Static task
static1
Behavioral task
behavioral1
Sample
1d377032def9a6c0c77e9f0e2c1c4dc73cb51d6a338c98cc0513b5df04611495.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1d377032def9a6c0c77e9f0e2c1c4dc73cb51d6a338c98cc0513b5df04611495.exe
Resource
win10v2004-20221111-en
General
-
Target
1d377032def9a6c0c77e9f0e2c1c4dc73cb51d6a338c98cc0513b5df04611495
-
Size
75KB
-
MD5
49f2e2c5092e6a6ff7f53a7448d9e0fc
-
SHA1
cf354576993ffcd858632fba732258130e08b3a6
-
SHA256
1d377032def9a6c0c77e9f0e2c1c4dc73cb51d6a338c98cc0513b5df04611495
-
SHA512
a2d5ddc9fff33519532b6c2556c22f95ca604884433ead85b67016178e80404fabb94f6883be9974b171e2b1c65ee98d253ba608ce00fd0949367528f88214bc
-
SSDEEP
1536:CkE5S9IzLLhTFM/rZt9ks8WbKNk78Xz0WmmFQRsKCqiYE4vdIfJIOP8W:CRS6x+zZkzWqw8Xz0JyNTBQIBnP8
Malware Config
Signatures
Files
-
1d377032def9a6c0c77e9f0e2c1c4dc73cb51d6a338c98cc0513b5df04611495.exe windows x86
c4a663213eca173c06c7467f30956407
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
clusapi
ClusterRegOpenKey
ClusterEnum
CloseClusterResource
OpenCluster
ClusterRegSetValue
AddClusterResourceNode
ClusterGroupCloseEnum
PauseClusterNode
RemoveClusterResourceNode
ClusterResourceTypeCloseEnum
ClusterRegGetKeySecurity
ClusterRegCloseKey
ClusterRegQueryInfoKey
GetClusterFromNetInterface
msvcrt
strcmp
iswspace
wcstol
wctomb
atof
memcpy
ungetc
isgraph
ispunct
setbuf
perror
fputwc
putc
isspace
wcstombs
scanf
iswupper
strcspn
qsort
strtoul
strncmp
rename
strcat
bsearch
vfprintf
wcsspn
free
sscanf
rewind
isalnum
wcsftime
fputws
iswalnum
strcpy
puts
strspn
vsprintf
atoi
vprintf
wcstok
fgets
isalpha
atol
mblen
strxfrm
putwc
abort
iswcntrl
getenv
memcmp
fwprintf
towupper
wcstod
toupper
memset
fgetws
system
mbstowcs
tmpfile
fputc
iswalpha
clearerr
is_wctype
wcscpy
fgetwc
sprintf
isxdigit
exit
setlocale
urlmon
GetComponentIDFromCLSSPEC
URLDownloadToFileA
CreateURLMoniker
CoInternetCreateSecurityManager
FaultInIEFeature
SetSoftwareUpdateAdvertisementState
GetClassURL
RevokeBindStatusCallback
pdh
PdhCloseQuery
PdhGetRawCounterValue
PdhExpandWildCardPathW
PdhGetCounterInfoA
PdhUpdateLogA
PdhOpenQueryA
PdhParseCounterPathW
PdhEnumObjectsA
PdhCalculateCounterFromRawValue
PdhSetCounterScaleFactor
PdhGetCounterInfoW
PdhEnumMachinesA
PdhCollectQueryData
oleaut32
VarUI2FromBool
VarUI4FromBool
SafeArraySetRecordInfo
VarUI2FromR4
VarCyFromUI2
VarCyFromI1
VarR4CmpR8
VarBstrCmp
ntdll
RtlCaptureContext
NtWaitForSingleObject
gdi32
GetTextExtentPointW
kernel32
FreeLibrary
GetProcAddress
LocalAlloc
EncodePointer
CreateDirectoryExW
SetConsoleCursorPosition
CreateJobObjectW
EnumDateFormatsA
GetWindowsDirectoryA
FindActCtxSectionGuid
OpenMutexA
LeaveCriticalSection
BuildCommDCBW
FindNextFileW
GetThreadSelectorEntry
GetLocaleInfoA
GetSystemTimes
SetFileApisToOEM
EnumDateFormatsExW
SetEnvironmentVariableW
DeleteFileA
WriteProfileStringW
FindCloseChangeNotification
MoveFileWithProgressA
GetHandleInformation
SetPriorityClass
GlobalAddAtomA
SwitchToThread
GetFullPathNameW
AllocateUserPhysicalPages
Thread32Next
VerLanguageNameW
GetSystemDefaultLangID
GlobalDeleteAtom
GetProfileStringW
lstrcmpiW
GetCurrentDirectoryA
ReadDirectoryChangesW
GetOverlappedResult
VirtualProtect
HeapQueryInformation
GetPrivateProfileStringA
InterlockedExchange
ReadConsoleOutputCharacterA
HeapLock
FindVolumeClose
ReadFile
GetTimeFormatW
GetCommModemStatus
GetLogicalDrives
SetInformationJobObject
FindActCtxSectionStringA
IsBadHugeReadPtr
GlobalAlloc
GetVolumeInformationW
SetConsoleTitleA
WriteFileGather
GetFileType
GetEnvironmentVariableA
GetWriteWatch
GetTimeFormatA
FlushConsoleInputBuffer
Module32NextW
CopyFileExA
SetConsoleOutputCP
CreateFileMappingA
FindClose
GetStringTypeW
SystemTimeToTzSpecificLocalTime
DeleteCriticalSection
VirtualAllocEx
LocalFileTimeToFileTime
ReadConsoleOutputW
CreateTapePartition
SizeofResource
GetLogicalDriveStringsW
GetVolumeNameForVolumeMountPointA
SetConsoleCursorInfo
GetPrivateProfileSectionNamesA
BuildCommDCBA
GetFileAttributesA
DecodePointer
EndUpdateResourceA
IsBadStringPtrW
TransactNamedPipe
SetConsoleTitleW
CheckRemoteDebuggerPresent
WaitForDebugEvent
VerLanguageNameA
GetUserDefaultLCID
PeekNamedPipe
GetVolumePathNamesForVolumeNameW
GetNumberFormatW
lstrcmpA
lstrcpynA
GetNamedPipeHandleStateW
EnterCriticalSection
GetThreadPriority
GetStdHandle
FreeResource
SetConsoleScreenBufferSize
LoadLibraryA
WaitForMultipleObjectsEx
ReadConsoleA
GetCurrentProcess
SetLastError
MultiByteToWideChar
GetLastError
GetModuleHandleW
GetDiskFreeSpaceW
ResumeThread
CreateThread
LoadModule
WTSGetActiveConsoleSessionId
CommConfigDialogW
HeapWalk
ReadConsoleOutputA
GlobalFix
IsSystemResumeAutomatic
OpenSemaphoreW
SetCalendarInfoA
ExitThread
SetComputerNameW
TerminateJobObject
SetConsoleWindowInfo
CallNamedPipeA
SetTimeZoneInformation
GetNumberFormatA
VirtualQueryEx
EnumCalendarInfoExA
ReleaseActCtx
Thread32First
AttachConsole
SetHandleCount
InterlockedExchangeAdd
GetExitCodeProcess
SetHandleInformation
FatalAppExitW
PeekConsoleInputW
GetSystemTime
lstrcpyW
ReplaceFileW
TlsFree
MoveFileExA
GetSystemDirectoryW
SetCurrentDirectoryW
GetProcessWorkingSetSize
FillConsoleOutputCharacterA
HeapFree
FindAtomW
SetCommBreak
BackupSeek
lstrcatW
LocalCompact
TlsSetValue
GetVolumePathNamesForVolumeNameA
InterlockedFlushSList
SetFileTime
SetFirmwareEnvironmentVariableW
GlobalSize
GetCommProperties
GetCommandLineW
AllocConsole
GetDateFormatA
FindNextVolumeMountPointA
lstrcpyA
DisableThreadLibraryCalls
UnlockFile
ScrollConsoleScreenBufferA
DefineDosDeviceW
CreateFiberEx
Process32NextW
SetConsoleCP
GetConsoleTitleW
GetThreadTimes
LockFile
FindActCtxSectionStringW
EnumResourceLanguagesA
FindFirstFileExW
GetNumberOfConsoleInputEvents
FindNextFileA
UnmapViewOfFile
WideCharToMultiByte
GetStringTypeExA
CreateHardLinkA
ContinueDebugEvent
WritePrivateProfileStringW
CancelDeviceWakeupRequest
PostQueuedCompletionStatus
DeleteTimerQueueTimer
HeapAlloc
FlushViewOfFile
DebugActiveProcess
DnsHostnameToComputerNameW
GetTapeParameters
CreateFileA
CreateActCtxA
GetLocaleInfoW
EnumLanguageGroupLocalesW
GetConsoleOutputCP
GetSystemPowerStatus
GetVolumeNameForVolumeMountPointW
ResetEvent
FindNextVolumeW
SetProcessShutdownParameters
GetCompressedFileSizeA
GetStartupInfoW
GetTempPathA
GetFileAttributesExW
SetFileValidData
PulseEvent
EnumUILanguagesA
DuplicateHandle
RegisterWaitForSingleObject
WriteConsoleInputW
GlobalUnfix
FindResourceW
AddAtomW
Heap32Next
lstrcmpW
GetGeoInfoW
SwitchToFiber
GetLongPathNameA
LocalReAlloc
OpenFileMappingA
IsBadStringPtrA
SetThreadPriority
AddAtomA
GetCurrentActCtx
GetThreadContext
CreateTimerQueue
SetErrorMode
WriteConsoleOutputA
RegisterWaitForSingleObjectEx
GlobalCompact
WriteProfileSectionA
VerifyVersionInfoW
FillConsoleOutputAttribute
CreateActCtxW
OpenThread
GetDefaultCommConfigW
HeapValidate
EnumSystemCodePagesA
DeleteFileW
LCMapStringW
Module32Next
CopyFileA
EnumSystemLanguageGroupsA
TzSpecificLocalTimeToSystemTime
UpdateResourceA
ExitProcess
SetComputerNameExA
GetFileAttributesW
LocalSize
LocalShrink
SuspendThread
lstrlenA
SetCriticalSectionSpinCount
CompareStringA
GetSystemWindowsDirectoryW
GetCurrentDirectoryW
SetThreadLocale
lstrcatA
OpenEventA
HeapSetInformation
SetEnvironmentVariableA
SetSystemTimeAdjustment
MoveFileW
EnumDateFormatsW
OpenJobObjectW
QueryActCtxW
ZombifyActCtx
GetFileInformationByHandle
CloseHandle
GetFullPathNameA
GetTapePosition
HeapSize
FindAtomA
DeactivateActCtx
CreateFileW
FillConsoleOutputCharacterW
GetBinaryTypeA
GetDiskFreeSpaceA
FormatMessageW
SetTapePosition
DecodeSystemPointer
SetConsoleActiveScreenBuffer
SearchPathW
GetConsoleWindow
IsBadReadPtr
LocalLock
OpenJobObjectA
FreeEnvironmentStringsA
GlobalGetAtomNameW
Toolhelp32ReadProcessMemory
OpenWaitableTimerW
EnumCalendarInfoW
GetACP
AddVectoredExceptionHandler
InitializeCriticalSection
OpenFileMappingW
lstrcmpiA
DosDateTimeToFileTime
SetComputerNameA
SetThreadAffinityMask
WriteFile
GetNamedPipeHandleStateA
CreateFileMappingW
GlobalMemoryStatus
IsProcessInJob
ReadConsoleA
IsValidLanguageGroup
lstrcpynW
CreateMemoryResourceNotification
EnumSystemGeoID
CancelTimerQueueTimer
GetVersionExA
HeapReAlloc
GetCurrentConsoleFont
GetModuleFileNameW
SetVolumeMountPointW
EnumLanguageGroupLocalesA
GetConsoleCP
Heap32ListFirst
GetStringTypeExW
QueryPerformanceFrequency
ConvertThreadToFiber
SearchPathA
GetQueuedCompletionStatus
FindResourceA
DeleteVolumeMountPointA
SystemTimeToFileTime
ExpandEnvironmentStringsW
Process32First
SetComputerNameExW
EncodeSystemPointer
RemoveDirectoryA
SetCommTimeouts
SetLocaleInfoA
SetUnhandledExceptionFilter
IsValidCodePage
QueryInformationJobObject
InterlockedIncrement
GetProfileIntW
MoveFileWithProgressW
GetPrivateProfileStructW
GetUserGeoID
GetProcessId
GetProcessShutdownParameters
EnumCalendarInfoA
GlobalFindAtomW
RaiseException
mprapi
MprInfoBlockSet
MprConfigInterfaceTransportSetInfo
MprInfoBlockRemove
MprAdminTransportGetInfo
MprAdminServerGetInfo
MprInfoBlockAdd
MprConfigTransportGetInfo
MprAdminDeviceEnum
MprConfigInterfaceTransportAdd
MprAdminConnectionClearStats
MprConfigInterfaceCreate
MprAdminMIBBufferFree
MprAdminConnectionGetInfo
shell32
Shell_NotifyIconA
ord179
DragQueryPoint
SHInvokePrinterCommandW
Shell_NotifyIconW
ord180
ExtractIconExA
ExtractAssociatedIconExW
ExtractIconA
DragAcceptFiles
Sections
.text Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.da Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ