Static task
static1
Behavioral task
behavioral1
Sample
3a4d36e7530a69dbbe166b2c7e09e61c513a3b56d09b11bb9d85d060170426f5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3a4d36e7530a69dbbe166b2c7e09e61c513a3b56d09b11bb9d85d060170426f5.exe
Resource
win10v2004-20221111-en
General
-
Target
3a4d36e7530a69dbbe166b2c7e09e61c513a3b56d09b11bb9d85d060170426f5
-
Size
317KB
-
MD5
f4105c06ced9b25bda6ac1c130c378d3
-
SHA1
17b4f5f4f23d17489e579bb95a726d976f75a290
-
SHA256
3a4d36e7530a69dbbe166b2c7e09e61c513a3b56d09b11bb9d85d060170426f5
-
SHA512
63626e3844ca781f0bb90f9514cda4ab61b2f6bf015a92c35a377f3c8f2e43afdbd03d2def4ab3b11db93dc63aa9cc54eb45da7cf4a4ebd824e86de0ef47c363
-
SSDEEP
6144:bKxObF4+TOX7W7ggiWoRHja1VjSAwxEijO:b5CiOXmggiWDUAwpO
Malware Config
Signatures
Files
-
3a4d36e7530a69dbbe166b2c7e09e61c513a3b56d09b11bb9d85d060170426f5.exe windows x86
0c6d61f7d56d0ac02b76b438ad2e6d1b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
lstrcpyA
lstrcmpA
GetComputerNameW
GetLocaleInfoW
GetLastError
GetPrivateProfileStringA
GetVersionExA
GetWindowsDirectoryW
DeleteFileA
GetVolumeInformationW
Sleep
ExitThread
CreateThread
FindResourceA
LoadResource
Process32First
OpenProcess
SizeofResource
Module32First
GetProcAddress
GetModuleFileNameA
LockResource
GetModuleHandleA
FatalExit
CreateToolhelp32Snapshot
Module32Next
GetCurrentProcessId
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
HeapSize
GetTickCount
SetFileAttributesA
CopyFileA
lstrcatA
WriteFile
CreateFileA
Process32Next
ExitProcess
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
LoadLibraryW
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FlushFileBuffers
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
HeapFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
GetCPInfo
RtlUnwind
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
HeapCreate
ReadFile
SetFilePointer
GetConsoleCP
GetConsoleMode
GetProcessHeap
user32
DispatchMessageA
ShowWindow
DefWindowProcA
UpdateWindow
TranslateMessage
LoadIconA
PostQuitMessage
RegisterClassExA
LoadCursorA
FindWindowA
CreateWindowExA
DestroyWindow
GetMessageA
advapi32
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyValueA
RegQueryValueExA
shell32
SHGetFolderPathA
ShellExecuteA
ws2_32
send
closesocket
socket
htons
inet_addr
connect
WSAStartup
recv
WSAGetLastError
urlmon
URLDownloadToFileA
Sections
.text Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ