Static task
static1
Behavioral task
behavioral1
Sample
d5ff8e67d3d6305279d9016e8e454728e01b19a16fd4c4fc3610d542759306f2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d5ff8e67d3d6305279d9016e8e454728e01b19a16fd4c4fc3610d542759306f2.exe
Resource
win10v2004-20220901-en
General
-
Target
d5ff8e67d3d6305279d9016e8e454728e01b19a16fd4c4fc3610d542759306f2
-
Size
316KB
-
MD5
3cfd59a4b974589f4042206785c4e69c
-
SHA1
94a9c145d3fb9f0b38f854c76980fb5c173912e9
-
SHA256
d5ff8e67d3d6305279d9016e8e454728e01b19a16fd4c4fc3610d542759306f2
-
SHA512
00ac687489265cf30c2f707350424a6a7adc6cd5819eaec1afa4f69f7b891bf13c28b53de090b9f12663965d232020f36d8d2a51c8b8a2641b08727dfde44af1
-
SSDEEP
6144:WMS204XsqtbR0N5a4UL/bc5PoHk81WwcXlRP2wo8kHDNOo4DGuLrOU7LYn4guC:WMS204ftiN5U/aPLgQY7rULSU7LpU
Malware Config
Signatures
Files
-
d5ff8e67d3d6305279d9016e8e454728e01b19a16fd4c4fc3610d542759306f2.exe windows x86
804fbdee929730fb30ae2b2c70133a84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadConsoleOutputCharacterW
LocalFree
lstrcpyA
PeekConsoleInputA
CreateFileW
GetStringTypeW
LCMapStringW
MultiByteToWideChar
SetStdHandle
SetFilePointer
RtlUnwind
HeapFree
CloseHandle
HeapSize
HeapReAlloc
GetLogicalDrives
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
LoadLibraryW
OutputDebugStringW
WriteConsoleW
FindFirstChangeNotificationA
FindNextFileA
WaitForMultipleObjects
FindNextChangeNotification
LocalAlloc
LoadLibraryA
GetLocalTime
FindClose
VerLanguageNameA
GetProcAddress
GetLastError
GetLogicalDriveStringsA
FindFirstFileA
GetStdHandle
SetThreadLocale
GlobalUnlock
GetSystemDirectoryA
GetVersionExW
Sleep
GetLocaleInfoW
GlobalAlloc
GetDriveTypeA
GetWindowsDirectoryA
ExpandEnvironmentStringsA
HeapQueryInformation
GetSystemTimeAsFileTime
OutputDebugStringA
GetFileType
SetHandleCount
SetLastError
FindCloseChangeNotification
WaitForSingleObject
GlobalLock
SetConsoleTextAttribute
ExitProcess
AllocConsole
GetComputerNameA
HeapAlloc
TlsFree
GetCurrentThreadId
TlsSetValue
TlsGetValue
TlsAlloc
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
FlushFileBuffers
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsBadReadPtr
HeapValidate
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetModuleHandleW
DecodePointer
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
GetNumberOfConsoleInputEvents
user32
GetWindow
UpdateWindow
IsWindowVisible
ActivateKeyboardLayout
SetMenu
GetCursorPos
EndDialog
SetWindowLongW
GetDlgItem
EnableMenuItem
DestroyMenu
MessageBoxA
SetWindowLongA
GetAsyncKeyState
GetWindowTextA
GetMenu
EndPaint
GetWindowRect
IsIconic
LoadIconA
IsWindowEnabled
wsprintfA
SetFocus
SendMessageA
BeginPaint
GetDC
GetForegroundWindow
ReleaseDC
gdi32
GetWindowOrgEx
GetViewportOrgEx
FrameRgn
LineTo
GetWindowExtEx
SetTextColor
DeleteDC
GetDeviceCaps
SetBkMode
DeleteObject
SelectObject
DPtoLP
SetMapMode
CreateCompatibleBitmap
SaveDC
SetViewportExtEx
SetROP2
GetViewportExtEx
TextOutW
GetStockObject
RestoreDC
UpdateColors
CreateSolidBrush
EnumFontsA
TextOutA
MoveToEx
winspool.drv
OpenPrinterA
EnumPrintersA
ClosePrinter
EnumJobsA
advapi32
GetUserNameA
ConvertStringSidToSidW
LookupAccountSidA
GetUserNameW
shell32
SHGetDesktopFolder
SHGetFolderPathA
ole32
CreateILockBytesOnHGlobal
CoInitialize
CoCreateGuid
CLSIDFromString
CoGetClassObject
CoInitializeEx
StringFromCLSID
CLSIDFromProgID
CoUninitialize
CoTaskMemFree
CoCreateInstance
oleaut32
VariantClear
GetActiveObject
VariantChangeType
SysAllocString
VariantInit
LoadTypeLi
RegisterActiveObject
SysFreeString
LoadRegTypeLi
ws2_32
WSAGetLastError
netapi32
NetUserGetInfo
rpcrt4
RpcBindingFromStringBindingA
RpcStringBindingComposeA
RpcBindingFree
wtsapi32
WTSQuerySessionInformationA
WTSFreeMemory
Sections
.text Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 71KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ