Static task
static1
Behavioral task
behavioral1
Sample
b2a8b8d184ae13ef528dfa8def25f92a27218252aa2dd449dbc44d3cb8e28a10.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b2a8b8d184ae13ef528dfa8def25f92a27218252aa2dd449dbc44d3cb8e28a10.exe
Resource
win10v2004-20220901-en
General
-
Target
b2a8b8d184ae13ef528dfa8def25f92a27218252aa2dd449dbc44d3cb8e28a10
-
Size
1.5MB
-
MD5
a4c0ba9f83f518a3ca98cd442013d1dd
-
SHA1
47bdea514e10b7d56c59b97e50ea6dd511391afc
-
SHA256
b2a8b8d184ae13ef528dfa8def25f92a27218252aa2dd449dbc44d3cb8e28a10
-
SHA512
c696798bb7201df8f8e54e89f5b90e4697a9f00fc83a8d979011ea7e380297155f79e7004d7dacc30e9f995a1d2bf90f48436c0518a77ba6d442be40ba8e1efb
-
SSDEEP
24576:SABcxTDcQnrrwWmTX+8aDDrlg6wM2O3AZu6:SscxdILj8lg6w03AX
Malware Config
Signatures
Files
-
b2a8b8d184ae13ef528dfa8def25f92a27218252aa2dd449dbc44d3cb8e28a10.exe windows x86
0a01b8a1e9f9ed7c3b7d288ce3aa439d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EraseTape
CreateFileW
GetPrivateProfileIntA
AddAtomW
GetCompressedFileSizeA
GetProfileStringW
MapViewOfFileEx
OpenFileMappingW
DeleteFileA
Module32First
ReleaseMutex
CreateSemaphoreA
MapUserPhysicalPages
SetProcessPriorityBoost
GetLocalTime
SwitchToThread
SetTapeParameters
FoldStringA
GetThreadPriority
MoveFileWithProgressA
GetSystemDefaultLCID
GetStringTypeExW
GetThreadLocale
CreateMailslotW
SetCurrentDirectoryA
MapUserPhysicalPagesScatter
GetCurrentDirectoryA
SetVolumeMountPointA
GetFullPathNameA
SetPriorityClass
OpenJobObjectA
GetSystemDefaultUILanguage
ReadDirectoryChangesW
SetLocaleInfoW
GetConsoleAliasExesLengthA
CreateMailslotA
GetDateFormatW
GetStdHandle
SetMailslotInfo
CreateEventA
GetThreadContext
Module32NextW
GetNamedPipeInfo
OpenWaitableTimerA
GetFileAttributesExA
GetCurrentConsoleFont
CreateWaitableTimerA
WaitForMultipleObjects
SetEvent
GetComputerNameExW
ChangeTimerQueueTimer
SetThreadContext
GetConsoleAliasesA
GetProfileSectionW
GetMailslotInfo
GetStringTypeExA
GetHandleInformation
CreateEventW
SetNamedPipeHandleState
SetProcessWorkingSetSize
GetTempPathW
GetCurrencyFormatA
CreateDirectoryExA
GetFileSize
CreateSemaphoreW
OpenSemaphoreW
GetConsoleOutputCP
SetTapePosition
GetLogicalDriveStringsW
CreateNamedPipeW
FindFirstFileExA
SetCalendarInfoW
GetProfileIntW
GetSystemDirectoryA
GetNumberFormatA
SetConsoleMode
GetProfileSectionA
AssignProcessToJobObject
VerSetConditionMask
GetTimeFormatW
OpenFileMappingA
EnumCalendarInfoExW
CreateHardLinkW
OpenWaitableTimerW
GetVolumeNameForVolumeMountPointA
FindNextFileW
FindResourceW
GetPrivateProfileStringA
GetDateFormatA
GetConsoleAliasW
ReplaceFileA
SetSystemTimeAdjustment
GetFullPathNameW
SetErrorMode
GetCPInfoExW
GetProcessAffinityMask
GetFileAttributesA
FormatMessageA
LoadResource
Toolhelp32ReadProcessMemory
GetLongPathNameA
SetThreadAffinityMask
AreFileApisANSI
ReleaseSemaphore
GetShortPathNameW
FoldStringW
OpenMutexA
GetVolumePathNameA
SetConsoleTextAttribute
CreateMutexW
DeleteAtom
SetThreadIdealProcessor
SetProcessAffinityMask
SetEndOfFile
SetCalendarInfoA
GetAtomNameW
GetUserDefaultLangID
GetLocaleInfoW
GetWindowsDirectoryA
GetConsoleMode
CopyFileW
FreeEnvironmentStringsA
CreateTimerQueueTimer
GetEnvironmentStringsW
PostQueuedCompletionStatus
BindIoCompletionCallback
GetFileSizeEx
SystemTimeToFileTime
CreateTimerQueue
SetUnhandledExceptionFilter
GetComputerNameA
GetModuleFileNameW
GetCurrencyFormatW
MapViewOfFile
WriteConsoleW
OpenEventW
OpenJobObjectW
GetSystemDirectoryW
GetBinaryTypeA
GetProcessPriorityBoost
FindAtomW
ExpandEnvironmentStringsA
DnsHostnameToComputerNameA
GetDriveTypeW
OpenSemaphoreA
SetWaitableTimer
lstrcatA
GetThreadTimes
DefineDosDeviceW
GetNamedPipeHandleStateW
FreeEnvironmentStringsW
GetProcessVersion
DeleteVolumeMountPointA
GetWindowsDirectoryW
GetConsoleWindow
CreateWaitableTimerW
LCMapStringW
GetConsoleScreenBufferInfo
GetFileInformationByHandle
SetConsoleCP
GetTapeStatus
FindFirstVolumeW
ReadProcessMemory
SetEnvironmentVariableA
GetCompressedFileSizeW
SetFileAttributesA
GetLogicalDrives
MultiByteToWideChar
CancelWaitableTimer
GetOverlappedResult
GetNumberFormatW
GetPrivateProfileSectionNamesW
CreateDirectoryA
GetDiskFreeSpaceExA
CopyFileExW
GetACP
DefineDosDeviceA
GetVolumeInformationA
ResetWriteWatch
GetCalendarInfoW
ReplaceFileW
HeapReAlloc
HeapAlloc
HeapSize
RtlUnwind
Sleep
IsProcessorFeaturePresent
HeapFree
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetLastError
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
DeleteCriticalSection
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetModuleFileNameA
WriteFile
DecodePointer
ExitProcess
GetProcAddress
HeapSetInformation
GetCommandLineA
GetStringTypeA
FlushFileBuffers
GetConsoleAliasExesA
FormatMessageW
OpenThread
CreateJobObjectA
GetConsoleAliasesW
GetSystemDefaultLangID
CancelIo
GetConsoleAliasExesLengthW
Module32FirstW
SetConsoleDisplayMode
DisconnectNamedPipe
GetDiskFreeSpaceExW
PeekNamedPipe
SearchPathA
DeviceIoControl
VirtualQuery
OpenProcess
EnumCalendarInfoW
CreateDirectoryW
QueryInformationJobObject
GetPrivateProfileStructW
GetCPInfo
SetSystemPowerState
GetPrivateProfileIntW
PrepareTape
IsDBCSLeadByteEx
DuplicateHandle
GetConsoleCursorInfo
FindResourceExW
GetModuleHandleA
GetCommandLineW
GetSystemWindowsDirectoryW
lstrcpynA
MoveFileWithProgressW
GlobalLock
FindAtomA
ExpandEnvironmentStringsW
GetCurrentProcess
GetEnvironmentVariableA
DeleteTimerQueueEx
CreateNamedPipeA
GetDiskFreeSpaceA
GetNamedPipeHandleStateA
FindVolumeMountPointClose
GetAtomNameA
Module32Next
FindFirstVolumeA
IsSystemResumeAutomatic
GetPrivateProfileSectionNamesA
GetConsoleCP
WideCharToMultiByte
FindFirstFileA
GetUserDefaultLCID
GetFileType
GetUserDefaultUILanguage
ContinueDebugEvent
LCMapStringA
CreateFileMappingA
SetComputerNameExW
GetProfileStringA
CreateMutexA
SystemTimeToTzSpecificLocalTime
CreateToolhelp32Snapshot
GetCurrentThread
CreateDirectoryExW
DosDateTimeToFileTime
SetCurrentDirectoryW
ReadFile
SetThreadExecutionState
FileTimeToSystemTime
CompareFileTime
SetComputerNameExA
GetFileAttributesW
GetModuleHandleW
CreateHardLinkA
SetConsoleOutputCP
CopyFileExA
SetInformationJobObject
CreateIoCompletionPort
ResetEvent
DnsHostnameToComputerNameW
DeleteTimerQueueTimer
GetFileAttributesExW
GetConsoleAliasExesW
FindNextChangeNotification
SetFileAttributesW
GetStringTypeW
FlushConsoleInputBuffer
GetProfileIntA
SetHandleInformation
GetEnvironmentVariableW
SetStdHandle
GetVolumeInformationW
GetOEMCP
VirtualAlloc
GetEnvironmentStrings
SetThreadPriorityBoost
SetConsoleActiveScreenBuffer
CreateJobObjectW
GetSystemWindowsDirectoryA
FindVolumeClose
GetTimeFormatA
CompareStringW
IsValidCodePage
GetCPInfoExA
GetFileTime
GetPrivateProfileStructA
GetDiskFreeSpaceW
SetFileTime
rpcrt4
RpcServerRegisterAuthInfoW
NdrCreateServerInterfaceFromStub
RpcServerUseProtseqA
UuidIsNil
RpcServerRegisterIf
MesDecodeIncrementalHandleCreate
NdrMesTypeAlignSize2
RpcBindingInqAuthClientW
NdrMesProcEncodeDecode2
RpcServerRegisterIfEx
NdrMesTypeDecode2
IUnknown_AddRef_Proxy
RpcStringFreeW
RpcStringBindingComposeW
RpcMgmtSetComTimeout
RpcStringBindingComposeA
NdrConformantArrayMarshall
RpcServerInqDefaultPrincNameW
RpcServerUnregisterIf
UuidToStringA
NdrCorrelationInitialize
NdrClientCall2
RpcErrorGetNextRecord
RpcServerUseProtseqExW
UuidToStringW
NdrCorrelationFree
RpcMgmtStopServerListening
RpcBindingVectorFree
MesHandleFree
RpcAsyncGetCallStatus
RpcSsGetContextBinding
RpcEpRegisterW
IUnknown_Release_Proxy
RpcServerInqCallAttributesW
RpcMgmtInqStats
RpcSmDestroyClientContext
RpcEpRegisterA
RpcSsFree
RpcSsDestroyClientContext
RpcServerListen
RpcBindingSetAuthInfoA
RpcRevertToSelf
user32
SetTimer
IntersectRect
LoadStringA
ReleaseCapture
RemovePropW
EnumWindows
SendMessageTimeoutW
SetMenuDefaultItem
FindWindowW
DestroyMenu
CharLowerBuffW
MapDialogRect
SetMenuItemInfoW
GetCursor
SendNotifyMessageW
GetScrollInfo
LoadStringW
SetWindowRgn
DefWindowProcW
PeekMessageW
MonitorFromRect
CreateIconIndirect
UnregisterClassW
UnhookWindowsHookEx
SetRectEmpty
CharNextW
FindWindowA
CallWindowProcW
SetWindowPlacement
wsprintfA
TrackPopupMenuEx
IsWindowVisible
GetSysColorBrush
IsRectEmpty
GetSysColor
PostMessageA
GetDlgCtrlID
WinHelpW
GetDialogBaseUnits
IsWindowEnabled
GetAltTabInfoA
GetKeyboardState
RegisterClassW
IsDlgButtonChecked
LoadCursorA
SetPropW
GetMessageA
RegisterWindowMessageW
SetFocus
PostMessageW
EndPaint
CloseWindowStation
IsDialogMessageA
OffsetRect
AdjustWindowRectEx
SetThreadDesktop
GetDC
SystemParametersInfoW
RegisterDeviceNotificationW
GetParent
CharLowerW
MoveWindow
comctl32
CreateToolbarEx
CreatePropertySheetPageW
ord17
ImageList_Add
ImageList_LoadImageA
InitializeFlatSB
FlatSB_GetScrollPos
CreatePropertySheetPageA
PropertySheetA
ImageList_SetDragCursorImage
ImageList_Remove
ImageList_Write
ImageList_Copy
ImageList_GetIconSize
PropertySheetW
ImageList_LoadImageW
ImageList_DragShowNolock
ImageList_GetDragImage
FlatSB_SetScrollPos
CreateStatusWindowW
ImageList_ReplaceIcon
ImageList_DrawEx
ImageList_Replace
ImageList_SetImageCount
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_Destroy
ImageList_SetIconSize
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Read
ImageList_DragEnter
ImageList_GetImageInfo
FlatSB_SetScrollInfo
ImageList_DragLeave
InitCommonControlsEx
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_DragMove
ImageList_DrawIndirect
FlatSB_SetScrollProp
ImageList_EndDrag
ImageList_SetBkColor
ImageList_GetIcon
ImageList_BeginDrag
DestroyPropertySheetPage
ImageList_Create
ImageList_Draw
advapi32
AreAnyAccessesGranted
AddAccessDeniedAce
SetTokenInformation
RegSetValueW
OpenProcessToken
RegNotifyChangeKeyValue
AllocateAndInitializeSid
GetSidSubAuthority
QueryServiceStatus
RegCloseKey
RegEnumValueA
AdjustTokenPrivileges
OpenSCManagerA
StartServiceA
RegQueryInfoKeyA
ControlService
RegFlushKey
RegEnumKeyA
CryptAcquireContextA
GetSecurityDescriptorSacl
LsaClose
RegQueryInfoKeyW
OpenServiceA
RegOpenKeyExW
FreeSid
RegOpenKeyW
GetUserNameW
OpenThreadToken
CryptDestroyHash
RegDeleteKeyW
RegCreateKeyA
IsValidSid
RegConnectRegistryW
GetSecurityDescriptorDacl
OpenSCManagerW
RegQueryValueExW
CryptHashData
SetSecurityDescriptorOwner
GetLengthSid
AddAccessAllowedAce
RegQueryMultipleValuesA
GetSidSubAuthorityCount
RegQueryValueExA
RegSetValueA
SetKernelObjectSecurity
GetCurrentHwProfileW
GetSidIdentifierAuthority
AreAllAccessesGranted
AddAuditAccessAce
RegSetKeySecurity
RegQueryMultipleValuesW
InitializeSecurityDescriptor
RegSetValueExA
InitializeAcl
RegCreateKeyExA
GetTokenInformation
GetSidLengthRequired
RegCreateKeyExW
GetKernelObjectSecurity
GetCurrentHwProfileA
RegSetValueExW
shell32
SHBindToParent
SHFileOperationW
SHBrowseForFolderW
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetMalloc
CommandLineToArgvW
SHChangeNotify
ShellExecuteExW
SHGetDesktopFolder
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderLocation
ole32
CoInvalidateRemoteMachineBindings
ReadClassStm
OleConvertIStorageToOLESTREAM
OleConvertOLESTREAMToIStorageEx
HWND_UserFree
HACCEL_UserMarshal
CreateOleAdviseHolder
CoGetStdMarshalEx
StgCreateStorageEx
WriteClassStm
OleRegEnumFormatEtc
HGLOBAL_UserFree
WriteClassStg
CoMarshalInterThreadInterfaceInStream
OleInitialize
CoGetCurrentLogicalThreadId
CoAddRefServerProcess
CoImpersonateClient
HICON_UserMarshal
CLSIDFromString
oleaut32
GetErrorInfo
VariantCopy
VariantChangeTypeEx
VariantInit
GetActiveObject
SafeArrayGetLBound
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ