Static task
static1
Behavioral task
behavioral1
Sample
32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62.exe
Resource
win10v2004-20221111-en
General
-
Target
32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62
-
Size
1.7MB
-
MD5
f0bbab3157f4449ca351557d5831296b
-
SHA1
9df273af889fe341ace0c141c4b2eae790d04759
-
SHA256
32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62
-
SHA512
57e8378d216431dad61b3b4ef390b3ed502297b27d853757c6158cb9caf73ddd528fe4e7023e1dd666ec49a759e4c46ee39594847c0ae2b87406f4016b648732
-
SSDEEP
24576:CMlR7xnnalkQk8ql5rvwbxmhRHWNY4mLxgPOh:CM/n+qzrKERHWNhm1z
Malware Config
Signatures
Files
-
32b670c390a5d2ccd57615b448052c4425cbba77e894205ec8cd3547debd9a62.exe windows x86
f9acefaa7a21cc0789f1db668afb40a6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
MoveFileA
SetEvent
GetProfileSectionW
GetFileAttributesExA
EnumCalendarInfoExA
GetLogicalDriveStringsW
GetPriorityClass
CreateWaitableTimerW
GetUserDefaultLCID
SetCalendarInfoW
IsDebuggerPresent
GetBinaryTypeA
ExpandEnvironmentStringsA
FindFirstVolumeMountPointA
GetProfileSectionA
GetCPInfoExW
GetPrivateProfileStringW
CreateJobObjectA
GetConsoleAliasA
CreateToolhelp32Snapshot
SetProcessWorkingSetSize
OpenWaitableTimerW
SetFileTime
CreateFileW
ConvertThreadToFiber
ReadProcessMemory
CreateTapePartition
GetEnvironmentVariableW
SetConsoleCtrlHandler
GetCPInfoExA
RemoveDirectoryA
FindResourceExA
ResetWriteWatch
SetThreadIdealProcessor
ChangeTimerQueueTimer
DeleteTimerQueue
GetCommandLineW
SwitchToThread
SetCurrentDirectoryW
GlobalDeleteAtom
GetPrivateProfileSectionW
GetCPInfo
LCMapStringW
HeapValidate
CreateMutexA
IsValidCodePage
GetProfileIntW
LoadResource
SetThreadContext
DeleteAtom
FindFirstVolumeA
FindResourceW
CreateMutexW
OpenProcess
AddAtomW
GetProcessTimes
GetPrivateProfileStructA
QueryPerformanceFrequency
OpenEventA
MapUserPhysicalPagesScatter
GetEnvironmentStrings
GetShortPathNameA
ResetEvent
GetHandleInformation
Module32Next
VirtualQuery
ReplaceFileW
ReleaseMutex
GetConsoleAliasExesLengthW
GetEnvironmentVariableA
SetPriorityClass
GetCurrencyFormatA
GetFileSize
GetFileAttributesA
GetModuleFileNameA
CopyFileExW
GetTempPathA
Module32FirstW
GetConsoleAliasExesA
ReplaceFileA
GetProcessWorkingSetSize
GetFileSizeEx
CreateIoCompletionPort
SetEnvironmentVariableW
CancelIo
CopyFileA
SetProcessPriorityBoost
GetDriveTypeA
OpenJobObjectW
ConvertDefaultLocale
GetProfileIntA
GetSystemDirectoryA
SetMailslotInfo
GetDiskFreeSpaceA
FindFirstFileA
lstrcmpA
FlushFileBuffers
SetThreadAffinityMask
GetVolumeInformationA
ReleaseSemaphore
GetConsoleScreenBufferInfo
SetWaitableTimer
GetNumberFormatW
GetCurrentConsoleFont
FindFirstFileExA
EraseTape
PeekNamedPipe
SetEnvironmentVariableA
GetCurrentProcess
GlobalHandle
SetThreadExecutionState
GetBinaryTypeW
SetConsoleActiveScreenBuffer
PostQueuedCompletionStatus
GetStdHandle
DefineDosDeviceW
FormatMessageA
GetLogicalDrives
CompareStringA
SetComputerNameExW
ExpandEnvironmentStringsW
FoldStringW
GetFileAttributesExW
GetCompressedFileSizeA
DuplicateHandle
CreateMailslotW
EnumCalendarInfoExW
GetFileInformationByHandle
FlushInstructionCache
DnsHostnameToComputerNameW
GetWindowsDirectoryA
GetLocaleInfoA
DeviceIoControl
LCMapStringA
GetConsoleAliasW
ProcessIdToSessionId
OpenWaitableTimerA
CreateDirectoryExW
SetConsoleMode
CreateDirectoryA
OpenFileMappingA
HeapReAlloc
HeapAlloc
HeapSize
RtlUnwind
GetACP
Sleep
HeapFree
TerminateProcess
UnhandledExceptionFilter
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
HeapCreate
InterlockedDecrement
GetLastError
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
DeleteCriticalSection
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
WideCharToMultiByte
WriteFile
DecodePointer
IsProcessorFeaturePresent
ExitProcess
SetUnhandledExceptionFilter
HeapSetInformation
GetCommandLineA
GetCompressedFileSizeW
WaitForMultipleObjectsEx
PrepareTape
FindResourceExW
IsDBCSLeadByteEx
GetProcAddress
GetNumberOfConsoleInputEvents
GetQueuedCompletionStatus
GetTimeFormatW
GetModuleHandleW
ReadFile
CreateEventW
OpenFileMappingW
RemoveDirectoryW
OpenThread
AddAtomA
GetFileTime
EnumCalendarInfoA
SetFileAttributesA
GetProfileStringA
FindResourceA
SetLocaleInfoA
GetSystemWindowsDirectoryA
CreateTimerQueue
GetVersion
SetVolumeMountPointA
VerSetConditionMask
GetStringTypeExW
ContinueDebugEvent
GetCurrencyFormatW
GetProcessAffinityMask
FreeLibraryAndExitThread
CreateHardLinkA
CreateFileMappingA
GetConsoleAliasExesW
GetUserDefaultUILanguage
GetFullPathNameA
AssignProcessToJobObject
DnsHostnameToComputerNameA
GetDateFormatA
OpenSemaphoreW
GetAtomNameA
CreateEventA
SearchPathA
CompareFileTime
GetVolumeNameForVolumeMountPointA
GetStringTypeW
FindNextChangeNotification
GetConsoleOutputCP
FlushViewOfFile
MoveFileExW
IsBadCodePtr
CreateJobObjectW
FoldStringA
GetThreadPriority
QueueUserWorkItem
GetProcessVersion
SetErrorMode
GetPrivateProfileIntA
GetProcessIoCounters
SetTapeParameters
OpenMutexA
GetWindowsDirectoryW
GetCalendarInfoA
QueryDosDeviceW
IsSystemResumeAutomatic
SetCalendarInfoA
SetFileAttributesW
GetConsoleMode
GetTempPathW
GetSystemDefaultUILanguage
OpenEventW
SetStdHandle
GetEnvironmentStringsW
MapViewOfFileEx
GetVolumeInformationW
GetNumberFormatA
SetLocaleInfoW
BindIoCompletionCallback
GetNamedPipeHandleStateA
CreateDirectoryExA
SetThreadPriority
CompareStringW
DeleteVolumeMountPointA
GetDiskFreeSpaceExW
GetAtomNameW
GetModuleFileNameW
DisconnectNamedPipe
CreateDirectoryW
GetConsoleAliasesW
GetOEMCP
GetDriveTypeW
FindVolumeMountPointClose
OpenMutexW
VirtualAlloc
GetSystemDefaultLCID
GetFileAttributesW
GetThreadLocale
FreeEnvironmentStringsA
SetThreadPriorityBoost
GetStringTypeA
SetThreadLocale
GetFullPathNameW
AreFileApisANSI
CopyFileExA
SetConsoleCP
GetCurrentThread
QueryInformationJobObject
GetProcessPriorityBoost
FreeEnvironmentStringsW
CopyFileW
FindAtomA
rpcrt4
RpcBindingSetObject
UuidFromStringW
RpcServerUseProtseqEpA
RpcServerTestCancel
NdrConvert
RpcServerRegisterIf
RpcCertGeneratePrincipalNameA
RpcSsGetContextBinding
NdrUserMarshalBufferSize
RpcMgmtInqServerPrincNameW
RpcServerRegisterIfEx
RpcServerInqBindings
MesEncodeFixedBufferHandleCreate
RpcErrorEndEnumeration
RpcMgmtWaitServerListen
RpcErrorGetNextRecord
IUnknown_QueryInterface_Proxy
RpcBindingSetAuthInfoW
RpcAsyncInitializeHandle
RpcServerUseProtseqEpW
RpcBindingToStringBindingW
UuidToStringW
RpcErrorGetNumberOfRecords
NdrMesTypeEncode2
UuidFromStringA
RpcMgmtIsServerListening
RpcErrorSaveErrorInfo
MesDecodeBufferHandleCreate
NdrCorrelationInitialize
RpcMgmtEpEltInqNextW
RpcServerUnregisterIfEx
RpcBindingInqAuthClientExA
RpcServerUnregisterIf
RpcImpersonateClient
RpcAsyncCompleteCall
RpcMgmtSetServerStackSize
RpcFreeAuthorizationContext
NdrDcomAsyncClientCall
RpcServerUseProtseqA
RpcServerInqCallAttributesA
NdrInterfacePointerFree
NdrClearOutParameters
RpcMgmtStatsVectorFree
RpcMgmtSetCancelTimeout
MesIncrementalHandleReset
NdrMesProcEncodeDecode2
RpcBindingFree
RpcBindingFromStringBindingW
NdrPointerMarshall
NdrAsyncServerCall
NdrInterfacePointerUnmarshall
NdrMesTypeFree2
RpcEpResolveBinding
RpcBindingInqAuthInfoExW
NdrOleAllocate
RpcStringBindingComposeA
NdrFullPointerXlatInit
NdrOleFree
RpcMgmtEpEltInqBegin
RpcBindingInqAuthClientExW
NdrConformantStringBufferSize
RpcEpRegisterNoReplaceW
NdrFullPointerXlatFree
user32
GetAltTabInfoA
TrackPopupMenu
GetWindow
EndDialog
EnumDisplayMonitors
IntersectRect
SetMenuDefaultItem
DefWindowProcA
EmptyClipboard
GetUpdateRect
AdjustWindowRectEx
PeekMessageA
IsDlgButtonChecked
OpenDesktopW
SendMessageA
GetMessageW
CharToOemBuffA
GetParent
DrawIconEx
LoadBitmapW
IsCharAlphaNumericW
comctl32
CreateToolbarEx
_TrackMouseEvent
ImageList_BeginDrag
ImageList_GetImageCount
ImageList_Copy
ImageList_Read
PropertySheetW
ImageList_DrawIndirect
PropertySheetA
FlatSB_SetScrollProp
ImageList_Create
ImageList_SetIconSize
ImageList_Replace
ImageList_DragLeave
ImageList_LoadImageA
ImageList_LoadImageW
ImageList_Draw
ImageList_AddMasked
ImageList_DragMove
DestroyPropertySheetPage
ImageList_ReplaceIcon
ImageList_SetOverlayImage
ImageList_EndDrag
ImageList_SetImageCount
ImageList_DragShowNolock
FlatSB_SetScrollInfo
CreatePropertySheetPageW
ImageList_GetImageInfo
ImageList_DragEnter
ImageList_SetDragCursorImage
CreatePropertySheetPageA
ImageList_GetIcon
ImageList_DrawEx
InitCommonControlsEx
ImageList_GetBkColor
ImageList_Remove
InitializeFlatSB
FlatSB_GetScrollPos
ImageList_Destroy
FlatSB_GetScrollInfo
ImageList_Add
ord17
CreateStatusWindowW
ImageList_SetBkColor
ImageList_GetIconSize
ImageList_GetDragImage
ImageList_Write
FlatSB_SetScrollPos
advapi32
CloseServiceHandle
OpenServiceA
GetSecurityDescriptorControl
QueryServiceConfigW
OpenProcessToken
CryptGetHashParam
RegSetValueW
RegSetValueA
RegNotifyChangeKeyValue
InitializeSecurityDescriptor
RegCreateKeyExA
AddAccessAllowedAce
GetCurrentHwProfileA
RegQueryMultipleValuesW
GetSidLengthRequired
GetKernelObjectSecurity
SetKernelObjectSecurity
RegQueryMultipleValuesA
GetSidSubAuthorityCount
AddAccessDeniedAce
RegCreateKeyExW
DuplicateTokenEx
LsaClose
RegEnumKeyExA
RegOpenKeyExA
CreateWellKnownSid
CryptHashData
RegDeleteValueA
LsaFreeMemory
IsValidSid
RegisterEventSourceW
RegQueryInfoKeyA
GetAclInformation
RegDeleteKeyA
CryptCreateHash
OpenThreadToken
SetEntriesInAclW
RegEnumValueW
SetFileSecurityW
StartServiceW
GetSidIdentifierAuthority
MakeSelfRelativeSD
ChangeServiceConfigW
ReportEventW
GetSidSubAuthority
RegFlushKey
RegQueryInfoKeyW
RegQueryValueExA
InitializeAcl
SetTokenInformation
AreAnyAccessesGranted
RegSetKeySecurity
RegOpenKeyW
AddAuditAccessAce
AreAllAccessesGranted
RegSetValueExA
RegSetValueExW
RegEnumKeyW
GetTokenInformation
CryptGenRandom
GetCurrentHwProfileW
ImpersonateLoggedOnUser
shell32
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteW
SHGetFolderPathW
SHGetFileInfoW
SHGetDesktopFolder
SHBindToParent
SHFileOperationW
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteExW
SHBrowseForFolderW
SHChangeNotify
ole32
RevokeDragDrop
HWND_UserFree
HBITMAP_UserSize
CreateStreamOnHGlobal
StgOpenStorageOnILockBytes
CoTaskMemAlloc
OleCreateFromData
StgSetTimes
CoRevokeInitializeSpy
CoFileTimeToDosDateTime
HACCEL_UserMarshal
CoInitializeSecurity
OleSetMenuDescriptor
HBITMAP_UserMarshal
CreateGenericComposite
HBITMAP_UserFree
CoMarshalHresult
CoCreateInstance
OleFlushClipboard
HACCEL_UserFree
StringFromIID
HPALETTE_UserFree
OleDraw
CoMarshalInterThreadInterfaceInStream
PropVariantCopy
OleConvertIStorageToOLESTREAM
HWND_UserMarshal
HGLOBAL_UserSize
CoGetContextToken
HDC_UserMarshal
OleSetAutoConvert
CoRegisterPSClsid
CoGetStandardMarshal
StgCreateDocfileOnILockBytes
HPALETTE_UserSize
CoDisconnectObject
SetConvertStg
CoReleaseMarshalData
CoTaskMemFree
CoUnmarshalInterface
CoFreeAllLibraries
OleGetClipboard
CreateItemMoniker
CoLockObjectExternal
OleLoad
ProgIDFromCLSID
OleRegGetUserType
OleIsCurrentClipboard
HGLOBAL_UserFree
CoQueryProxyBlanket
CoGetCallerTID
CoDisableCallCancellation
OleCreateMenuDescriptor
HICON_UserSize
HDC_UserFree
CoImpersonateClient
IsAccelerator
CoInitialize
CoGetMarshalSizeMax
OleSetContainedObject
oleaut32
SysAllocStringLen
SysFreeString
GetErrorInfo
VariantInit
SysAllocStringByteLen
VariantChangeType
VariantChangeTypeEx
SysStringLen
GetActiveObject
SysReAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetLBound
VariantClear
SafeArrayCreate
VariantCopy
SafeArrayGetUBound
VariantCopyInd
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 43KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ