Static task
static1
Behavioral task
behavioral1
Sample
542fc9d2274c8ee2dcf98066773bbfbe1811f163d11d6549c1be686b40428dd4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
542fc9d2274c8ee2dcf98066773bbfbe1811f163d11d6549c1be686b40428dd4.exe
Resource
win10v2004-20220812-en
General
-
Target
542fc9d2274c8ee2dcf98066773bbfbe1811f163d11d6549c1be686b40428dd4
-
Size
236KB
-
MD5
b943b038c6b9478e88750dd0acf31ee2
-
SHA1
b3925602582bd108aebea1dde96ca5d03b0313d7
-
SHA256
542fc9d2274c8ee2dcf98066773bbfbe1811f163d11d6549c1be686b40428dd4
-
SHA512
f03877071803eba172b66063245d90a9416a02cc9556b213376b2aa8fd30086e38d45ee902489dd5c8073b969113e5927438eca233a3ab92658ef94e2034be67
-
SSDEEP
3072:2DxvbumkJf+VU1W3O4m6ZgPx1Itku9B8V0yIB5wEsAYrvV5IGBmdDQ+rI5zlalXV:2DBum0kUZ1hteyIBjerzciQXdf
Malware Config
Signatures
Files
-
542fc9d2274c8ee2dcf98066773bbfbe1811f163d11d6549c1be686b40428dd4.exe windows x86
1f1cccefb0b5e4206f08f96282088bf1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
GetFileSizeEx
GetLastError
CreateDirectoryA
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameA
LocalFree
FormatMessageA
GetSystemInfo
GetProcAddress
GetModuleHandleA
InterlockedDecrement
SetEvent
CreateEventA
OutputDebugStringA
ResumeThread
SetThreadPriority
InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
lstrlenW
InterlockedIncrement
lstrlenA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
LoadLibraryA
HeapAlloc
HeapFree
InterlockedCompareExchange
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
ReadFile
WriteFile
SetFileAttributesA
CopyFileA
DeleteFileA
CreateProcessA
CreateFileA
GetFileSize
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32First
CloseHandle
Process32Next
Sleep
OpenProcess
TerminateProcess
GetCurrentProcess
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
ExitProcess
LCMapStringW
GetVersionExA
VirtualFree
VirtualAlloc
InterlockedExchange
GetACP
LCMapStringA
IsValidCodePage
GetProcessHeap
RaiseException
GetOEMCP
GetCPInfo
HeapSize
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetCommandLineA
VirtualQuery
VirtualProtect
CreateThread
ExitThread
GetSystemTimeAsFileTime
RtlUnwind
HeapReAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetThreadLocale
GetLocaleInfoA
IsProcessorFeaturePresent
user32
CreateDialogParamA
DefWindowProcA
TranslateMessage
DispatchMessageA
ShowWindow
SetWindowLongA
KillTimer
GetWindowLongA
SendMessageA
IsDialogMessageA
SetWindowPos
MapWindowPoints
CharNextA
GetClientRect
SystemParametersInfoA
GetWindowRect
GetWindow
GetParent
GetWindowThreadProcessId
FindWindowA
DestroyWindow
PostQuitMessage
LoadImageA
GetSystemMetrics
PostMessageA
PeekMessageA
UnregisterClassA
SetTimer
GetMessageA
advapi32
CryptHashData
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
CryptDecrypt
CryptAcquireContextA
CryptCreateHash
AdjustTokenPrivileges
CryptDeriveKey
CryptDestroyHash
CryptEncrypt
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VarUI4FromStr
VariantClear
shlwapi
PathFileExistsA
comctl32
InitCommonControlsEx
ws2_32
ioctlsocket
recvfrom
ntohs
htonl
bind
WSACleanup
select
WSAGetLastError
htons
sendto
socket
WSAStartup
winmm
timeGetTime
Sections
.text Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
=! Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE