Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.not-a-virus.RiskTool.Win32.Agent.anpo.3985.26168.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.not-a-virus.RiskTool.Win32.Agent.anpo.3985.26168.dll
Resource
win10v2004-20221111-en
General
-
Target
SecuriteInfo.com.not-a-virus.RiskTool.Win32.Agent.anpo.3985.26168.exe
-
Size
1.1MB
-
MD5
f30c331e9697a92a847b39168c056283
-
SHA1
fbde1a8b3edbe23763d0551bfa075f578ca578dd
-
SHA256
f20dcb608f60486aaf385348048cd340b41e929ec14bc59fbb58e33c106a7ae6
-
SHA512
02d1e6e000235727f527d9710c676a7a26c101a5f17ba5e900d078296d4444b36e8aa73461b9b8933305df8652d75c8b2d823cdc4666b5138b0df49eae38bf5a
-
SSDEEP
12288:2M+t4646v7nbX+n8iuEqFR+ZSwiImakYIXcdb+v+MLAioiiomDp:Et46xOn8HFRsU+8m
Malware Config
Signatures
Files
-
SecuriteInfo.com.not-a-virus.RiskTool.Win32.Agent.anpo.3985.26168.exe.dll windows x86
eb64368ee3257c14a038edaa28158029
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
user32
mouse_event
msvcp140
?_BADOFF@std@@3_JB
urlmon
URLOpenBlockingStreamA
d3dx9_43
D3DXCreateLine
d3d9
Direct3DCreate9
vcruntime140
memset
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-runtime-l1-1-0
_cexit
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
_except1
Sections
.MPRESS1 Size: 33KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE