Behavioral task
behavioral1
Sample
973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6.exe
Resource
win10v2004-20220812-en
General
-
Target
973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6
-
Size
311KB
-
MD5
35a6c83d341f178df35037c17b2c5b38
-
SHA1
49be98b46116143042d1b67c9a420d427b719fc1
-
SHA256
973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6
-
SHA512
4f0f2ab06ccd923628f25c3257a32044d44f0006c10d5483af91fd30d45c33cdd73850bd34e5e053206e43b745bc224e0bb406cdf6880475f828b23a4989267e
-
SSDEEP
6144:nk4jBDrwpAmmgUJOiMtS2xsA3BMj0lMGxaP+nvbYZRUhTR7R+G4y:nfjEiMtSBj0lMiaPgbWRSTf
Malware Config
Signatures
-
Processes:
resource yara_rule sample upx
Files
-
973e452ed356890f8422e7a1a7515bc944f281e26e1380b13ac085091619d4a6.exe windows x86
7c67c62bd48f5a9950bfca32bd7e3f78
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleFileNameW
GetNativeSystemInfo
LoadLibraryW
SetLastError
OutputDebugStringA
FormatMessageW
GetTickCount
SetEvent
GetCurrentThreadId
GetSystemDefaultUILanguage
GetSystemTime
GetSystemTimeAsFileTime
GetFileTime
CreateFileW
GetProcAddress
DeleteFileW
GetThreadLocale
MoveFileExW
CreateDirectoryW
GetTempPathW
LocalFree
CreateWaitableTimerW
CancelWaitableTimer
SetWaitableTimer
LocalAlloc
lstrcmpA
FileTimeToLocalFileTime
FreeLibrary
GetSystemDirectoryW
InterlockedCompareExchange
LoadLibraryA
GetVersion
CreateEventW
GetFileAttributesW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
Sleep
WideCharToMultiByte
DelayLoadFailureHook
GetModuleHandleW
GetModuleHandleA
MultiByteToWideChar
GetVersionExW
InterlockedIncrement
InterlockedDecrement
HeapSetInformation
CreateMutexW
GetLastError
ReleaseMutex
CloseHandle
SetFileTime
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
LoadResource
FindResourceExW
LoadLibraryExW
MapViewOfFile
CreateFileMappingW
GetLocaleInfoW
UnmapViewOfFile
GetUserDefaultUILanguage
FindResourceW
SearchPathW
GetStartupInfoA
gdi32
CreateFontIndirectW
GetObjectW
user32
DestroyMenu
TrackPopupMenu
SetForegroundWindow
GetCursorPos
EnableMenuItem
GetSubMenu
LoadMenuW
MessageBoxW
DefWindowProcW
RegisterClassW
CreateWindowExW
UnregisterClassW
DestroyWindow
LoadImageW
PostThreadMessageW
GetParent
GetMessageW
PostQuitMessage
TranslateMessage
LoadStringW
GetDesktopWindow
SendMessageW
SetWindowTextW
SendDlgItemMessageW
LoadIconW
GetDlgItem
DialogBoxParamW
SetWindowPos
OffsetRect
CopyRect
GetWindowRect
EndDialog
GetSystemMetrics
DispatchMessageW
msvcrt
__crtLCMapStringW
__mb_cur_max
abort
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
__uncaught_exception
___lc_codepage_func
memmove
_controlfp
mbtowc
isleadbyte
_iob
_snprintf
__crtGetStringTypeW
wctomb
ferror
__badioinfo
__pioinfo
_fileno
_lseeki64
_write
_isatty
_vsnwprintf
__pctype_func
_callnewh
_errno
__CxxFrameHandler
malloc
_wtoi
wcsrchr
strcspn
memchr
localeconv
free
setlocale
___mb_cur_max_func
_itoa
___lc_handle_func
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
_waccess
??0exception@@QAE@XZ
_ltow
_ultow
_beginthreadex
_CxxThrowException
??0exception@@QAE@ABV0@@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
_purecall
memcpy
_wcsicmp
memset
wcsncmp
iswspace
_wcsnicmp
__RTDynamicCast
bsearch
ntdll
RtlUnwind
ole32
CoUninitialize
StringFromCLSID
CLSIDFromString
CoCreateInstance
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoInitializeEx
CoInitializeSecurity
shell32
ShellExecuteExW
Shell_NotifyIconW
shlwapi
PathFindExtensionW
AssocQueryStringW
urlmon
URLDownloadToCacheFileW
CoInternetCombineUrl
CoInternetParseUrl
wintrust
WinVerifyTrust
crypt32
CryptMsgGetParam
CertFreeCertificateChain
CryptHashPublicKeyInfo
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertCloseStore
CryptMsgClose
CertFreeCertificateContext
CryptMsgGetAndVerifySigner
CryptQueryObject
CryptDecodeObject
Sections
.text Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE