Static task
static1
Behavioral task
behavioral1
Sample
1c1a765bdaac056ae04b9ef813163db9b4297b79958a26ca643afdc8e6b1e700.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1c1a765bdaac056ae04b9ef813163db9b4297b79958a26ca643afdc8e6b1e700.exe
Resource
win10v2004-20221111-en
General
-
Target
1c1a765bdaac056ae04b9ef813163db9b4297b79958a26ca643afdc8e6b1e700
-
Size
1.6MB
-
MD5
aba2650f6448bc9f6252502de81e4655
-
SHA1
14d7514e268dd9b098f238c064ea702c8e96597f
-
SHA256
1c1a765bdaac056ae04b9ef813163db9b4297b79958a26ca643afdc8e6b1e700
-
SHA512
97e456adb4aebf91084d088dd9a91a290ab53d39d6d537986e0d9d54b275ff8e9d61cb09ba58b644ca3c97aa37e84369b32075f196844f1c6ed8e28d8fec89d6
-
SSDEEP
12288:mUTGtMXDXv6j6DC28BF/Zz7+69hBfx6eKXZQece3rRWPKPdzeKAPmWAqT:mUiIyj6gBNs6tKX/cebRUQzTAHAqT
Malware Config
Signatures
Files
-
1c1a765bdaac056ae04b9ef813163db9b4297b79958a26ca643afdc8e6b1e700.exe windows x86
8274f4f051ab6fb0114cd8662e30ae89
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocalTime
IsBadReadPtr
GetFileAttributesExW
GetProfileStringA
IsValidCodePage
ReleaseMutex
CreateEventA
DefineDosDeviceW
GetEnvironmentStringsW
SetConsoleActiveScreenBuffer
GetFullPathNameW
CreateProcessA
GetProcessWorkingSetSize
GetUserDefaultUILanguage
FindVolumeClose
GetVolumeNameForVolumeMountPointA
GetConsoleCP
GetFileAttributesA
GetCurrencyFormatA
SetStdHandle
FormatMessageW
ExpandEnvironmentStringsA
SetVolumeMountPointA
RemoveDirectoryA
ContinueDebugEvent
GetVolumeInformationW
GetBinaryTypeW
PostQueuedCompletionStatus
GetPrivateProfileSectionNamesA
GetVersion
GetStringTypeW
GetLogicalDriveStringsA
DefineDosDeviceA
GetDriveTypeA
GetDevicePowerState
FreeLibraryAndExitThread
SetSystemTimeAdjustment
GetVolumeInformationA
BindIoCompletionCallback
CreateJobObjectW
SleepEx
SetUnhandledExceptionFilter
CreateMutexA
OpenMutexW
QueueUserWorkItem
GetStringTypeExW
GetCurrentDirectoryW
SetInformationJobObject
ReleaseSemaphore
FoldStringW
PrepareTape
SetErrorMode
SetCurrentDirectoryA
CreateDirectoryExA
GetProcessVersion
GetCommandLineA
GetThreadContext
GetDateFormatA
SuspendThread
GetFullPathNameA
FindFirstVolumeW
GetFileType
FindResourceExA
GetCurrencyFormatW
SetTapeParameters
CreateSemaphoreA
MapViewOfFile
FindResourceExW
GetCommandLineW
OpenMutexA
CreateWaitableTimerW
ConvertDefaultLocale
OpenWaitableTimerW
GetCurrentDirectoryA
EnumCalendarInfoW
CopyFileExW
GetConsoleOutputCP
SetThreadAffinityMask
GetStringTypeA
ProcessIdToSessionId
FindNextChangeNotification
DeleteVolumeMountPointA
Module32Next
RtlUnwind
GetACP
GetProcessTimes
GetTimeZoneInformation
GetNumberFormatW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
OpenJobObjectA
GetNamedPipeHandleStateW
FreeEnvironmentStringsA
CreateFileW
lstrcatA
GetNumberOfConsoleInputEvents
OpenJobObjectW
SetFileTime
AddAtomW
SetTapePosition
QueryInformationJobObject
CopyFileExA
SetNamedPipeHandleState
GetCPInfo
SetProcessWorkingSetSize
SetThreadExecutionState
EnumCalendarInfoExA
OpenSemaphoreA
MapUserPhysicalPagesScatter
GetTempPathA
OpenEventW
CreateDirectoryExW
SetThreadLocale
GetTempPathW
FlushInstructionCache
SetPriorityClass
GetCalendarInfoW
GetEnvironmentVariableW
HeapReAlloc
HeapAlloc
HeapSize
Sleep
HeapFree
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
InterlockedDecrement
GetLastError
GetCurrentThreadId
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
DeleteCriticalSection
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetModuleFileNameW
WriteFile
DecodePointer
ExitProcess
GetModuleHandleW
HeapSetInformation
SetComputerNameExA
HeapCreate
OpenEventA
DeleteAtom
GetDateFormatW
SetComputerNameExW
IsProcessorFeaturePresent
SetFileAttributesW
GetProfileIntW
GetTempFileNameW
GetShortPathNameA
CreateTapePartition
CreateDirectoryW
MapViewOfFileEx
GetBinaryTypeA
GetVolumePathNameW
GetProcAddress
GetEnvironmentVariableA
GetDiskFreeSpaceW
FindFirstFileA
GetTapeStatus
GetAtomNameA
MapUserPhysicalPages
GetStringTypeExA
GetAtomNameW
DuplicateHandle
WideCharToMultiByte
CompareFileTime
GetProcessIoCounters
CreateProcessW
GetOEMCP
Module32NextW
DnsHostnameToComputerNameW
GetThreadLocale
CreateMutexW
VerSetConditionMask
FlushConsoleInputBuffer
SetEvent
IsDebuggerPresent
EnumCalendarInfoA
GetConsoleWindow
SearchPathA
GetQueuedCompletionStatus
GetLocaleInfoW
MultiByteToWideChar
GetThreadTimes
GetDiskFreeSpaceExA
FindAtomW
DisconnectNamedPipe
ReplaceFileW
GetCalendarInfoA
DosDateTimeToFileTime
SetCurrentDirectoryW
OpenFileMappingA
DeleteTimerQueueTimer
GetConsoleAliasExesA
IsBadCodePtr
DeviceIoControl
SetCalendarInfoW
CopyFileA
SetFileAttributesA
FlushFileBuffers
GetPrivateProfileStructA
FreeUserPhysicalPages
AreFileApisANSI
DeleteFileA
FileTimeToSystemTime
GetProfileIntA
GetFileInformationByHandle
FindFirstVolumeA
FreeEnvironmentStringsW
GetModuleFileNameA
GetFileSize
GetConsoleAliasA
GetProcessPriorityBoost
CopyFileW
OpenWaitableTimerA
GetPrivateProfileSectionNamesW
ReplaceFileA
GlobalLock
SetProcessAffinityMask
VirtualAlloc
LCMapStringA
CreateNamedPipeA
SetLocaleInfoA
GetProfileSectionA
OpenFileMappingW
LCMapStringW
CreateHardLinkA
OpenThread
FindResourceW
GetSystemDefaultLangID
FindAtomA
GetEnvironmentStrings
SetProcessPriorityBoost
ConvertThreadToFiber
GetStdHandle
SetConsoleOutputCP
rpcrt4
RpcAsyncAbortCall
RpcNetworkIsProtseqValidA
RpcServerRegisterAuthInfoA
NdrUserMarshalMarshall
NdrAsyncServerCall
RpcMgmtSetServerStackSize
RpcServerRegisterIf
RpcServerInqCallAttributesW
RpcEpRegisterNoReplaceW
RpcBindingSetOption
UuidEqual
IUnknown_Release_Proxy
RpcUserFree
RpcImpersonateClient
RpcErrorStartEnumeration
MesEncodeDynBufferHandleCreate
RpcBindingCopy
RpcBindingFree
NdrServerCall2
NdrMesTypeFree2
RpcServerUseProtseqEpExA
RpcServerInqDefaultPrincNameW
UuidCompare
RpcErrorEndEnumeration
RpcMgmtEnableIdleCleanup
RpcServerUseProtseqIfW
RpcServerUseProtseqEpExW
NdrSimpleStructUnmarshall
RpcMgmtInqComTimeout
NdrCorrelationInitialize
RpcIfInqId
RpcSsGetContextBinding
RpcMgmtInqServerPrincNameW
RpcMgmtEpEltInqBegin
RpcMgmtWaitServerListen
RpcBindingInqAuthInfoA
NdrAsyncClientCall
RpcServerInqBindings
RpcObjectSetType
RpcServerUseProtseqW
MesDecodeIncrementalHandleCreate
RpcBindingInqAuthClientExW
RpcEpResolveBinding
RpcBindingInqAuthClientA
NdrSimpleTypeMarshall
RpcErrorAddRecord
RpcMgmtInqStats
NdrConformantArrayBufferSize
UuidFromStringW
RpcBindingToStringBindingW
RpcBindingSetAuthInfoExA
RpcRevertToSelf
NdrClearOutParameters
RpcServerRegisterIfEx
RpcCancelThreadEx
NdrUserMarshalBufferSize
RpcServerYield
RpcServerUseAllProtseqsIf
MesEncodeIncrementalHandleCreate
NdrStubCall
RpcBindingInqObject
NdrSimpleStructBufferSize
user32
GetAltTabInfoA
SetWindowsHookExA
LoadBitmapW
GetLastActivePopup
DestroyIcon
CharToOemA
CreatePopupMenu
DeferWindowPos
EnableWindow
ValidateRect
DefWindowProcA
UpdateWindow
AppendMenuA
GetActiveWindow
SetActiveWindow
TrackPopupMenuEx
CharUpperW
GetWindowTextA
InflateRect
SetProcessWindowStation
CreateWindowExA
ReleaseCapture
GetWindowLongA
IsIconic
RegisterWindowMessageA
GetWindowTextW
SetPropW
EmptyClipboard
TrackPopupMenu
CopyIcon
WindowFromPoint
EnumDisplaySettingsW
IntersectRect
CharLowerA
GetWindowInfo
ActivateKeyboardLayout
GetShellWindow
SetClipboardData
GetDoubleClickTime
InvalidateRgn
CheckDlgButton
EnableMenuItem
GetDesktopWindow
wvsprintfA
GetSubMenu
SetFocus
AppendMenuW
GetSystemMetrics
GetSysColorBrush
wvsprintfW
DrawIconEx
SendMessageW
GetPropA
GetKeyboardLayoutList
AttachThreadInput
FrameRect
DrawTextW
MapWindowPoints
GetNextDlgTabItem
RemoveMenu
MsgWaitForMultipleObjects
ScrollWindowEx
comctl32
ImageList_GetIconSize
ImageList_Write
ImageList_DrawEx
ImageList_SetDragCursorImage
ImageList_DragLeave
FlatSB_GetScrollPos
ImageList_AddMasked
ImageList_Add
FlatSB_SetScrollInfo
ImageList_Create
CreateStatusWindowW
ImageList_Draw
ImageList_Destroy
InitializeFlatSB
ImageList_LoadImageA
ImageList_Replace
ImageList_LoadImageW
ImageList_Remove
CreatePropertySheetPageW
DestroyPropertySheetPage
ImageList_GetImageInfo
ord17
ImageList_DrawIndirect
CreateToolbarEx
ImageList_DragShowNolock
ImageList_BeginDrag
ImageList_EndDrag
ImageList_GetIcon
ImageList_Read
FlatSB_SetScrollPos
ImageList_GetDragImage
ImageList_SetIconSize
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_SetImageCount
InitCommonControlsEx
FlatSB_SetScrollProp
ImageList_SetOverlayImage
ImageList_ReplaceIcon
CreatePropertySheetPageA
PropertySheetW
ImageList_GetImageCount
ImageList_Copy
PropertySheetA
ImageList_GetBkColor
ImageList_DragMove
ImageList_SetBkColor
ImageList_DragEnter
advapi32
RegSetValueExW
AddAce
GetSidLengthRequired
RegCreateKeyExA
RegQueryMultipleValuesW
GetSidSubAuthority
AreAnyAccessesGranted
AddAccessDeniedAce
RegEnumKeyExA
RegSetValueExA
RegSetValueW
RegQueryMultipleValuesA
GetSidIdentifierAuthority
SetTokenInformation
RegDeleteValueA
RegSetValueA
RegSetKeySecurity
CreateProcessAsUserW
OpenServiceA
CryptAcquireContextW
QueryServiceConfigW
DuplicateTokenEx
RegConnectRegistryW
RegDeleteKeyA
LsaFreeMemory
LookupAccountNameW
SetEntriesInAclW
GetSecurityDescriptorSacl
LsaClose
ImpersonateLoggedOnUser
DeregisterEventSource
RegCreateKeyW
GetLengthSid
AddAuditAccessAce
InitializeAcl
InitializeSecurityDescriptor
AddAccessAllowedAce
GetTokenInformation
AreAllAccessesGranted
SetKernelObjectSecurity
RegNotifyChangeKeyValue
GetKernelObjectSecurity
RegCreateKeyExW
RegQueryValueExA
GetSidSubAuthorityCount
GetCurrentHwProfileA
GetCurrentHwProfileW
shell32
SHChangeNotify
SHGetMalloc
SHGetSpecialFolderLocation
SHGetFolderPathW
SHBindToParent
SHGetDesktopFolder
SHFileOperationW
CommandLineToArgvW
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
SHBrowseForFolderW
SHGetFileInfoW
ole32
StgOpenStorageEx
CoCreateInstanceEx
ProgIDFromCLSID
ReadFmtUserTypeStg
HPALETTE_UserMarshal
HICON_UserMarshal
CoCreateInstance
HMENU_UserMarshal
OleRegEnumVerbs
HWND_UserUnmarshal
OleLoadFromStream
HWND_UserMarshal
OleCreateLinkToFile
oleaut32
SysFreeString
VariantChangeType
SysAllocStringByteLen
VariantClear
VariantInit
GetActiveObject
SysStringLen
SafeArrayCreate
SysAllocStringLen
VariantCopyInd
VariantChangeTypeEx
GetErrorInfo
SafeArrayGetUBound
VariantCopy
SysReAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetLBound
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 270KB - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ