Static task
static1
Behavioral task
behavioral1
Sample
dcf51048426ca40ebab9ee7b826a8ad99ebc84ac9e8a9dc5c663aacc7961529e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dcf51048426ca40ebab9ee7b826a8ad99ebc84ac9e8a9dc5c663aacc7961529e.exe
Resource
win10v2004-20220812-en
General
-
Target
dcf51048426ca40ebab9ee7b826a8ad99ebc84ac9e8a9dc5c663aacc7961529e
-
Size
152KB
-
MD5
2b326da4812d6a192a7368163b2d2781
-
SHA1
1cb82f0dee324e4d83ee5339af48008fad7c86bc
-
SHA256
dcf51048426ca40ebab9ee7b826a8ad99ebc84ac9e8a9dc5c663aacc7961529e
-
SHA512
b8df2e6af4e4e630e04416962256251746c498c09b12ddd133ba419639d3db44aabafafe79af0db5a58533df191c69bbc22b7d12276f6fb9c43380072783fac8
-
SSDEEP
3072:VJQbH9L+4YAR8gQEBTP0G7EN4ch25O5bwB:4bdi4YAR8wN0ICF5by
Malware Config
Signatures
Files
-
dcf51048426ca40ebab9ee7b826a8ad99ebc84ac9e8a9dc5c663aacc7961529e.exe windows x86
61710635eee38fce96c6351bf6c7a6d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCheckConnectionA
urlmon
URLDownloadToFileA
wtsapi32
WTSEnumerateSessionsA
kernel32
GetExitCodeThread
GetModuleFileNameA
GetVersionExA
CloseHandle
FindResourceA
FreeResource
LoadResource
GetCurrentProcess
Process32First
GlobalLock
CreateRemoteThread
GetWindowsDirectoryA
OpenProcess
GlobalAlloc
VirtualFreeEx
SizeofResource
CreateEventA
TerminateProcess
GlobalUnlock
Module32First
GetLastError
LoadLibraryA
VirtualAllocEx
Process32Next
CreateFileMappingA
LockResource
GetSystemInfo
GetModuleHandleA
CreateToolhelp32Snapshot
Module32Next
WriteProcessMemory
GetPrivateProfileIntA
GetPrivateProfileStringA
GetLocaleInfoA
SetFileAttributesA
GetProcAddress
MultiByteToWideChar
CreateProcessA
Sleep
TerminateThread
WideCharToMultiByte
GetCommandLineA
SetEvent
WaitForSingleObject
FreeLibrary
UnmapViewOfFile
MapViewOfFile
SetEndOfFile
GetProcessHeap
lstrcmpiA
GetStringTypeW
GetStringTypeA
LCMapStringW
GetFileAttributesA
ExitThread
GetCurrentThreadId
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteFileA
GetSystemTimeAsFileTime
CreateDirectoryA
GetStartupInfoA
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetConsoleCP
GetConsoleMode
SetStdHandle
GetFileType
SetFilePointer
SetHandleCount
GetStdHandle
DeleteCriticalSection
ReadFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LCMapStringA
user32
GetMessageA
SetTimer
KillTimer
WaitForInputIdle
TranslateMessage
DispatchMessageA
advapi32
CryptDestroyHash
CryptDecrypt
CheckTokenMembership
FreeSid
CryptCreateHash
CryptEncrypt
AllocateAndInitializeSid
CryptAcquireContextA
CryptReleaseContext
GetTokenInformation
CryptDeriveKey
OpenProcessToken
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
CryptHashData
shell32
CommandLineToArgvW
ShellExecuteExA
Sections
.text Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ