Static task
static1
Behavioral task
behavioral1
Sample
f906656dbdd7fdac72dd236cc72979c3417d77c947501ac2d71f7104139aa890.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f906656dbdd7fdac72dd236cc72979c3417d77c947501ac2d71f7104139aa890.exe
Resource
win10v2004-20221111-en
General
-
Target
f906656dbdd7fdac72dd236cc72979c3417d77c947501ac2d71f7104139aa890
-
Size
1.9MB
-
MD5
093c922eff92a287e011f5c4807b6589
-
SHA1
0d4126aef08d7955e7bb14d1efa0d630c5fd4d8b
-
SHA256
f906656dbdd7fdac72dd236cc72979c3417d77c947501ac2d71f7104139aa890
-
SHA512
b1bd801fdf8b10a83c7ca786248f2865d7e7e9d54e62cfae3a42cf64af567f66f940b59c0fea58112d7e0acca2dadf4093283be97f24994edda7db82dcd3f00a
-
SSDEEP
49152:AM1TCHQ2BhJGauxJEoXqi/4O9l2xuTL/4TV4pj4djW5ulb9bli:AWCHfBhJZux2oai/zlHwTV4+//i
Malware Config
Signatures
Files
-
f906656dbdd7fdac72dd236cc72979c3417d77c947501ac2d71f7104139aa890.exe windows x86
25517175b31158ce674e9e590eb094be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessW
GetCurrentProcess
WaitForSingleObject
GetProcAddress
CreateMutexA
CloseHandle
FreeLibrary
HeapAlloc
HeapFree
InterlockedCompareExchange
GetProcessHeap
Sleep
LoadLibraryA
GetModuleHandleA
GetThreadContext
InterlockedIncrement
InterlockedDecrement
GetModuleHandleExW
GetCurrentThread
VirtualFree
IsBadReadPtr
GetLastError
UnmapViewOfFile
WriteFile
DeleteFileA
ExitProcess
SetUnhandledExceptionFilter
SystemTimeToFileTime
GetTickCount
InitializeCriticalSection
TerminateThread
LeaveCriticalSection
TerminateProcess
GetModuleFileNameW
GetCurrentDirectoryW
SetLastError
EnterCriticalSection
GetTempFileNameA
GetLocalTime
OpenThread
GetProcessId
AddVectoredExceptionHandler
SetCurrentDirectoryW
DeleteCriticalSection
GetCurrentThreadId
GetTempPathA
WideCharToMultiByte
GetFileAttributesA
RemoveDirectoryA
GetFullPathNameW
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
WriteConsoleA
SetFilePointer
ReadFile
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
Sections
.text Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.7MB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ