Static task
static1
Behavioral task
behavioral1
Sample
54b6d0d759c04b1114f9c658c79adcb3bc471b11ac540cd334b8c891f50adfdc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
54b6d0d759c04b1114f9c658c79adcb3bc471b11ac540cd334b8c891f50adfdc.exe
Resource
win10v2004-20221111-en
General
-
Target
54b6d0d759c04b1114f9c658c79adcb3bc471b11ac540cd334b8c891f50adfdc
-
Size
676KB
-
MD5
4e8a27ab360cd455abd148c6bf7d21db
-
SHA1
90824d3039b914909596798a1233350fdb851474
-
SHA256
54b6d0d759c04b1114f9c658c79adcb3bc471b11ac540cd334b8c891f50adfdc
-
SHA512
ba06fc9c5692936e34fcc39ec3f489fb114308a6204d0ac398c42410198bda7617025a0a8a0fda4611753f9d4e7bf6e4c7ac472eb11c3964a4b8fe3829cd630c
-
SSDEEP
12288:61otNb/28oHyO3IBfFJbJxPir1/SRDKyCoE5qFpVdh:61otB/xulIBfHXPip/2fC15G3
Malware Config
Signatures
Files
-
54b6d0d759c04b1114f9c658c79adcb3bc471b11ac540cd334b8c891f50adfdc.exe windows x86
6dd4f862bd2e35e64e8fd6d443bede8b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
wcsrchr
wcsncat
swprintf
swscanf
_wtoi
_wcsdup
iswspace
memmove
_ftol
_beginthreadex
_vsnwprintf
_CxxThrowException
_wcsicmp
_purecall
wcslen
realloc
free
malloc
_strdup
wcsncpy
_wcsnicmp
wcscpy
_except_handler3
_controlfp
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
wcscmp
wcscat
__CxxFrameHandler
advapi32
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
CryptEncrypt
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
ConvertSidToStringSidW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
DeregisterEventSource
RegOpenKeyExA
RegQueryValueExA
CryptGenRandom
QueryServiceStatus
QueryServiceConfigW
ChangeServiceConfigW
StartServiceW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegConnectRegistryW
RegQueryValueExW
RegEnumKeyW
OpenProcessToken
IsValidAcl
AddAce
GetAce
GetAclInformation
EqualSid
SetSecurityDescriptorDacl
SetThreadToken
CopySid
GetLengthSid
GetTokenInformation
OpenThreadToken
InitializeAcl
AddAccessAllowedAceEx
AddAccessDeniedAceEx
AddAuditAccessAceEx
AddAccessAllowedObjectAce
AddAccessDeniedObjectAce
AddAuditAccessObjectAce
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
kernel32
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
lstrcpynW
HeapDestroy
lstrcatW
GetModuleFileNameW
FreeLibrary
InterlockedIncrement
InterlockedDecrement
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
GetShortPathNameW
GetCurrentThreadId
HeapAlloc
FlushInstructionCache
GetCurrentProcess
InterlockedExchange
Sleep
WaitForMultipleObjects
GetTickCount
SetEvent
CloseHandle
CreateEventW
WaitForSingleObject
GetCurrentThread
SetEnvironmentVariableW
GetTempPathW
GetEnvironmentVariableW
GetSystemTime
GetLocalTime
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalMemoryStatusEx
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GetCommandLineW
GetFileAttributesExW
GetExitCodeProcess
CreateProcessW
GetUserDefaultLCID
GetTimeZoneInformation
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempFileNameW
WideCharToMultiByte
LocalFree
DuplicateHandle
ReadFile
WriteFile
SetFilePointer
GetFileInformationByHandle
CreateFileW
CopyFileW
SetFileAttributesW
DeleteFileW
MoveFileExW
RemoveDirectoryW
GlobalFree
GetModuleHandleA
GetStartupInfoW
EnterCriticalSection
GetProcessHeap
HeapFree
lstrcpyW
lstrlenW
MultiByteToWideChar
LoadLibraryW
GetProcAddress
lstrcmpiA
SetLastError
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetSystemDefaultLCID
GetUserDefaultUILanguage
GetLocaleInfoW
GetModuleHandleW
FlushFileBuffers
TlsGetValue
TlsSetValue
LocalAlloc
LoadLibraryA
ReleaseMutex
FlushViewOfFile
UnmapViewOfFile
OpenMutexW
CreateMutexW
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
ResetEvent
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
HeapReAlloc
RaiseException
TlsFree
TlsAlloc
ExitProcess
GlobalReAlloc
SetThreadPriority
GetVersionExW
GetSystemTimeAsFileTime
LeaveCriticalSection
lstrcmpW
gdi32
CreateDIBSection
CreateCompatibleBitmap
SetLayout
SelectObject
BitBlt
GetStockObject
GetObjectW
CreateCompatibleDC
DeleteObject
CreateRectRgnIndirect
CreateDCW
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
CreateSolidBrush
user32
wsprintfW
RegisterClassExW
GetParent
ShowWindow
GetFocus
IsChild
EndPaint
GetClientRect
BeginPaint
GetClassNameW
SendMessageTimeoutW
RegisterWindowMessageW
LoadCursorW
GetWindowRect
SendMessageW
MoveWindow
CharUpperW
IsWindowVisible
DestroyMenu
TrackPopupMenu
MapWindowPoints
AppendMenuW
CreatePopupMenu
InsertMenuItemW
GetMenuItemCount
GetSystemMenu
GetSystemMetrics
SystemParametersInfoW
CreateWindowExW
GetClassInfoExW
LoadStringW
EnumChildWindows
MessageBoxW
MsgWaitForMultipleObjects
DispatchMessageW
EnumDisplaySettingsW
TranslateMessage
PeekMessageW
SetFocus
InvalidateRect
DestroyAcceleratorTable
GetKeyState
IsWindow
CallWindowProcW
GetWindowLongW
DefWindowProcW
SetWindowLongW
DestroyWindow
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
PtInRect
GetDC
ReleaseDC
CharNextW
SystemParametersInfoA
CharUpperBuffW
CharLowerW
SetWindowTextW
LoadIconW
LoadImageW
SetForegroundWindow
IsIconic
PostMessageW
GetProcessDefaultLayout
GetCursorPos
GetSysColor
GetWindow
GetWindowTextW
GetWindowTextLengthW
ReleaseCapture
SetCapture
InvalidateRgn
GetDesktopWindow
GetDlgItem
FillRect
RedrawWindow
CreateAcceleratorTableW
CopyImage
comctl32
ImageList_LoadImageW
ImageList_Destroy
ImageList_GetImageCount
ImageList_Create
ImageList_DrawIndirect
ImageList_AddMasked
InitCommonControlsEx
uxtheme
GetCurrentThemeName
GetThemeDocumentationProperty
IsThemeActive
urlmon
URLOpenBlockingStreamW
RegisterBindStatusCallback
CreateURLMoniker
ReleaseBindInfo
CopyBindInfo
CoInternetQueryInfo
CoInternetGetSession
wininet
InternetCloseHandle
InternetSetOptionW
InternetQueryOptionW
InternetSetOptionA
InternetCombineUrlW
InternetCanonicalizeUrlW
CommitUrlCacheEntryW
DeleteUrlCacheEntryW
CreateUrlCacheEntryW
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetGetConnectedState
InternetCrackUrlW
InternetAutodial
InternetAutodialHangup
InternetSetStatusCallbackW
ole32
CoRegisterClassObject
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
StgOpenStorageEx
StgCreateStorageEx
GetRunningObjectTable
CreateClassMoniker
CoRevokeClassObject
WriteClassStm
OleSaveToStream
CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
CoGetCallContext
GetHGlobalFromStream
CoGetClassObject
CreateBindCtx
CLSIDFromString
StringFromCLSID
OleInitialize
OleUninitialize
OleLockRunning
CLSIDFromProgID
OleLoadFromStream
oleaut32
DispCallFunc
VariantInit
VariantTimeToSystemTime
VariantChangeTypeEx
SafeArrayCreateVector
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SystemTimeToVariantTime
VariantCopy
OleCreatePropertyFrame
SysStringLen
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
SysAllocString
SysFreeString
shlwapi
UrlGetPartW
UrlCanonicalizeW
PathIsRelativeW
shell32
SHGetSpecialFolderLocation
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ntdll
wcsncmp
strncpy
sprintf
wcsstr
wcschr
_wtol
_snwprintf
msimg32
GradientFill
Sections
.text Size: 490KB - Virtual size: 489KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ