Static task
static1
Behavioral task
behavioral1
Sample
b31724e8f348b42a88170790f384cb1999f64888df74418c7bf59dc52c92f70a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b31724e8f348b42a88170790f384cb1999f64888df74418c7bf59dc52c92f70a.exe
Resource
win10v2004-20220812-en
General
-
Target
b31724e8f348b42a88170790f384cb1999f64888df74418c7bf59dc52c92f70a
-
Size
299KB
-
MD5
b30f94ada7710f5067d23668b9102626
-
SHA1
0f67516852a34930787aac9f17774335d5b150c6
-
SHA256
b31724e8f348b42a88170790f384cb1999f64888df74418c7bf59dc52c92f70a
-
SHA512
c98671a0b3696130ea12ab3d2c0f95f75bd18441e96499477153ee87fa272e10652a1fe4a26eedac3fb325eb0d74c25d09ed3d0715b7d5253cd4ce8a56985205
-
SSDEEP
6144:Z/5v+hUIfM9Bk54SrbUyCq/fUmWfwB06Z/3r0v5g7uIy8jkG5T3Hbzysg5:V5v+infW4wUyCqDV0aj0v8uSPH
Malware Config
Signatures
Files
-
b31724e8f348b42a88170790f384cb1999f64888df74418c7bf59dc52c92f70a.exe windows x86
20c5dd5c5484483c6c9c0a6387bd9553
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
LocalUnlock
SetEvent
PulseEvent
CreateThread
GetSystemTime
GetModuleHandleA
GetCommandLineW
lstrlenA
Sleep
GetCurrentDirectoryA
CloseHandle
SetLastError
HeapCreate
CreateFileA
GetTickCount
LocalFree
UnmapViewOfFile
GetComputerNameA
CreateThread
user32
CallWindowProcA
GetDlgItem
GetKeyState
DispatchMessageA
FillRect
SetFocus
GetScrollBarInfo
IsWindow
GetDC
CheckRadioButton
DrawEdge
CreateWindowExA
DrawMenuBar
clbcatq
DowngradeAPL
UpdateFromAppChange
CheckMemoryGates
SetSetupSave
SetupOpen
desk.cpl
InstallScreenSaver
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 628KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ