Static task
static1
Behavioral task
behavioral1
Sample
1f1da09449d337daf295c9a01987190bf58461373b8b32e893970c6e8f460a3a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1f1da09449d337daf295c9a01987190bf58461373b8b32e893970c6e8f460a3a.exe
Resource
win10v2004-20221111-en
General
-
Target
1f1da09449d337daf295c9a01987190bf58461373b8b32e893970c6e8f460a3a
-
Size
790KB
-
MD5
850498be1e415a030d8cd00b6b0f62dd
-
SHA1
5e7393949d0c2369c841ade00da1600acc17a3be
-
SHA256
1f1da09449d337daf295c9a01987190bf58461373b8b32e893970c6e8f460a3a
-
SHA512
6b51cbf443fc431e0112e47ef186b5958d989f3fe695237899a4064ea561391023545e0b6a55853b98003e258d80c8e82399b5f513ca1078ee0277c5751240d3
-
SSDEEP
12288:JztOGiprouJbqrnGd/MdcrhBO1MUN6xZR74U7GzSJdjz:2G2r2rG9MdGe1MUNcEeGMl
Malware Config
Signatures
Files
-
1f1da09449d337daf295c9a01987190bf58461373b8b32e893970c6e8f460a3a.exe windows x86
7aee349ec31ee9e928c2c22d6b7d38bd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFullPathNameA
ExpandEnvironmentStringsW
GetSystemDirectoryW
GetProfileIntW
VerifyVersionInfoW
SetConsoleActiveScreenBuffer
FindFirstVolumeMountPointA
DisconnectNamedPipe
OpenFileMappingW
FreeEnvironmentStringsA
GetFileSize
GetProfileSectionW
CreateWaitableTimerW
OpenWaitableTimerA
EnumCalendarInfoA
GetShortPathNameA
FindResourceExA
CreateFileMappingW
GetProcessPriorityBoost
DeleteAtom
SetConsoleDisplayMode
SetThreadPriorityBoost
GetBinaryTypeW
GetAtomNameW
SetSystemPowerState
GetTempPathA
FreeConsole
GetOEMCP
LoadResource
GetFileTime
GetVolumePathNameW
FindVolumeClose
GetFileAttributesExA
GetSystemWindowsDirectoryA
SetLocaleInfoW
SetHandleInformation
CopyFileExA
GetModuleHandleW
GetConsoleOutputCP
BindIoCompletionCallback
FormatMessageW
CreateDirectoryA
GetModuleFileNameW
GetConsoleMode
CreateNamedPipeA
DefineDosDeviceW
GetSystemWindowsDirectoryW
SetCurrentDirectoryA
AddAtomA
DefineDosDeviceA
GetProfileStringA
GetACP
GetConsoleCursorInfo
OpenThread
PeekNamedPipe
CreateMutexW
CreateMailslotW
IsDBCSLeadByteEx
WideCharToMultiByte
MapUserPhysicalPagesScatter
QueryInformationJobObject
GetLongPathNameA
Module32FirstW
GetSystemDefaultLCID
SetErrorMode
GetProfileIntA
GetDevicePowerState
GetNamedPipeInfo
FoldStringA
PrepareTape
CompareStringA
PostQueuedCompletionStatus
Module32First
GetFileAttributesExW
GetModuleHandleA
GetStringTypeA
SetTapePosition
GetPrivateProfileStructW
FlushInstructionCache
GetCurrencyFormatA
SetComputerNameExA
GetPrivateProfileStructA
SetMailslotInfo
GetEnvironmentStrings
GetLocaleInfoW
GetConsoleAliasExesLengthA
AreFileApisANSI
GetVolumeInformationA
GetLogicalDrives
ReadDirectoryChangesW
GetProfileSectionA
ProcessIdToSessionId
GetNumberOfConsoleInputEvents
GetCPInfoExA
FindNextChangeNotification
SetThreadContext
CreateDirectoryExA
GetFileAttributesW
GetConsoleAliasExesW
CreateDirectoryExW
FlushFileBuffers
AddAtomW
GetDiskFreeSpaceExA
GetPrivateProfileStringW
GetMailslotInfo
GetConsoleAliasW
Module32Next
GetPrivateProfileIntW
GetTapeStatus
GetSystemDefaultUILanguage
MoveFileWithProgressW
SetPriorityClass
LCMapStringA
DeleteTimerQueueEx
CreateTimerQueue
FindAtomW
SetThreadLocale
ContinueDebugEvent
ReadFile
FlushConsoleInputBuffer
EraseTape
GetBinaryTypeA
GetCurrentThread
SetThreadExecutionState
GetVolumeInformationW
GetDriveTypeA
SetEndOfFile
GetDateFormatA
SetUnhandledExceptionFilter
CreateToolhelp32Snapshot
GetLogicalDriveStringsA
LCMapStringW
GetPrivateProfileSectionNamesW
ReleaseMutex
OpenJobObjectW
GetWindowsDirectoryW
CreateMutexA
GetProfileStringW
GetConsoleScreenBufferInfo
DeviceIoControl
OpenFileMappingA
CopyFileA
VirtualAlloc
FindResourceA
SetInformationJobObject
SetThreadIdealProcessor
GetConsoleCP
GetAtomNameA
SetThreadPriority
GetCompressedFileSizeW
GetPrivateProfileSectionW
CreateHardLinkA
GetSystemDefaultLangID
GetDiskFreeSpaceW
SetFileAttributesA
GetThreadLocale
GetVersion
Toolhelp32ReadProcessMemory
DeleteTimerQueue
CopyFileW
GetCompressedFileSizeA
GetNamedPipeHandleStateW
SetFileAttributesW
CreateEventW
ReadProcessMemory
CreateMailslotA
GetConsoleAliasesA
OpenEventW
GetVolumeNameForVolumeMountPointA
GetHandleInformation
GetCPInfo
FreeEnvironmentStringsW
CreateTapePartition
OpenWaitableTimerW
GetEnvironmentVariableW
GetPriorityClass
SetCalendarInfoW
OpenEventA
FindResourceW
GetFileInformationByHandle
ResetEvent
ExpandEnvironmentStringsA
FindFirstFileExA
Module32NextW
EnumCalendarInfoExA
ChangeTimerQueueTimer
GetProcAddress
GetWindowsDirectoryA
FindFirstFileA
SearchPathA
OpenMutexW
SetConsoleCP
GetStringTypeExA
DeleteTimerQueueTimer
GetProcessAffinityMask
GetThreadPriority
GetNumberFormatW
FindResourceExW
CreateSemaphoreW
CreateJobObjectA
GetPrivateProfileStringA
GetProcessVersion
GetCalendarInfoW
GetProcessIoCounters
GetCPInfoExW
GetConsoleAliasExesA
OpenJobObjectA
CompareStringW
GetDateFormatW
IsSystemResumeAutomatic
GetTempPathW
AssignProcessToJobObject
GetCommandLineA
HeapSetInformation
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameA
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
HeapFree
Sleep
IsValidCodePage
RtlUnwind
HeapSize
HeapAlloc
HeapReAlloc
MultiByteToWideChar
GetStringTypeW
IsProcessorFeaturePresent
advapi32
CryptDestroyHash
OpenSCManagerW
RegQueryValueExA
OpenThreadToken
LookupAccountSidW
RegNotifyChangeKeyValue
GetSecurityDescriptorDacl
CloseServiceHandle
SetThreadToken
CryptCreateHash
RegSetValueExA
RegCloseKey
LsaOpenPolicy
GetSecurityDescriptorOwner
StartServiceA
SetEntriesInAclW
RegisterEventSourceW
GetTokenInformation
OpenServiceA
RegFlushKey
GetLengthSid
SetSecurityDescriptorGroup
RegCreateKeyA
CryptGetHashParam
RegDeleteKeyA
RegOpenKeyExA
OpenSCManagerA
RegSetKeySecurity
DuplicateTokenEx
CryptAcquireContextW
RegDeleteValueW
RegEnumKeyExW
InitializeAcl
RegEnumKeyW
RegDeleteValueA
LookupAccountNameW
QueryServiceStatus
MakeSelfRelativeSD
CryptAcquireContextA
RegEnumKeyExA
RegSetValueW
GetSidSubAuthorityCount
GetSecurityDescriptorLength
GetAclInformation
RegQueryValueExW
DeregisterEventSource
OpenServiceW
RegDeleteKeyW
QueryServiceConfigW
GetAce
SetSecurityDescriptorOwner
RegEnumValueW
ImpersonateLoggedOnUser
GetSecurityDescriptorGroup
CryptGenRandom
RegCreateKeyW
CryptDestroyKey
GetSidSubAuthority
CreateWellKnownSid
AllocateAndInitializeSid
FreeSid
Sections
.text Size: 549KB - Virtual size: 549KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 176KB - Virtual size: 564KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ