Static task
static1
Behavioral task
behavioral1
Sample
e462e1df4943897fde6d39c74f225eae5f1ad43969cf917061d5b81ebfab6982.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e462e1df4943897fde6d39c74f225eae5f1ad43969cf917061d5b81ebfab6982.exe
Resource
win10v2004-20221111-en
General
-
Target
e462e1df4943897fde6d39c74f225eae5f1ad43969cf917061d5b81ebfab6982
-
Size
865KB
-
MD5
0c6a3986d7eb12548f97fe6fa04fe5cf
-
SHA1
8fa0579ea73fa3732e6c1c5c39dec786e0441274
-
SHA256
e462e1df4943897fde6d39c74f225eae5f1ad43969cf917061d5b81ebfab6982
-
SHA512
99bf529bbee6f9450045aa8c3d88d032f92df210540d8d8c506722672da47c6ceb90bce47446f9301594e624b3f9247e5c4fa8f5a6c902a4db2935045a855a57
-
SSDEEP
24576:t3twknYSNLhD9soQ03roAEO64icfTxmaL:t3twknYSzuoxNE94iaTxB
Malware Config
Signatures
Files
-
e462e1df4943897fde6d39c74f225eae5f1ad43969cf917061d5b81ebfab6982.exe windows x86
dcb72de1c1c900c99965b6da89bc7036
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSAStartup
recv
bind
listen
select
__WSAFDIsSet
gethostbyname
inet_addr
closesocket
socket
WSACleanup
connect
send
htons
ioctlsocket
accept
gdi32
GetMapMode
SetMapMode
LPtoDP
GetDeviceCaps
DPtoLP
GetStockObject
kernel32
GetStringTypeW
SetFilePointer
IsValidLocale
EnumSystemLocalesA
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetLocaleInfoW
CreateProcessA
Sleep
CreateThread
SetEvent
CloseHandle
TerminateThread
CreateEventA
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTempFileNameA
TerminateProcess
ContinueDebugEvent
SetThreadContext
GetThreadContext
WaitForDebugEvent
GetStartupInfoA
GetTickCount
GetTempPathA
CopyFileA
GetModuleFileNameA
ReadFile
CreateFileA
GetLocalTime
GetLastError
FindClose
FindNextFileA
SetFileAttributesA
CompareStringA
MulDiv
GetVersionExA
WaitForSingleObject
ResetEvent
GetWindowsDirectoryA
GetSystemTime
WriteFile
Process32Next
MoveFileA
Module32First
Process32First
CreateToolhelp32Snapshot
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
ReleaseMutex
GetExitCodeProcess
GetCommandLineA
CreateMutexA
GetEnvironmentVariableA
GetModuleHandleA
OpenProcess
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetFileType
SetHandleCount
GetCurrentDirectoryA
GetFullPathNameA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
GetStdHandle
VirtualAlloc
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
FindFirstFileA
CreateDirectoryA
GetLocaleInfoA
GetUserDefaultLCID
VirtualFree
HeapCreate
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
RtlUnwind
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
RaiseException
GetModuleHandleW
ExitProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetFileAttributesA
user32
SetWindowTextA
GetTitleBarInfo
GetDesktopWindow
GetWindowRect
MoveWindow
SetFocus
BeginPaint
EndPaint
ShowWindow
LoadCursorA
RegisterClassExA
CreateWindowExA
TranslateMessage
DispatchMessageA
MessageBoxA
PostQuitMessage
DefWindowProcA
GetWindowDC
CreateIconFromResourceEx
InvalidateRect
UpdateWindow
PostMessageA
GetMessageA
advapi32
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyA
ole32
CreateStreamOnHGlobal
shell32
Shell_NotifyIconA
oleaut32
OleLoadPicture
Sections
.text Size: 751KB - Virtual size: 751KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 82KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE