Static task
static1
Behavioral task
behavioral1
Sample
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe
Resource
win10v2004-20221111-en
General
-
Target
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348
-
Size
119KB
-
MD5
46e1676cfc354dae4ae457773d20c2b2
-
SHA1
6515f574701e101b7df0b6306671cb70800359eb
-
SHA256
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348
-
SHA512
1e04f78a01558c6f3e7d6fef718ed3da6559be7185c92f78d9e24b2b3731b2e9b974b5b1f3f0dde63e5116a155c86a60852eff53fb6c726f9cb5590c07c94489
-
SSDEEP
1536:TwbIdIdbNCPoWaPEnw3XW4nKyXsseoiepwQRfl16p8eZk7qjh3rmKPNRsbA5:EPNYnkG4nKyjjw0fGqeZ7jZqMNRsE5
Malware Config
Signatures
Files
-
8dd4bbe4d9d2a935c0f420a09989529830f814a979ff444debc8d98ce557f348.exe windows x86
fd982d2ffc2625d904aa7e652b6bc750
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
SHFileOperationW
ShellExecuteW
SHBrowseForFolderW
ole32
OleInitialize
CoTaskMemFree
CoCreateInstance
OleUninitialize
advapi32
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyW
RegCloseKey
gdi32
SetTextColor
SetBkMode
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
GetDeviceCaps
SetBkColor
SelectObject
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
kernel32
GetStringTypeA
GetStringTypeW
GlobalAlloc
LCMapStringW
LCMapStringA
GetLocaleInfoA
GetModuleFileNameA
GetCommandLineW
FlushViewOfFile
GetExitCodeProcess
SetFileApisToOEM
RemoveVectoredExceptionHandler
GetThreadIOPendingFlag
CloseHandle
GetCurrentThread
FindNextChangeNotification
DecodeSystemPointer
GetVersion
GetNamedPipeInfo
GetProcessAffinityMask
GetNamedPipeHandleStateA
EncodeSystemPointer
SetHandleCount
OpenProcess
GetExitCodeThread
GetCurrentProcess
GlobalUnlock
GetModuleFileNameW
GetProcessId
FindFirstFileExW
GetCommMask
CancelIo
ResetEvent
DisableThreadLibraryCalls
LocalUnlock
CreateTapePartition
GetThreadPriorityBoost
DeactivateActCtx
RtlCaptureStackBackTrace
CreateIoCompletionPort
GetProcessHeap
ConvertFiberToThread
GetFileType
ContinueDebugEvent
GetProcessHandleCount
PeekNamedPipe
GetCommModemStatus
SetStdHandle
GetThreadContext
SetEndOfFile
SetFileValidData
SetProcessPriorityBoost
GetWriteWatch
lstrcpynA
DeleteFileW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
MultiByteToWideChar
ReadFile
WriteFile
MulDiv
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
GlobalFree
WaitForSingleObject
ExpandEnvironmentStringsW
lstrcmpW
lstrcmpiW
lstrcmpA
RemoveDirectoryW
lstrcpyA
GetSystemDirectoryW
GetVersionExW
lstrcpyW
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatW
GetTempFileNameW
lstrcmpiA
CreateProcessW
LoadLibraryW
CreateThread
GlobalLock
GetDiskFreeSpaceW
lstrcpynW
lstrlenW
SetErrorMode
GetTempPathW
GetWindowsDirectoryW
ExitProcess
CopyFileW
GetFileSize
CreateFileW
GetTickCount
Sleep
SetFileAttributesW
CreateDirectoryW
GetLastError
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
GetCommandLineA
GetStartupInfoA
SetUnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ