Static task
static1
Behavioral task
behavioral1
Sample
f56b08b4a564f46039549e0cf665e7f96e48be70633ce0fae9f5084dafaca85b.exe
Resource
win7-20221111-en
General
-
Target
f56b08b4a564f46039549e0cf665e7f96e48be70633ce0fae9f5084dafaca85b
-
Size
354KB
-
MD5
5d078c7779037725a77885b486c4c2d6
-
SHA1
91256f2e8916de628ad318ae011d5f12fe43993c
-
SHA256
f56b08b4a564f46039549e0cf665e7f96e48be70633ce0fae9f5084dafaca85b
-
SHA512
9b679a55c2d19ec524deaf10f5f2f262d025ca1852e2bdaece4e296cd6a7d8c7e42ec3f381c4c33d0baa001b5d968d1759593c2cb74ea4ad3eb49bffa6727a39
-
SSDEEP
6144:tLzq//nkdgd+Sds/r3K6B7YQkvjqAQg8fOeE/Vap9:tLzq3ntd+Tr3Kq7YQkxve2g9
Malware Config
Signatures
Files
-
f56b08b4a564f46039549e0cf665e7f96e48be70633ce0fae9f5084dafaca85b.exe windows x86
a0ac44b2395708f0ead5d5c692ad000d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileA
FindFirstFileA
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
LocalFree
CopyFileA
GetPrivateProfileIntA
GetTempFileNameA
GetEnvironmentVariableA
GetVersionExA
WritePrivateProfileStringA
GetLastError
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
RaiseException
WaitForSingleObject
InterlockedDecrement
lstrcmpiA
SetEvent
CreateThread
CreateEventA
FindClose
GetModuleHandleW
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
Sleep
GetCurrentThreadId
GetCommandLineA
ReleaseMutex
OpenMutexA
OpenEventA
GetUserDefaultLCID
GetCurrentProcessId
GetTickCount
GetFileType
SetHandleCount
GetProcessHeap
FlushFileBuffers
lstrlenA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
GetTempPathA
DeleteCriticalSection
QueryPerformanceCounter
WriteFile
OutputDebugStringA
CreateFileA
SetFilePointer
GetModuleHandleA
GetModuleFileNameA
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InterlockedIncrement
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InterlockedExchange
SetConsoleCtrlHandler
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetStringTypeW
GetStringTypeA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
GetStdHandle
IsValidLocale
EnumSystemLocalesA
GetSystemTimeAsFileTime
RtlUnwind
GetTimeFormatA
GetDateFormatA
HeapAlloc
HeapFree
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
FatalAppExitA
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetLocaleInfoA
user32
CharNextA
GetMessageA
PostThreadMessageA
DispatchMessageA
CharNextW
MessageBoxA
advapi32
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorA
shell32
SHFileOperationA
ole32
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc
StringFromGUID2
oleaut32
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString
SysReAllocString
SysAllocStringLen
CreateErrorInfo
VariantClear
GetErrorInfo
VariantChangeType
VariantInit
SetErrorInfo
shlwapi
SHDeleteKeyA
Sections
.text Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE