Static task
static1
Behavioral task
behavioral1
Sample
79e559c2a82d86af7f72e7db787c62d80f6101ed0c40e3b44847deb58001a8ff.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
79e559c2a82d86af7f72e7db787c62d80f6101ed0c40e3b44847deb58001a8ff.exe
Resource
win10v2004-20221111-en
General
-
Target
79e559c2a82d86af7f72e7db787c62d80f6101ed0c40e3b44847deb58001a8ff
-
Size
135KB
-
MD5
1389f1eec5e9ee38304e016e9c9091cf
-
SHA1
aeab3a5dc10c79cbe7746a5c992031951169d2db
-
SHA256
79e559c2a82d86af7f72e7db787c62d80f6101ed0c40e3b44847deb58001a8ff
-
SHA512
25e60c8a27b686d1279cc3214fa0405e5ddb0f02a73ca9d4496b045b5755f1dc1f160ebb3f9995eee437ef6b62c0176c25e2bf9e352d6c03ec63551683869227
-
SSDEEP
3072:0Wc1rJyJRPL3wDU6OOuYxL9avdEiX0JpWl3d4g:0WclJyrTyUnOumL9ke24
Malware Config
Signatures
Files
-
79e559c2a82d86af7f72e7db787c62d80f6101ed0c40e3b44847deb58001a8ff.exe windows x86
63e3be249c171a69e2e367e5752c1c8c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
HttpOpenRequestA
InternetConnectA
HttpAddRequestHeadersA
InternetQueryDataAvailable
InternetOpenUrlA
InternetGetCookieA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
InternetReadFile
HttpQueryInfoA
InternetGetConnectedState
setupapi
SetupIterateCabinetA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
ws2_32
WSACleanup
gethostname
WSAStartup
kernel32
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
SetUnhandledExceptionFilter
GetSystemInfo
InterlockedIncrement
lstrcpyA
InterlockedDecrement
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
LocalAlloc
lstrlenA
FormatMessageA
LocalFree
LoadLibraryA
CloseHandle
GetProcAddress
GetModuleHandleA
CreateProcessA
WaitForSingleObject
GetLastError
lstrcatA
CreateDirectoryA
GetEnvironmentStringsW
GetTempPathA
GetTickCount
WritePrivateProfileSectionA
RemoveDirectoryA
WritePrivateProfileStringA
GetShortPathNameA
DeleteFileA
WriteFile
CreateFileA
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleFileNameA
GetCurrentProcess
GetCurrentThread
LockResource
LoadResource
SizeofResource
FindResourceA
Sleep
MultiByteToWideChar
WideCharToMultiByte
VirtualProtect
GetTimeZoneInformation
LCMapStringW
LCMapStringA
SetHandleCount
GetFileType
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
SetFilePointer
SetEnvironmentVariableA
SetEndOfFile
ReadFile
CompareStringA
CompareStringW
GetTempFileNameA
GetCPInfo
GetOEMCP
HeapSize
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
VirtualQuery
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
HeapReAlloc
HeapAlloc
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
GetDateFormatA
GetTimeFormatA
HeapFree
RtlUnwind
ExitProcess
GetWindowsDirectoryA
GetFileInformationByHandle
lstrcmpA
GetVolumeInformationA
user32
wsprintfA
GetActiveWindow
advapi32
FreeSid
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
shell32
FindExecutableA
ole32
CoCreateGuid
StringFromGUID2
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
OleRun
oleaut32
GetErrorInfo
VariantClear
VariantChangeType
VariantCopy
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
SysStringLen
netapi32
Netbios
Sections
.text Size: 93KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE