Static task
static1
Behavioral task
behavioral1
Sample
f26178289e288e7431ad3760a2adc5b510d39e27dfda0b7294be8efaa8437cd0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f26178289e288e7431ad3760a2adc5b510d39e27dfda0b7294be8efaa8437cd0.exe
Resource
win10v2004-20221111-en
General
-
Target
f26178289e288e7431ad3760a2adc5b510d39e27dfda0b7294be8efaa8437cd0
-
Size
87KB
-
MD5
505a994654244137b7ba681bffd3e5f6
-
SHA1
2bab21fb96587082a00d9c3455f0e5ab99c9c886
-
SHA256
f26178289e288e7431ad3760a2adc5b510d39e27dfda0b7294be8efaa8437cd0
-
SHA512
6caeefe5d6901a9431fe8872716d048156c5f81b68d2a91c99a1e427e2e1452edafcea739b14fcfb0baa8d38f634fc892dba8aeaef99650f433b0a0b5d412bf3
-
SSDEEP
1536:aDbmvKdoA5roBgJbrHVhD/lDW0K7xa7vcuTHuGDE9e7MSbnbkLnbkWZ+GdWig8:aJdxjlD/DrOxCkuTHuFEISbnUnv4GdWi
Malware Config
Signatures
Files
-
f26178289e288e7431ad3760a2adc5b510d39e27dfda0b7294be8efaa8437cd0.exe windows x86
0ae70b8a55b52cf204df26ac5e0e5c57
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
BuildCommDCBAndTimeoutsA
GetNamedPipeHandleStateW
IsBadHugeWritePtr
GetCommandLineW
EnumCalendarInfoW
ReleaseSemaphore
GenerateConsoleCtrlEvent
SetCurrentDirectoryA
VirtualProtectEx
SetFileApisToOEM
BuildCommDCBAndTimeoutsW
VerLanguageNameW
EraseTape
GetNumberFormatA
GetAtomNameW
RtlFillMemory
LocalCompact
GetCurrentDirectoryA
DeleteFiber
GetFileTime
GetProcessPriorityBoost
IsBadHugeReadPtr
HeapValidate
GlobalSize
GetFileAttributesExW
ExpandEnvironmentStringsW
QueryPerformanceFrequency
EnumResourceTypesA
GetExitCodeThread
SetConsoleActiveScreenBuffer
GetPrivateProfileIntW
GetVersionExW
FormatMessageA
WaitForDebugEvent
LockFile
GetStringTypeExA
HeapWalk
FreeLibraryAndExitThread
GetHandleInformation
FindResourceExA
WaitForMultipleObjects
FlushInstructionCache
SystemTimeToTzSpecificLocalTime
DebugActiveProcess
EnumResourceNamesA
CallNamedPipeW
WriteFile
WaitCommEvent
FatalExit
CreateMailslotW
GlobalWire
MapViewOfFileEx
BackupSeek
LocalUnlock
LoadLibraryExA
TransmitCommChar
GetThreadContext
TerminateProcess
GetPrivateProfileSectionA
IsBadReadPtr
ContinueDebugEvent
GetDiskFreeSpaceA
CreateEventW
lstrcmpiW
GetProfileIntW
WriteProfileStringA
GetCommState
GetDevicePowerState
WriteConsoleW
SetCommBreak
RequestWakeupLatency
WaitNamedPipeW
ReadFile
SetConsoleCursorPosition
GlobalFlags
GetFileSize
PurgeComm
CreateSemaphoreA
ReadDirectoryChangesW
ConvertThreadToFiber
IsBadStringPtrA
BeginUpdateResourceW
GlobalUnfix
LocalFileTimeToFileTime
GetConsoleTitleA
GetShortPathNameA
VirtualProtect
WaitForSingleObjectEx
GetTapeStatus
ResetWriteWatch
VirtualAlloc
EnumResourceLanguagesW
AddAtomA
GetEnvironmentStringsA
ExpandEnvironmentStringsA
LocalFlags
GetSystemDirectoryA
DisableThreadLibraryCalls
GetFileAttributesW
SetConsoleTitleW
UpdateResourceW
WriteConsoleOutputCharacterW
TlsAlloc
GetBinaryTypeA
GetPrivateProfileStringA
GetBinaryTypeW
EnumResourceNamesW
CloseHandle
CopyFileA
AreFileApisANSI
SetThreadLocale
ExitProcess
FoldStringA
GetFullPathNameW
GetOEMCP
WriteConsoleInputA
OpenEventW
SetThreadIdealProcessor
EnumDateFormatsExA
SetCalendarInfoW
GlobalGetAtomNameA
ScrollConsoleScreenBufferA
GetVersion
FreeLibrary
FindNextChangeNotification
VirtualLock
FindFirstChangeNotificationW
LoadLibraryExW
GetCalendarInfoW
GlobalMemoryStatus
RemoveDirectoryA
GlobalHandle
lstrcmp
GetVersionExA
SetConsoleTitleA
ReadConsoleA
GetNamedPipeInfo
EnumSystemCodePagesW
WritePrivateProfileStructA
shlwapi
SHDeleteKeyA
PathIsUNCW
PathMakeSystemFolderW
PathAddBackslashW
StrToIntExA
PathSkipRootW
SHDeleteEmptyKeyA
PathIsDirectoryEmptyW
UrlIsNoHistoryA
PathFindExtensionW
PathIsNetworkPathA
PathRemoveBlanksW
PathIsUNCServerShareA
PathIsURLA
SHCreateStreamOnFileA
PathMatchSpecW
StrCSpnIA
SHRegEnumUSValueW
PathAddExtensionA
SHDeleteValueA
SHAutoComplete
PathIsSystemFolderA
PathParseIconLocationA
SHRegQueryInfoUSKeyW
UrlIsOpaqueW
PathFindSuffixArrayA
StrToIntA
SHGetValueW
SHRegGetUSValueW
PathFindOnPathA
PathIsSameRootW
SHDeleteKeyW
StrFormatByteSizeA
PathParseIconLocationW
SHRegDeleteUSValueA
StrDupW
SHStrDupA
PathBuildRootW
PathFindNextComponentW
PathRenameExtensionW
PathSearchAndQualifyW
SHEnumValueA
PathFindFileNameW
PathIsContentTypeW
StrCmpNIA
StrCmpNA
ColorHLSToRGB
SHQueryInfoKeyW
IntlStrEqWorkerW
PathFileExistsW
SHRegEnumUSKeyW
StrCmpW
UrlCanonicalizeW
AssocQueryKeyA
PathIsFileSpecA
ColorRGBToHLS
PathRemoveBlanksA
StrCSpnIW
PathIsURLW
PathRemoveExtensionW
StrFormatByteSizeW
SHDeleteEmptyKeyW
PathUndecorateA
UrlApplySchemeW
PathIsUNCServerA
UrlIsW
PathRelativePathToA
SHCreateStreamOnFileW
UrlCompareW
wnsprintfA
SHQueryInfoKeyA
PathMakePrettyA
StrRetToBufW
StrNCatA
SHRegEnumUSValueA
SHRegGetBoolUSValueW
PathCombineW
AssocQueryStringA
SHSetValueA
StrTrimA
PathIsRootW
StrToIntW
PathIsNetworkPathW
StrRetToStrA
PathStripToRootA
PathFindSuffixArrayW
PathMakeSystemFolderA
SHOpenRegStream2A
ChrCmpIA
SHSkipJunction
PathIsLFNFileSpecA
PathIsRelativeA
PathSetDlgItemPathW
UrlIsOpaqueA
StrDupA
SHSetThreadRef
SHStrDupW
SHGetThreadRef
PathIsRelativeW
PathStripToRootW
PathIsSystemFolderW
PathGetDriveNumberA
SHIsLowMemoryMachine
StrCatBuffA
PathIsRootA
StrStrIA
StrCatW
SHCopyKeyW
SHGetValueA
PathCompactPathA
StrPBrkA
StrStrW
PathSearchAndQualifyA
UrlCreateFromPathW
PathGetCharTypeW
advapi32
CryptGetDefaultProviderA
SetEntriesInAclW
RegSetValueExW
CryptSetProvParam
AreAllAccessesGranted
DuplicateTokenEx
FreeSid
BuildSecurityDescriptorA
BuildExplicitAccessWithNameW
SetNamedSecurityInfoExA
LookupSecurityDescriptorPartsW
QueryServiceLockStatusA
RegGetKeySecurity
SetSecurityInfoExW
QueryServiceConfigA
GetNamedSecurityInfoExW
LookupPrivilegeDisplayNameW
RegQueryInfoKeyW
RegSetKeySecurity
OpenBackupEventLogW
GetTrusteeTypeW
EqualPrefixSid
CryptDestroyKey
RegNotifyChangeKeyValue
SetSecurityInfoExA
BuildTrusteeWithNameA
LookupPrivilegeNameA
QueryServiceLockStatusW
CreateServiceA
BuildImpersonateTrusteeW
RegCloseKey
RegEnumKeyW
StartServiceW
GetSecurityInfoExA
SetPrivateObjectSecurity
GetCurrentHwProfileW
EnumServicesStatusA
AddAuditAccessAce
CryptDecrypt
RegReplaceKeyW
SetSecurityDescriptorOwner
AllocateAndInitializeSid
AbortSystemShutdownW
DuplicateToken
AccessCheck
QueryServiceConfigW
GetSecurityInfo
DestroyPrivateObjectSecurity
ImpersonateLoggedOnUser
LookupAccountNameW
CancelOverlappedAccess
FindFirstFreeAce
RegConnectRegistryA
BackupEventLogW
GetSecurityDescriptorGroup
RegOpenKeyExW
GetMultipleTrusteeOperationA
RegOpenKeyA
RegSetValueExA
RegQueryValueExA
ConvertAccessToSecurityDescriptorA
GetAclInformation
CryptSetKeyParam
CreateProcessAsUserW
GetTrusteeTypeA
RegisterEventSourceW
RegisterServiceCtrlHandlerW
IsValidSecurityDescriptor
ObjectDeleteAuditAlarmW
RegOpenKeyW
RegSetValueA
SetSecurityDescriptorSacl
DeregisterEventSource
EqualSid
CryptGetProvParam
CryptDuplicateKey
CryptReleaseContext
RegLoadKeyW
GetMultipleTrusteeW
SetKernelObjectSecurity
GetMultipleTrusteeOperationW
SetFileSecurityW
GetSidSubAuthority
ImpersonateNamedPipeClient
BuildImpersonateTrusteeA
SetServiceBits
GetServiceKeyNameA
OpenThreadToken
NotifyChangeEventLog
IsValidSid
CryptSignHashW
GetOverlappedAccessResults
RegisterServiceCtrlHandlerA
CryptVerifySignatureW
SetThreadToken
MakeAbsoluteSD
RegRestoreKeyW
ControlService
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetLengthSid
GetSecurityDescriptorLength
RegDeleteValueW
BuildTrusteeWithNameW
DeleteAce
GetSecurityDescriptorOwner
GetTokenInformation
GetNamedSecurityInfoA
CryptEnumProvidersA
EnumServicesStatusW
BuildTrusteeWithSidW
GetOldestEventLogRecord
GetPrivateObjectSecurity
AccessCheckAndAuditAlarmW
RegSetValueW
CryptDeriveKey
GetAuditedPermissionsFromAclW
CryptImportKey
LockServiceDatabase
GetSecurityDescriptorSacl
ReadEventLogA
ReportEventW
GetAccessPermissionsForObjectW
CryptExportKey
user32
GetComboBoxInfo
GetUpdateRgn
SetMessageQueue
RegisterWindowMessageW
ShowWindow
FlashWindow
EnumDesktopsW
GetClassLongW
MsgWaitForMultipleObjects
SetWindowsHookExA
ReuseDDElParam
DdeCreateStringHandleA
IsWindow
GetShellWindow
DefMDIChildProcA
CreateIconFromResourceEx
GetKeyboardType
CreateMDIWindowA
CopyImage
LoadMenuA
SetMenu
CreateDesktopW
SetPropA
GetCursor
SetWindowsHookA
UnregisterDeviceNotification
IntersectRect
WINNLSEnableIME
GetMenuItemCount
GetSysColorBrush
SetCursorPos
GetProcessWindowStation
SetWindowPlacement
DlgDirListW
EndTask
DdeQueryConvInfo
GetForegroundWindow
GetMenuItemID
CharNextW
GetKeyboardLayoutList
RegisterClassExW
RegisterClassW
IsMenu
CharLowerA
GetUserObjectSecurity
DdeAccessData
SetMessageExtraInfo
GetIconInfo
GrayStringW
RemovePropA
DefFrameProcW
SwitchDesktop
MonitorFromWindow
GetClassNameA
TrackPopupMenuEx
WINNLSGetIMEHotkey
SetMenuContextHelpId
GetMenuStringW
GetMenuItemRect
GetDlgItemTextA
CharLowerW
EnumWindowStationsA
SetWindowRgn
SetScrollPos
CreateAcceleratorTableW
MessageBoxExA
LoadBitmapA
GetUpdateRect
SetDeskWallpaper
CreateIconFromResource
RegisterClassExA
DlgDirListA
CharNextA
LoadKeyboardLayoutW
EnumDisplaySettingsA
SendNotifyMessageW
GetClassInfoA
DdeInitializeA
DdeFreeDataHandle
DdeUnaccessData
GetGuiResources
IsChild
DdeDisconnect
IsCharLowerA
SetFocus
ShowScrollBar
CallMsgFilter
DestroyMenu
WaitMessage
TrackPopupMenu
RealGetWindowClass
LoadStringA
ChangeMenuW
RegisterClipboardFormatA
CreateWindowExW
RegisterHotKey
LookupIconIdFromDirectory
DefFrameProcA
DdeDisconnectList
GetSubMenu
EnumDisplaySettingsExW
ModifyMenuA
GetMenuDefaultItem
ScrollWindow
FreeDDElParam
GetWindowModuleFileNameA
GetNextDlgGroupItem
SendMessageCallbackW
GetWindowWord
GetWindowPlacement
GetWindowTextA
CharToOemBuffW
SetCaretBlinkTime
CreateCaret
UnhookWindowsHookEx
IsCharLowerW
AdjustWindowRectEx
SetScrollRange
CloseClipboard
BroadcastSystemMessage
AnimateWindow
AppendMenuW
CascadeWindows
OpenDesktopA
ole32
PropVariantClear
CoReleaseServerProcess
OleIsRunning
CoReleaseMarshalData
StgCreateDocfile
EnableHookObject
OpenOrCreateStream
DllDebugObjectRPCHook
ReadClassStg
OleCreateLinkFromData
CoTaskMemFree
OleDraw
OleMetafilePictFromIconAndLabel
CoRegisterMallocSpy
UpdateDCOMSettings
CoCreateInstanceEx
CoRegisterChannelHook
CoGetObject
GetDocumentBitStg
UtConvertDvtd32toDvtd16
OleCreateLink
OleCreateFromDataEx
OleCreateFromFileEx
StgGetIFillLockBytesOnFile
CoRegisterMessageFilter
StgIsStorageILockBytes
OleRegEnumFormatEtc
DoDragDrop
CLSIDFromProgID
OleCreateLinkToFileEx
StgOpenStorageOnILockBytes
OleCreateEmbeddingHelper
StgGetIFillLockBytesOnILockBytes
OleIsCurrentClipboard
CoRegisterClassObject
OleFlushClipboard
CoGetMarshalSizeMax
StringFromCLSID
OleDuplicateData
CreateAntiMoniker
StgCreateDocfileOnILockBytes
ReadClassStm
CoLoadLibrary
IsEqualGUID
OleSaveToStream
OleLoad
CoFreeAllLibraries
CoSuspendClassObjects
GetRunningObjectTable
CoAddRefServerProcess
StgIsStorageFile
GetConvertStg
ProgIDFromCLSID
CoGetInstanceFromFile
CoCreateGuid
CoQueryAuthenticationServices
OleSetContainedObject
CoLockObjectExternal
StgOpenStorage
OleQueryLinkFromData
OleCreateMenuDescriptor
OleConvertOLESTREAMToIStorage
CoUnmarshalInterface
CreateOleAdviseHolder
CreateItemMoniker
CoGetTreatAsClass
OleRegGetMiscStatus
ReadFmtUserTypeStg
RevokeDragDrop
CoGetClassObject
CoGetInterfaceAndReleaseStream
OleRegGetUserType
CoQueryClientBlanket
ReadOleStg
WriteClassStg
CoTaskMemRealloc
MkParseDisplayName
CoBuildVersion
StgOpenAsyncDocfileOnIFillLockBytes
CoFreeLibrary
CoUninitialize
OleSave
CreateILockBytesOnHGlobal
BindMoniker
OleNoteObjectVisible
CoResumeClassObjects
CoRevertToSelf
CreateStreamOnHGlobal
UtGetDvtd32Info
CoRevokeMallocSpy
CoQueryProxyBlanket
OleQueryCreateFromData
OleCreateLinkFromDataEx
CreateObjrefMoniker
CreateBindCtx
CoCreateInstance
CoGetInstanceFromIStorage
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 179B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE