Static task
static1
Behavioral task
behavioral1
Sample
AdFind.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
AdFind.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
run.bat
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
run.bat
Resource
win10v2004-20221111-en
General
-
Target
32f4b7b56845b1c68dc066389ec709d48835150e6f8781cb938836ea381b88a3.vhd
-
Size
13.0MB
-
MD5
86b415dbf3bf56a7b03e5625a6139de7
-
SHA1
56029454d2616c57830f081ff552484b7f5c4cfd
-
SHA256
32f4b7b56845b1c68dc066389ec709d48835150e6f8781cb938836ea381b88a3
-
SHA512
8272d66f1c2cd04b0f05798565a3ed5b57b8dd9b674376e95a684b471ad3aeeb625dd66c107678bb48d4e2107b88da5398abf7aaebcd8dd8f8bd05a49529ee1e
-
SSDEEP
98304:nGofBLWN29gDeqzHCtYSJ8e9gDeqzHCtYS:nGoNW3HCt7meW3HCt7
Malware Config
Signatures
Files
-
32f4b7b56845b1c68dc066389ec709d48835150e6f8781cb938836ea381b88a3.vhd.vhd
-
out.vhd.vhd
-
$RECYCLE.BIN/S-1-5-21-2691333271-3572924591-1293602303-1000/desktop.ini
-
$RECYCLE.BIN/S-1-5-21-4146211897-1148071999-3005339123-1110/desktop.ini
-
AdFind.exe.exe windows x86
12ce1c0f3f5837ecc18a3782408fa975
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertNameToStrA
CertFreeCertificateContext
CryptDecodeObjectEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
advapi32
ConvertStringSidToSidA
ConvertSecurityDescriptorToStringSecurityDescriptorA
LsaLookupSids
ConvertSidToStringSidA
ConvertStringSidToSidW
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
LsaOpenPolicy
GetLengthSid
LookupAccountSidA
IsValidSecurityDescriptor
IsValidSid
wldap32
ord309
ord215
ord139
ord132
ord12
ord178
ord77
ord141
ord207
ord96
ord146
ord223
ord310
ord41
ord135
ord72
ord304
ord191
ord14
ord147
ord166
ord79
ord36
ord27
ord121
ord13
ord54
ord55
ord205
ord26
ord117
ord119
ord126
ord301
ord93
ord196
ord218
ws2_32
ntohs
kernel32
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadFile
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
CreateFileW
GetConsoleMode
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
HeapFree
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameW
GetConsoleCP
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RaiseException
RtlUnwind
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
GetFileAttributesExA
lstrlenW
GetStdHandle
MultiByteToWideChar
FormatMessageW
GetTimeZoneInformation
LocalFileTimeToFileTime
GetLastError
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
SystemTimeToFileTime
WideCharToMultiByte
GetFileType
CreateDirectoryA
GetSystemTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
FreeLibrary
LoadLibraryA
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
SetEvent
ResetEvent
ole32
CLSIDFromString
StringFromGUID2
user32
LoadStringA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 294KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
System Volume Information/IndexerVolumeGuid
-
System Volume Information/WPSettings.dat
-
run.bat