Static task
static1
Behavioral task
behavioral1
Sample
b33af4fbbf909b8d7677cd4b94970b8f0f507051a4dc0411f077fcf3f04afffa.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b33af4fbbf909b8d7677cd4b94970b8f0f507051a4dc0411f077fcf3f04afffa.exe
Resource
win10v2004-20220901-en
General
-
Target
b33af4fbbf909b8d7677cd4b94970b8f0f507051a4dc0411f077fcf3f04afffa
-
Size
1.4MB
-
MD5
ca0424d4cf1396b0f2f621e2174ee242
-
SHA1
f6f38d31c04521de19cb5a9cb069cc1762c21e03
-
SHA256
b33af4fbbf909b8d7677cd4b94970b8f0f507051a4dc0411f077fcf3f04afffa
-
SHA512
c22304e83f2ba39d47826f46a33b2168eab8958ae2064227c3ebd7b541905118c89c11e5a97e6adbb65c753fdb4dd9b07c72c59447fc00327b4a2f7d7115231d
-
SSDEEP
24576:pNYRC0Z4Qj+bEPrz++QVhGbGX/yXLBc/WhQo6:p/hwGaSF
Malware Config
Signatures
Files
-
b33af4fbbf909b8d7677cd4b94970b8f0f507051a4dc0411f077fcf3f04afffa.exe windows x86
fb241d0f6113d654c1e0591e850d6170
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleW
GetFileAttributesExA
GetOEMCP
lstrcpyA
CreateDirectoryExW
VirtualProtect
FindFirstFileA
GetModuleFileNameW
GetThreadTimes
Module32First
GetCompressedFileSizeW
GetPrivateProfileSectionNamesW
MapViewOfFile
GetUserDefaultLangID
GetShortPathNameW
GetFileSizeEx
GetUserDefaultLCID
GetEnvironmentStrings
GetProcAddress
GetSystemDirectoryW
GetPrivateProfileIntA
ReleaseSemaphore
GetCurrentDirectoryA
SetEndOfFile
VerSetConditionMask
CopyFileExA
SetConsoleOutputCP
FindResourceW
WriteConsoleA
WideCharToMultiByte
GetPrivateProfileSectionNamesA
GetProcessAffinityMask
QueueUserWorkItem
GlobalAddAtomW
FoldStringW
GlobalDeleteAtom
IsDBCSLeadByteEx
FlushFileBuffers
GetConsoleAliasExesLengthW
SetThreadAffinityMask
SetErrorMode
SetCurrentDirectoryW
CreateFileW
CreateEventA
SetHandleCount
CopyFileW
AddAtomA
CreateProcessW
GetFileTime
SetNamedPipeHandleState
VirtualQuery
GetSystemDefaultLCID
GetLongPathNameW
SetInformationJobObject
ExpandEnvironmentStringsA
CancelIo
SetFileAttributesA
GetProcessIoCounters
MultiByteToWideChar
FreeUserPhysicalPages
GetCurrentThread
GetConsoleMode
GetStartupInfoW
GetCurrencyFormatW
FindResourceExA
GetVolumeNameForVolumeMountPointW
GetTapeStatus
FindFirstVolumeW
GetTempPathW
QueryDosDeviceW
GetAtomNameA
DeleteTimerQueueEx
GetComputerNameW
IsSystemResumeAutomatic
GetModuleFileNameA
CreateHardLinkA
lstrcpynA
GetConsoleScreenBufferInfo
GetDriveTypeA
EnumCalendarInfoExW
GetStringTypeExA
GetStdHandle
ReleaseMutex
DeleteVolumeMountPointA
SetThreadPriorityBoost
GetACP
GetVolumeInformationW
GetHandleInformation
GetProcessWorkingSetSize
OpenSemaphoreW
SetVolumeMountPointA
SetConsoleActiveScreenBuffer
SetSystemPowerState
VerifyVersionInfoW
CreateWaitableTimerA
MoveFileWithProgressA
GetTimeFormatA
FindVolumeMountPointClose
DeleteAtom
CreateHardLinkW
DosDateTimeToFileTime
GetConsoleAliasExesLengthA
GetStringTypeW
LCMapStringW
HeapReAlloc
HeapAlloc
HeapSize
RtlUnwind
IsValidCodePage
Sleep
HeapFree
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
IsProcessorFeaturePresent
GetLastError
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsGetValue
TlsAlloc
EncodePointer
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
WriteFile
DecodePointer
ExitProcess
HeapSetInformation
GetCommandLineA
EraseTape
ConvertThreadToFiber
CreateMutexW
GetCommandLineW
FreeEnvironmentStringsA
DnsHostnameToComputerNameA
GetCompressedFileSizeA
DisconnectNamedPipe
OpenEventW
OpenJobObjectW
GlobalSize
GetCPInfo
FindAtomA
GetConsoleAliasesA
FreeEnvironmentStringsW
GetStringTypeExW
ReadProcessMemory
CreateMutexA
OpenSemaphoreA
FindResourceA
CreateFileMappingA
GetLocaleInfoW
GetDevicePowerState
GetSystemDefaultUILanguage
Module32Next
GlobalLock
GetSystemDefaultLangID
GetExitCodeProcess
AreFileApisANSI
FindNextChangeNotification
TlsSetValue
FormatMessageA
GetMailslotInfo
ReplaceFileA
Toolhelp32ReadProcessMemory
SetThreadExecutionState
SetTapePosition
SetThreadIdealProcessor
SearchPathA
GetVolumeInformationA
GetNumberFormatW
GetTempFileNameA
GetConsoleAliasExesA
GetLongPathNameA
SetHandleInformation
GetFileAttributesA
SetProcessAffinityMask
SetLocaleInfoA
GetDateFormatA
FormatMessageW
GetTimeFormatW
OpenMutexW
SetThreadContext
LCMapStringA
CreateSemaphoreA
GetModuleHandleA
OpenFileMappingW
SetMailslotInfo
GetStringTypeA
DuplicateHandle
GetTempFileNameW
GetConsoleAliasesW
SetUnhandledExceptionFilter
GetSystemWindowsDirectoryW
DefineDosDeviceA
SetLocaleInfoW
GetPrivateProfileStructA
VirtualAlloc
GetConsoleAliasA
FlushInstructionCache
GetNumberFormatA
FindFirstFileExA
rpcrt4
NdrConformantArrayBufferSize
RpcServerUseProtseqA
RpcServerUseProtseqW
MesIncrementalHandleReset
RpcMgmtInqComTimeout
RpcBindingFromStringBindingA
RpcBindingVectorFree
UuidToStringA
NdrMesTypeFree2
RpcServerInqBindings
RpcErrorAddRecord
RpcErrorClearInformation
RpcMgmtEpEltInqDone
RpcMgmtStopServerListening
NdrSimpleTypeMarshall
RpcBindingInqAuthClientW
RpcCancelThreadEx
RpcMgmtEnableIdleCleanup
MesHandleFree
NdrCorrelationFree
RpcAsyncGetCallStatus
NdrServerCall2
RpcStringBindingParseW
user32
TrackMouseEvent
SetDlgItemInt
GetDlgItemTextA
GetDialogBaseUnits
SetCapture
SendNotifyMessageW
GetWindowPlacement
SetWindowLongA
GetAltTabInfoA
GetSysColor
DrawTextW
GetShellWindow
GetCursorPos
EndPaint
GetActiveWindow
EnableWindow
CharToOemBuffA
SetProcessWindowStation
TrackPopupMenu
DialogBoxParamW
InvalidateRgn
SystemParametersInfoW
GetWindowTextW
SetMenu
ScrollWindowEx
comctl32
ImageList_SetBkColor
ImageList_GetBkColor
ImageList_Destroy
ImageList_Draw
ImageList_Write
ImageList_SetDragCursorImage
ImageList_SetIconSize
CreateStatusWindowW
FlatSB_SetScrollInfo
ImageList_GetImageInfo
ImageList_GetIconSize
ImageList_Create
ImageList_LoadImageW
ImageList_DrawIndirect
ImageList_SetOverlayImage
CreateToolbarEx
InitCommonControlsEx
ImageList_Remove
ImageList_SetImageCount
ord17
advapi32
GetSecurityDescriptorSacl
LsaQueryInformationPolicy
SetSecurityDescriptorDacl
CryptDestroyKey
RegOpenKeyExW
LsaOpenPolicy
FreeSid
RegConnectRegistryW
OpenSCManagerA
SetNamedSecurityInfoW
SetServiceStatus
OpenServiceA
GetSecurityDescriptorLength
RegEnumValueA
LsaFreeMemory
RegSetValueExW
CryptCreateHash
GetSidSubAuthorityCount
QueryServiceStatus
OpenSCManagerW
EqualSid
ControlService
DuplicateTokenEx
RegOpenKeyW
CryptAcquireContextA
LsaClose
RegCreateKeyExW
RegSetKeySecurity
QueryServiceConfigW
GetSecurityDescriptorDacl
LookupAccountNameW
InitializeSecurityDescriptor
CryptHashData
RegCreateKeyA
RegEnumKeyExA
SetThreadToken
RegFlushKey
GetSidSubAuthority
GetSecurityDescriptorOwner
ImpersonateLoggedOnUser
AddAccessAllowedAce
InitializeAcl
RegQueryValueExW
ChangeServiceConfigW
SetSecurityDescriptorOwner
RegCloseKey
OpenThreadToken
RegCreateKeyW
IsValidSecurityDescriptor
SetFileSecurityW
shell32
SHBindToParent
SHChangeNotify
SHGetFileInfoW
ShellExecuteExW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ShellExecuteW
CommandLineToArgvW
SHGetFolderPathW
SHGetMalloc
SHBrowseForFolderW
SHFileOperationW
ole32
HBITMAP_UserUnmarshal
HPALETTE_UserUnmarshal
CoTreatAsClass
CreateItemMoniker
StgIsStorageFile
OleCreateMenuDescriptor
HICON_UserUnmarshal
OleMetafilePictFromIconAndLabel
StringFromCLSID
CoRegisterPSClsid
IsAccelerator
STGMEDIUM_UserSize
CoInstall
CoQueryClientBlanket
HBITMAP_UserMarshal
GetRunningObjectTable
HDC_UserMarshal
CoIsHandlerConnected
CoReleaseMarshalData
CoRegisterSurrogate
OleConvertOLESTREAMToIStorageEx
HMENU_UserFree
CoCancelCall
CreatePointerMoniker
HPALETTE_UserSize
HWND_UserMarshal
OleCreateLinkToFile
OleUninitialize
CoFreeLibrary
oleaut32
GetActiveObject
SysReAllocStringLen
SysStringLen
VariantCopy
GetErrorInfo
SysAllocStringLen
SafeArrayGetUBound
VariantChangeTypeEx
SafeArrayGetLBound
VariantInit
VariantChangeType
SysFreeString
SysAllocStringByteLen
SafeArrayPtrOfIndex
VariantCopyInd
SafeArrayCreate
VariantClear
Sections
.text Size: 872KB - Virtual size: 872KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 511KB - Virtual size: 514KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ