Static task
static1
Behavioral task
behavioral1
Sample
df01a1811b524c257cacc75ec47670f788c6e214ae6507cf6d9ccedc5b2c581d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
df01a1811b524c257cacc75ec47670f788c6e214ae6507cf6d9ccedc5b2c581d.exe
Resource
win10v2004-20221111-en
General
-
Target
df01a1811b524c257cacc75ec47670f788c6e214ae6507cf6d9ccedc5b2c581d
-
Size
124KB
-
MD5
0698761be59428967ff587d7783cd0ab
-
SHA1
58b25522c5392e120197a97b18627ad14eab1b8f
-
SHA256
df01a1811b524c257cacc75ec47670f788c6e214ae6507cf6d9ccedc5b2c581d
-
SHA512
7760c6ebab27b135456b8250614d1fca109de7045d79c5a33d452cd33fc800fa5df69920215fcfaae3b2593b615e5bc4bb13a2feb8a11396c977737a3b37c1be
-
SSDEEP
3072:OXUXLhp2grceDYfr6/FwYviPqAfNKVFdz:Gchp227MOqLk
Malware Config
Signatures
Files
-
df01a1811b524c257cacc75ec47670f788c6e214ae6507cf6d9ccedc5b2c581d.exe windows x86
edaca8b0dfe77f69d337fb4ce6fa32e5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
esent
JetRestore2
oleaut32
VarUI4FromBool
VarUI4FromDisp
BSTR_UserFree
VarBstrCmp
VarCyFromUI2
VarUI2FromI4
urlmon
URLDownloadToFileA
RevokeFormatEnumerator
CoInternetCompareUrl
user32
GetThreadDesktop
MessageBoxW
OpenInputDesktop
DrawTextA
ShowWindow
clusapi
ClusterNodeEnum
OfflineClusterResource
GetClusterFromNetInterface
ntdll
bsearch
cos
isalpha
wcscspn
strcmp
iswxdigit
qsort
isprint
wcstombs
iswspace
towupper
pdh
PdhSetCounterScaleFactor
PdhRemoveCounter
PdhExpandWildCardPathW
PdhParseCounterPathW
shell32
SHQueryRecycleBinW
DragAcceptFiles
ExtractIconW
ExtractAssociatedIconExW
kernel32
InterlockedExchange
GetProcAddress
LocalFree
LocalAlloc
BuildCommDCBAndTimeoutsW
GetLastError
GetUserDefaultUILanguage
WaitForSingleObject
WritePrivateProfileSectionW
SetFileApisToANSI
SetFileApisToOEM
RemoveVectoredExceptionHandler
CreateSemaphoreW
LoadLibraryA
RaiseException
SetTimerQueueTimer
MoveFileWithProgressW
EnumDateFormatsW
SetHandleInformation
TerminateThread
OpenMutexA
MultiByteToWideChar
FileTimeToSystemTime
GetVolumeInformationW
InitializeSListHead
SetThreadPriority
InitializeCriticalSectionAndSpinCount
CreateTimerQueue
FindNextVolumeMountPointA
EnumResourceNamesA
HeapReAlloc
SetTimeZoneInformation
GetVolumePathNameW
GlobalMemoryStatusEx
SetCurrentDirectoryW
FatalAppExitA
GetWriteWatch
WaitNamedPipeW
ExitThread
EnumSystemLanguageGroupsA
IsValidCodePage
GlobalGetAtomNameA
GetVersionExW
GetAtomNameW
WaitForMultipleObjectsEx
ReadConsoleInputA
OutputDebugStringW
GetVolumeNameForVolumeMountPointA
GetFileAttributesExA
lstrcmpiA
GetLongPathNameW
GetProcessHandleCount
FindResourceW
DeleteTimerQueueTimer
GetCalendarInfoA
DnsHostnameToComputerNameA
GetProcessTimes
GlobalSize
GetProfileSectionW
SetEnvironmentVariableA
GetConsoleSelectionInfo
GetExitCodeProcess
FindFirstVolumeW
LocalFileTimeToFileTime
MoveFileW
lstrcmpA
GetProcessAffinityMask
IsBadStringPtrW
GetSystemDirectoryW
OpenFile
ProcessIdToSessionId
GetPrivateProfileIntW
SetConsoleCursorPosition
GetNamedPipeHandleStateW
CloseHandle
ConvertThreadToFiber
LocalUnlock
GlobalUnlock
GetCompressedFileSizeA
GetFileSizeEx
GetCurrencyFormatW
SetProcessPriorityBoost
AssignProcessToJobObject
GetCommModemStatus
lstrcatA
TlsFree
GetTempPathA
WaitCommEvent
GetStringTypeExA
WaitForMultipleObjects
GlobalFindAtomW
IsValidLanguageGroup
GetLogicalDriveStringsA
SetThreadContext
GetLongPathNameA
lstrlenW
DosDateTimeToFileTime
EnumTimeFormatsW
FillConsoleOutputCharacterA
MoveFileA
GetCurrencyFormatA
FreeLibrary
GetGeoInfoW
InterlockedDecrement
FreeConsole
OutputDebugStringA
CopyFileExW
CancelIo
GlobalUnWire
GetPrivateProfileSectionNamesW
GetBinaryTypeA
GetThreadLocale
HeapCreate
GetCPInfoExW
GlobalFix
FindResourceA
LocalShrink
GlobalFindAtomA
ExpandEnvironmentStringsA
SearchPathW
GetPrivateProfileSectionW
SetConsoleScreenBufferSize
GetNamedPipeInfo
CreateFileW
WriteConsoleOutputCharacterW
EnumSystemCodePagesW
SetConsoleCP
FindCloseChangeNotification
BuildCommDCBW
GetDefaultCommConfigA
setupapi
SetupGetLineTextW
mprapi
MprAdminMIBEntryGet
MprAdminInterfaceUpdatePhonebookInfo
MprConfigInterfaceSetInfo
MprAdminTransportGetInfo
MprConfigInterfaceCreate
msvcrt
tmpfile
ungetwc
fwrite
iswascii
setlocale
atof
remove
putwc
free
putc
fputs
fputws
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 56KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 4KB - Virtual size: 704B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ