Static task
static1
Behavioral task
behavioral1
Sample
a7af1098985e1d3e4b19660298a3099af6fe41946fa26d86f0c5ca07d02db7a4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a7af1098985e1d3e4b19660298a3099af6fe41946fa26d86f0c5ca07d02db7a4.exe
Resource
win10v2004-20220812-en
General
-
Target
a7af1098985e1d3e4b19660298a3099af6fe41946fa26d86f0c5ca07d02db7a4
-
Size
320KB
-
MD5
527b6423153c11cd0e6f4013fb637ad0
-
SHA1
c7ac46ffc8b9df7ede19df9c72ac9d6389c04118
-
SHA256
a7af1098985e1d3e4b19660298a3099af6fe41946fa26d86f0c5ca07d02db7a4
-
SHA512
db99e6abaa1ce5fbed9d179cdfa6299005ef1e552bd4216c66d730b871ac8fc728db3c616eb1560d72648cc0a3a028c51520a259251954b5e643b107acd7be0c
-
SSDEEP
6144:KOHa2kFOgQUD//KGQLkz7/JXLl+DJoTBq5R50dqOMmqMfy7tsqESsQLH5AdZ:KO6XFOeD//KzLkvxXLl+DJoTs5RWPqMH
Malware Config
Signatures
Files
-
a7af1098985e1d3e4b19660298a3099af6fe41946fa26d86f0c5ca07d02db7a4.exe windows x86
351eb3b8caab398f03a53a7730291d4c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
dbghelp
SymCleanup
SymSetOptions
SymInitialize
SymGetModuleInfoW
SymLoadModule
wininet
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
psapi
GetModuleFileNameExA
comctl32
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_Create
kernel32
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
IsDebuggerPresent
SetUnhandledExceptionFilter
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetModuleHandleW
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
GetTickCount
SetCurrentDirectoryW
FindResourceW
OpenThread
ReadProcessMemory
WriteProcessMemory
CloseHandle
CreateThread
OpenProcess
lstrlenW
lstrcatW
DeleteFileW
CopyFileW
LoadLibraryW
FindFirstFileW
FindNextFileW
GetExitCodeProcess
FindClose
TerminateProcess
lstrcpyW
VirtualQueryEx
SetEvent
CreateFileA
WaitForSingleObject
CreateProcessW
SizeofResource
LockResource
LoadResource
FindResourceExW
FreeLibrary
GlobalFree
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
GlobalLock
GlobalUnlock
GetLastError
WideCharToMultiByte
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeResource
CreateEventW
Sleep
CreateFileW
WriteFile
DeleteCriticalSection
InterlockedCompareExchange
ReadFile
SetFilePointer
GetProcAddress
GetFileSize
GetTempPathW
CreateDirectoryW
GetModuleFileNameW
GetPrivateProfileSectionW
GetVersionExW
GetThreadSelectorEntry
GetFileAttributesW
GetCurrentProcessId
GetCurrentThreadId
MultiByteToWideChar
InitializeCriticalSection
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetProcessTimes
GetCurrentProcess
GetSystemTimeAsFileTime
SetFileAttributesW
VirtualQuery
MoveFileW
UnhandledExceptionFilter
GetStartupInfoW
RaiseException
user32
CreateWindowExW
RegisterClassExW
GetClassInfoExW
DefWindowProcW
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
IsWindow
GetDC
ReleaseDC
OpenClipboard
RegisterClipboardFormatW
CallWindowProcW
InvalidateRect
MapDialogRect
DestroyWindow
MapWindowPoints
SetWindowLongW
ClientToScreen
KillTimer
GetKeyState
MessageBoxW
SetDlgItemTextW
GetWindow
DialogBoxParamW
GetWindowTextW
SetTimer
GetWindowTextLengthW
CloseClipboard
SetClipboardData
EnableWindow
EmptyClipboard
SendDlgItemMessageW
GetDesktopWindow
PostMessageW
EndDialog
DrawIconEx
GetDlgItem
GetClientRect
ShowWindow
LoadImageW
SetWindowPos
SetWindowTextW
SendMessageW
LoadIconW
UnregisterClassA
GetWindowRect
gdi32
GetStockObject
DeleteObject
SetTextColor
advapi32
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
shell32
ord155
SHBindToParent
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderPathW
ole32
DoDragDrop
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
oleaut32
SysStringLen
SysStringByteLen
SysAllocString
SysFreeString
SysAllocStringByteLen
gdiplus
GdiplusShutdown
GdipCreateFromHDC
GdipDisposeImage
GdipDeleteGraphics
GdipDrawImageRectI
GdipLoadImageFromStreamICM
GdiplusStartup
GdipCloneImage
GdipImageSelectActiveFrame
GdipGetImageHeight
GdipGetImageWidth
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipAlloc
GdipFree
shlwapi
PathFileExistsW
msvcp80
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
msvcr80
_wcslwr_s
?what@exception@std@@UBEPBDXZ
wcsrchr
??1exception@std@@UAE@XZ
??_V@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
wcschr
_vscwprintf
_CxxThrowException
_mbscmp
vswprintf_s
iswspace
_wcsicmp
strtoul
fprintf
_wfopen
fseek
??2@YAPAXI@Z
_snprintf
??0exception@std@@QAE@ABQBD@Z
_time32
_snwprintf
_mbslwr_s
malloc
ftell
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_mbsstr
??0exception@std@@QAE@XZ
swscanf
_invalid_parameter_noinfo
wcsncmp
__wargv
_crt_debugger_hook
__argc
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
free
vsprintf_s
fwrite
fclose
_beginthreadex
isspace
strncmp
strchr
strrchr
atoi
_gmtime32
wcscpy_s
wcsstr
wcscat_s
fread
iswdigit
iswalpha
iswalnum
memmove
_vsnprintf_s
isalpha
isalnum
tolower
wcsncpy
_wtoi
memset
memcpy
__CxxFrameHandler3
_unlock
__dllonexit
_encode_pointer
_time64
??3@YAXPAX@Z
_purecall
memmove_s
memcpy_s
srand
_vscprintf
_lock
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
crypt32
CertGetNameStringW
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvCertFromChain
Sections
.text Size: 160KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ