Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
General
-
Target
file.exe
-
Size
378KB
-
MD5
af9d46ddea5fff1d052e0213535f7134
-
SHA1
aaf8d0f191d0d25b1ee57115887a2a76cc78f944
-
SHA256
e62ec093ba3a6e4bddc236667d861e4334831e5ee1f123cb17f2e34f93af4d91
-
SHA512
6848b8214b6e7c4a88fabef4397db28b1a1d1ceb6ba1918eaa2264f85abc256d920731996ab456e752bd6ce21926fc6e4007c924303ccfed8a87e7e57defad3d
-
SSDEEP
6144:rcfcps4vEsQbIh68tPo+B7CTByv1XXvmjlazKRPwwibEEpT7dNcaW5O+ANF:rcfHsQcQew+PNXXv8larPYO7d1
Malware Config
Signatures
Files
-
file.exe.exe windows x86
cc3b74212ef03e4841bdf50c2671a6fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MoveFileExA
CreateFileA
GetFileSizeEx
ReadFile
WriteConsoleW
VerifyVersionInfoW
VerSetConditionMask
FormatMessageW
SetLastError
GetEnvironmentVariableA
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObjectEx
Sleep
GetTickCount
HeapSize
GetTimeZoneInformation
FlushFileBuffers
DeleteFileW
GetStringTypeW
QueryPerformanceCounter
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
SetStdHandle
GetFileAttributesExW
HeapReAlloc
SetFilePointerEx
LCMapStringW
CompareStringW
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
GetLastError
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetExitCodeProcess
CloseHandle
WaitForSingleObject
GetTempPathA
HeapFree
HeapAlloc
GetConsoleOutputCP
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
CreateFileW
GetFileType
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetConsoleMode
ReadConsoleW
DecodePointer
advapi32
RegOpenKeyExW
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
RegCloseKey
CryptAcquireContextA
shell32
ShellExecuteExA
ws2_32
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
ioctlsocket
getaddrinfo
getpeername
connect
bind
recv
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockname
freeaddrinfo
getsockopt
crypt32
CryptStringToBinaryA
CertFreeCertificateContext
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
PFXImportCertStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertFindCertificateInStore
CertGetCertificateChain
normaliz
IdnToAscii
Sections
.text Size: 295KB - Virtual size: 295KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ