Static task
static1
Behavioral task
behavioral1
Sample
2b1b6424036722f483bed3422b944d6af169141330067229f12fcf63f2a2f45b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2b1b6424036722f483bed3422b944d6af169141330067229f12fcf63f2a2f45b.exe
Resource
win10v2004-20220812-en
General
-
Target
2b1b6424036722f483bed3422b944d6af169141330067229f12fcf63f2a2f45b
-
Size
5.5MB
-
MD5
fd0235dbf65da4cbb0e21e36e7178478
-
SHA1
1b73fed28199ecbfd44dc3b0b44f46a4d75446ec
-
SHA256
2b1b6424036722f483bed3422b944d6af169141330067229f12fcf63f2a2f45b
-
SHA512
48f5902cb8b644c7c43b8f3238df09609d29dc099fac3b2660bdee8fcda92ffbcd79ff943ad7e2d9d507223f64e407edf1c10989a248115fdb4af673b3a06dd0
-
SSDEEP
98304:r27fshsa5Ca0yng29cEIDG708qbl/1NPyfesbrf0F9g/dZTw/Np/qUk:r2DsheMgyIDGQD5yWgrMFmof/qv
Malware Config
Signatures
Files
-
2b1b6424036722f483bed3422b944d6af169141330067229f12fcf63f2a2f45b.exe windows x86
8c58c1cb49cef7cd274158cbbc86bd0d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFileTimeToFileTime
WaitForSingleObject
GetProcessHeap
HeapAlloc
HeapFree
LoadLibraryA
GetLastError
CreateMutexA
CloseHandle
GetCurrentProcess
GetModuleHandleA
GetVersionExA
GetModuleHandleExW
IsBadReadPtr
GetProcAddress
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetTickCount
EnterCriticalSection
InterlockedCompareExchange
ExitProcess
ResumeThread
SetLastError
VirtualProtect
GetLocalTime
CreateFileW
Sleep
SystemTimeToFileTime
GetProcessId
DeleteCriticalSection
GetCurrentThread
VirtualFree
HeapReAlloc
VirtualAlloc
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
FlushFileBuffers
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
IsProcessorFeaturePresent
RtlUnwind
GetCommandLineA
InterlockedDecrement
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
IsDebuggerPresent
HeapSize
RaiseException
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
GetCurrentThreadId
WideCharToMultiByte
GetFileType
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
advapi32
RegQueryValueExA
RegOpenKeyW
RegEnumKeyA
RegCreateKeyExW
RegQueryValueA
RegCreateKeyW
user32
AppendMenuW
SetWindowPos
PeekMessageA
CreateWindowExA
GetDesktopWindow
GetSystemMetrics
DispatchMessageW
SetForegroundWindow
RegisterWindowMessageW
PostMessageW
GetParent
DispatchMessageA
UpdateWindow
PostQuitMessage
RedrawWindow
MsgWaitForMultipleObjects
PostMessageA
RegisterClassExA
TranslateMessage
LoadIconW
RegisterClassExW
MessageBoxA
GetWindowTextW
LoadIconA
SendMessageA
SendMessageW
GetMessageA
DestroyWindow
Sections
.text Size: 352KB - Virtual size: 351KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 332KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4.8MB - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ