Static task
static1
Behavioral task
behavioral1
Sample
d1a7de5073188514e4e9cbab5f74fbd3a0dcc74f9859764fea5a9be4da6fb84f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d1a7de5073188514e4e9cbab5f74fbd3a0dcc74f9859764fea5a9be4da6fb84f.exe
Resource
win10v2004-20220812-en
General
-
Target
d1a7de5073188514e4e9cbab5f74fbd3a0dcc74f9859764fea5a9be4da6fb84f
-
Size
271KB
-
MD5
ac67744275cf9dcbd95184d9d6ed2e6d
-
SHA1
84dfa2c1d72c6a462783f01d583800580ffe0bfa
-
SHA256
d1a7de5073188514e4e9cbab5f74fbd3a0dcc74f9859764fea5a9be4da6fb84f
-
SHA512
8c37dd5cc174cda1c37799acffb7444c8e6cfc491199935011a929f1589aa76593c53f3b29911375060158ba885ad660221f1f73fb83c60e2e30ed30214b42af
-
SSDEEP
6144:TexHolRqE/ORNffDcL+QIDt2rE8A1Uke1:TK+xafoEt2ju
Malware Config
Signatures
Files
-
d1a7de5073188514e4e9cbab5f74fbd3a0dcc74f9859764fea5a9be4da6fb84f.exe windows x86
fa56b8c55b5438afb41fab31fc342f3a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
sohdb
??0sohdb@@QAE@XZ
?Open@sohdb@@QAE_NJ@Z
?BeginTransaction@sohdb@@QAE_NXZ
?Rollback@sohdb@@QAE_NXZ
??1sohdb@@UAE@XZ
?Commit@sohdb@@QAE_NXZ
?ExecSQL@sohdb@@QAE_NPB_WPAVSohdbNotify@@@Z
kernel32
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
TerminateProcess
RaiseException
GetCommandLineW
GetCurrentThread
SetEvent
SetLastError
LocalFree
CreateEventW
CreateThread
GetCurrentThreadId
GetModuleHandleW
GetProcAddress
Sleep
WaitForSingleObject
CloseHandle
GetLastError
GetModuleFileNameW
lstrlenW
LeaveCriticalSection
GetSystemTimeAsFileTime
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
HeapDestroy
user32
TranslateMessage
CharNextW
CharUpperW
MessageBoxW
DispatchMessageW
GetMessageW
PostThreadMessageW
LoadStringW
advapi32
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorSacl
MakeAbsoluteSD
GetSecurityDescriptorControl
GetAclInformation
InitializeAcl
AddAce
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
ChangeServiceConfigW
GetSecurityInfo
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
CopySid
IsValidSid
GetLengthSid
ControlService
DeleteService
CreateServiceW
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
ole32
CoResumeClassObjects
CoCreateInstance
CoSuspendClassObjects
CoUninitialize
CoInitializeEx
CoInitializeSecurity
oleaut32
SysStringLen
LoadRegTypeLi
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
SysFreeString
atl90
ord49
ord56
ord68
ord17
ord20
ord64
ord31
ord58
ord61
ord23
ord30
ord67
ord32
msvcp90
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?length@?$char_traits@_W@std@@SAIPB_W@Z
?width@ios_base@std@@QBEHXZ
?flags@ios_base@std@@QBEHXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?eq_int_type@?$char_traits@_W@std@@SA_NABG0@Z
?eof@?$char_traits@_W@std@@SAGXZ
msvcr90
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
??0exception@std@@QAE@ABV01@@Z
_adjust_fdiv
__p__fmode
??3@YAXPAX@Z
free
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_invalid_parameter_noinfo
_CxxThrowException
exit
??2@YAPAXI@Z
??_V@YAXPAX@Z
_purecall
_recalloc
calloc
memset
malloc
_resetstkoflw
_wtoi
memcpy_s
memmove_s
wcscpy_s
wcsncpy_s
_putws
_vsnwprintf_s
_except_handler4_common
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
__p__commode
Sections
.text Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 192KB - Virtual size: 1.3MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE