Static task
static1
Behavioral task
behavioral1
Sample
a04dcb38934288e69f771ef6dc2c11b956f98a6bec6a56aea367ab731952150b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a04dcb38934288e69f771ef6dc2c11b956f98a6bec6a56aea367ab731952150b.exe
Resource
win10v2004-20221111-en
General
-
Target
a04dcb38934288e69f771ef6dc2c11b956f98a6bec6a56aea367ab731952150b
-
Size
564KB
-
MD5
fe6e33da5310c2a0d642bc60cf844fc1
-
SHA1
807f978c498761122963badae97f7c0add760dea
-
SHA256
a04dcb38934288e69f771ef6dc2c11b956f98a6bec6a56aea367ab731952150b
-
SHA512
8a1d3b9a49981cec5bb7c0bccd731e299bc8447fc2d329ec135398fc55745848c21a764bb03b36f8b99aca9aa14d31b1ac725307835efa6ba6fe9e0425ecaf08
-
SSDEEP
12288:GiQobmPYJBUf8HSKbFt4foLeA3ptPGCWTkWETBsflGWCqNOTOXZ1nd9hhd:GbVYMkyKbaAZtPGPAONljnd9
Malware Config
Signatures
Files
-
a04dcb38934288e69f771ef6dc2c11b956f98a6bec6a56aea367ab731952150b.exe windows x86
4d0bcb5702f4b819a92ffa95ea0e6082
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
DeleteFileA
LoadLibraryA
WaitForSingleObject
OpenProcess
GetExitCodeProcess
CreateProcessA
CloseHandle
CreateFileA
MoveFileA
SetFilePointer
VirtualFree
ReadFile
MoveFileExA
WriteFile
DeviceIoControl
SetUnhandledExceptionFilter
SetFileTime
FileTimeToSystemTime
FlushFileBuffers
GetFileTime
GetPrivateProfileStringA
GetTempFileNameA
GetProcAddress
GetLastError
SetCurrentDirectoryA
Sleep
ExpandEnvironmentStringsA
GetCurrentProcess
GetFileSize
SetEnvironmentVariableA
CompareStringW
HeapReAlloc
LoadLibraryW
SetErrorMode
ExitProcess
CreateRemoteThread
DuplicateHandle
CreateDirectoryA
SetEndOfFile
HeapFree
HeapAlloc
GetProcessHeap
FindClose
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetCommandLineA
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
RtlUnwind
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringW
MultiByteToWideChar
DeleteCriticalSection
RaiseException
GetFileType
CreateFileW
SetStdHandle
SetHandleCount
GetStdHandle
GetFullPathNameA
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryW
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetStringTypeW
WriteConsoleW
IsProcessorFeaturePresent
GetDriveTypeW
GetTimeZoneInformation
GetLocaleInfoA
user32
wsprintfA
advapi32
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
shell32
ShellExecuteA
ord680
psapi
GetProcessImageFileNameA
EnumProcesses
shlwapi
PathFileExistsA
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 472KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ