Static task
static1
Behavioral task
behavioral1
Sample
432bff5a79da4c472e15cd4395ddb1afbd73122062981f72626dc83f9be8cf20.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
432bff5a79da4c472e15cd4395ddb1afbd73122062981f72626dc83f9be8cf20.exe
Resource
win10v2004-20221111-en
General
-
Target
432bff5a79da4c472e15cd4395ddb1afbd73122062981f72626dc83f9be8cf20
-
Size
84KB
-
MD5
11c3fe8da9b6b9b5c70f094e4a6f342d
-
SHA1
c83890cd03c9da5dfc250203ce7c446e0128c3cb
-
SHA256
432bff5a79da4c472e15cd4395ddb1afbd73122062981f72626dc83f9be8cf20
-
SHA512
a9e82ba7d375b3a7a7f1800de923e037bcbdc9927c740cc7f55fe39414a104256e182da2178e383337b433a5d79f32bb451e6ea4b61d015046da0d1e12a345bd
-
SSDEEP
768:I3ncJu5hBXF2pmiq2V41xNmAFgGyi4XwP13GT9W28z/zMp5xAFiE3s:I3cJu5hBVWq2kN6LXwPVGT9lgA5gs
Malware Config
Signatures
Files
-
432bff5a79da4c472e15cd4395ddb1afbd73122062981f72626dc83f9be8cf20.exe windows x86
af7bbc720f4103a2065171def931dc1a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord6374
ord4299
ord2379
ord4710
ord4287
ord4234
ord324
ord1168
ord1146
ord3597
ord4425
ord4627
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5280
ord4353
ord5163
ord2385
ord5241
ord4407
ord1775
ord825
ord4078
ord6052
ord4998
ord5265
ord823
ord2514
ord641
ord561
ord815
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord1576
msvcrt
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
_adjust_fdiv
_strdup
_mbscmp
_mbstok
memmove
srand
rand
wcscpy
_setmbcp
__p__commode
__p__fmode
__set_app_type
__dllonexit
exit
_mbsstr
_mbsrev
_mbsnbcpy
_mbsnbcat
_splitpath
swprintf
wcsrchr
wcscmp
_mbsnbicmp
_mbsicmp
_mbsupr
wcschr
_mbslwr
malloc
free
__CxxFrameHandler
_mbsrchr
sprintf
_access
_except_handler3
_vsnprintf
fopen
fprintf
_mbslen
fclose
_mbschr
_controlfp
kernel32
CreateFileA
GetCurrentProcessId
GetLocalTime
GetModuleHandleA
OutputDebugStringA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetModuleFileNameA
TerminateProcess
DuplicateHandle
GetCurrentProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpynA
GetLastError
FormatMessageA
LocalFree
SetLastError
OpenProcess
WaitForSingleObject
CreateThread
GetCurrentThreadId
Sleep
GetProcessHeap
Process32Next
Process32First
LockResource
SizeofResource
LoadResource
FindResourceA
WriteFile
GetTempFileNameA
GetTempPathA
CreateFileMappingA
OpenFileMappingA
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
WideCharToMultiByte
GetStartupInfoA
WriteProcessMemory
GetProcAddress
LoadLibraryA
GetTickCount
SetUnhandledExceptionFilter
FreeLibrary
VirtualAllocEx
VirtualFreeEx
ReadProcessMemory
CreateProcessA
GetVersionExA
CreateMutexA
LoadLibraryExA
MapViewOfFile
UnmapViewOfFile
LocalAlloc
ResumeThread
GetWindowsDirectoryA
SetFileAttributesA
SetPriorityClass
GetShortPathNameA
GetEnvironmentVariableA
Module32First
CreateToolhelp32Snapshot
ExpandEnvironmentStringsA
HeapFree
CloseHandle
HeapAlloc
user32
EnableWindow
wsprintfA
PostMessageA
GetWindowThreadProcessId
SendMessageA
GetWindowLongA
SetWindowLongA
SetTimer
LoadIconA
ClientToScreen
FindWindowExA
advapi32
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
GetTokenInformation
GetSecurityInfo
FreeSid
AddAccessAllowedAce
AddAccessDeniedAce
InitializeAcl
LookupAccountSidA
RegDeleteValueA
RegEnumKeyExA
SetNamedSecurityInfoA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetSecurityDescriptorDacl
GetLengthSid
InitializeSecurityDescriptor
SetSecurityInfo
OpenProcessToken
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SetEntriesInAclA
shell32
SHGetSpecialFolderPathW
SHGetDesktopFolder
SHGetDataFromIDListW
SHGetSpecialFolderLocation
ShellExecuteA
SHGetPathFromIDListA
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
msvcp60
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
dbghelp
MiniDumpWriteDump
wininet
DeleteUrlCacheEntry
shlwapi
PathUnquoteSpacesA
SHDeleteKeyA
PathRemoveArgsA
Sections
.text Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ