Static task
static1
Behavioral task
behavioral1
Sample
510a26358119447cf235e04d333eae5d8f848a203b7a9ef770bf0551c909c2c6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
510a26358119447cf235e04d333eae5d8f848a203b7a9ef770bf0551c909c2c6.exe
Resource
win10v2004-20220812-en
General
-
Target
510a26358119447cf235e04d333eae5d8f848a203b7a9ef770bf0551c909c2c6
-
Size
1.9MB
-
MD5
9bd13047c3f918fa25aa303aa650f36a
-
SHA1
eb483813c4c830d1b3a422d203e8b95b43d35180
-
SHA256
510a26358119447cf235e04d333eae5d8f848a203b7a9ef770bf0551c909c2c6
-
SHA512
c4b334f3693ca3b21ad40411b14469be96b76f6c23bf8dc000cf501b3d1a9b5d524e5ccf72bd68b7a15ba5325e2f6ced1473fc0c47fd051e29cde5839474114e
-
SSDEEP
24576:R/QrzO39ZkWgwDvh9VEUbZ3jXuOcZf4cEH93+9TyviwN+EQbKCCSKR3Mi2fg8Z+8:7vJoZaJS2ZsEQG3M3JZ5R6qFmdgQSr
Malware Config
Signatures
Files
-
510a26358119447cf235e04d333eae5d8f848a203b7a9ef770bf0551c909c2c6.exe windows x86
d8b2097440eda10de91f735c49332455
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SystemTimeToFileTime
GetCurrentDirectoryW
MultiByteToWideChar
LocalFileTimeToFileTime
GetFileAttributesW
WriteFile
SetFileTime
GetProcAddress
GetModuleHandleW
GetCurrentProcess
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
GetVersionExW
ReadFile
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetFilePointer
CreateFileW
CloseHandle
CreateDirectoryW
WritePrivateProfileStringW
GetModuleFileNameW
DeleteFileW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTempPathW
user32
wsprintfW
advapi32
AdjustTokenPrivileges
RegQueryValueExW
RegCreateKeyW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegSetValueExW
shell32
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
ole32
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemFree
msvcp90
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
msvcr90
_decode_pointer
memset
__CxxFrameHandler3
_ftelli64
sprintf
memmove
free
malloc
_fseeki64
_wfopen
wcsstr
fread
_purecall
??3@YAXPAX@Z
ferror
fwrite
fclose
swscanf_s
_wcsicmp
calloc
??2@YAPAXI@Z
_wpgmptr
_swprintf
wcsrchr
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
memcpy
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ