Static task
static1
Behavioral task
behavioral1
Sample
c2170ba2d3376e1944f1a4f7cfeb69ff2b5e094ba0ab6973e1f8af8e6020698c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c2170ba2d3376e1944f1a4f7cfeb69ff2b5e094ba0ab6973e1f8af8e6020698c.exe
Resource
win10v2004-20221111-en
General
-
Target
c2170ba2d3376e1944f1a4f7cfeb69ff2b5e094ba0ab6973e1f8af8e6020698c
-
Size
92KB
-
MD5
42ae87a8edcbea189c89d709d578dba6
-
SHA1
e994405460cd8c39f7ee44e8cab732cf6ce3cc61
-
SHA256
c2170ba2d3376e1944f1a4f7cfeb69ff2b5e094ba0ab6973e1f8af8e6020698c
-
SHA512
4ef9c76f238e465721489cc7d470fbd0c7cdf59d8b6297c5c198d271238f875e9795c0131b1574b2a4b4767eb7ae450be2b417f967bf56c47beabc77105f000f
-
SSDEEP
1536:Z06IrgIDFtUOwQWtkHkKyLdIOrkT9Er4clME5F0Nh1bfBWbhNq:TID3WLtkYLPrkTdcHGN/bf0bfq
Malware Config
Signatures
Files
-
c2170ba2d3376e1944f1a4f7cfeb69ff2b5e094ba0ab6973e1f8af8e6020698c.exe windows x86
bbd9e0a21398b30f34a86ae5e633ff7b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
mpr
WNetCloseEnum
WNetLogonNotify
WNetLogonNotify
WNetLogonNotify
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetLogonNotify
WNetConnectionDialog
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetCloseEnum
WNetLogonNotify
kernel32
GetSystemTime
LoadLibraryA
ReadProcessMemory
TerminateProcess
VirtualProtect
SleepEx
GetSystemTimeAsFileTime
TerminateProcess
CreateProcessA
CreateProcessW
VirtualProtectEx
Sleep
SleepEx
Sleep
CreateProcessW
WriteProcessMemory
ReleaseMutex
VirtualProtect
VirtualProtect
LoadLibraryExW
GetProcAddress
LoadLibraryA
VirtualProtect
GetProfileIntA
GetBinaryTypeW
LoadLibraryA
GetSystemTimeAsFileTime
WriteProcessMemory
ReadFile
CreateFileA
TerminateProcess
VirtualProtectEx
LoadLibraryExW
LoadLibraryExA
CreateFileA
VirtualProtect
VirtualProtect
GetStartupInfoW
LoadLibraryExA
GetStartupInfoW
WriteProcessMemory
LoadLibraryExW
ReadProcessMemory
GetStartupInfoA
GetStartupInfoA
Sections
.text Size: 4KB - Virtual size: 1024KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
oLF Size: 2KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
Mix Size: 2KB - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.rsrc Size: 79KB - Virtual size: 78KB
IMAGE_SCN_MEM_READ