDescriptor
RtlNewSecurityObject
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlCreateSecurityDescriptor
RtlTimeToTimeFields
RtlSystemTimeToLocalTime
NtSetVolumeInformationFile
RtlPrefixUnicodeString
NtQueryValueKey
NtOpenKey
_allrem
RtlDecompressBuffer
RtlUpcaseUnicodeString
RtlRaiseStatus
NtTerminateThread
NtSetEvent
NtWaitForSingleObject
NtQueryInformationThread
RtlCreateUserThread
RtlComputeCrc32
DbgPrint
RtlDeleteElementGenericTable
RtlFindSetBits
RtlClearBits
RtlInitializeBitMap
RtlLookupElementGenericTable
RtlNumberOfSetBits
RtlEnumerateGenericTableWithoutSplaying
RtlSetBits
RtlInsertElementGenericTable
RtlInitializeGenericTable
NtQueryPerformanceCounter
Sections
.text Size: 358KB - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE