Static task
static1
Behavioral task
behavioral1
Sample
814bba006e9c0b96b847f659348a43724f1029393e038063a646940417410fc4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
814bba006e9c0b96b847f659348a43724f1029393e038063a646940417410fc4.exe
Resource
win10v2004-20221111-en
General
-
Target
814bba006e9c0b96b847f659348a43724f1029393e038063a646940417410fc4
-
Size
543KB
-
MD5
164c34536d49d36016d778758fa9f011
-
SHA1
3b3407a89058a2fbc0bc489ab2be8367c5b627b8
-
SHA256
814bba006e9c0b96b847f659348a43724f1029393e038063a646940417410fc4
-
SHA512
625354b004aeec1e2965af723630d3a62ac65cd1d210bc0c747fb5be78ff1e97826a443a58b5482ecb3fb55e88868c4ba849f1e00a30a63c568d33a637bc6399
-
SSDEEP
12288:MjfN5GKWpSwLoL8srFH9BWGOLhbYcSuIlOyniA1gMg3DCjptY0akfKViOT0r/lMr:S7uyrOLhbYcSuIlOyniA1gMg3DCjp+0s
Malware Config
Signatures
Files
-
814bba006e9c0b96b847f659348a43724f1029393e038063a646940417410fc4.exe windows x64
27fcb49cc5e0bdf482e71a0bc85708e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcessId
UnregisterWaitEx
FreeLibrary
CloseHandle
LoadLibraryExA
DelayLoadFailureHook
HeapSetInformation
CreateWaitableTimerW
CreateEventW
RegisterWaitForSingleObject
GetLastError
GetModuleHandleW
SetWaitableTimer
GetProcAddress
GetCommandLineW
LocalFree
LocalAlloc
WaitForSingleObject
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
user32
DestroyIcon
SetCursor
PostQuitMessage
GetThreadDesktop
MsgWaitForMultipleObjects
LoadCursorW
GetProcessWindowStation
TranslateMessage
PeekMessageW
GetUserObjectInformationW
EnableWindow
DispatchMessageW
FlashWindowEx
LoadIconW
PostMessageW
msvcrt
_wtoi
?terminate@@YAXXZ
wcsstr
_vsnwprintf
_wtol
??2@YAPEAX_K@Z
__getmainargs
__C_specific_handler
_XcptFilter
_exit
_ismbblead
_cexit
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
??3@YAXPEAX@Z
memset
ole32
CoUninitialize
CoCreateInstance
CoInitialize
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
advapi32
CloseServiceHandle
OpenServiceW
StartServiceW
QueryServiceStatus
CreateWellKnownSid
OpenSCManagerW
rpcrt4
RpcAsyncCompleteCall
RpcBindingFree
RpcBindingFromStringBindingW
I_RpcExceptionFilter
RpcStringFreeW
RpcStringBindingComposeW
RpcBindingSetAuthInfoExW
Ndr64AsyncClientCall
RpcAsyncInitializeHandle
RpcAsyncCancelCall
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 396B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 442B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 500KB - Virtual size: 1.8MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE