Static task
static1
Behavioral task
behavioral1
Sample
8f8508ef9dc6c9269a72cf4a89334355a291a4bb5a702390bfebd989682d49c8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8f8508ef9dc6c9269a72cf4a89334355a291a4bb5a702390bfebd989682d49c8.exe
Resource
win10v2004-20220812-en
General
-
Target
8f8508ef9dc6c9269a72cf4a89334355a291a4bb5a702390bfebd989682d49c8
-
Size
52KB
-
MD5
a06e324da7564c047412ba80571ee07f
-
SHA1
dc11b95945d76320417708082327a43c590ebb20
-
SHA256
8f8508ef9dc6c9269a72cf4a89334355a291a4bb5a702390bfebd989682d49c8
-
SHA512
2b7645d63d1ec0ca340e4d74e3ae817e55733fc48fe424e04f935dd533905289b471face5c807378e5415f6abd943141abd332f02991861e8ed526db5505dfb0
-
SSDEEP
1536:bcReNy2coBL3AuTRYeAWHCc0tpzqc/S5BjAVqMJLL:osgQL3AuTRYe2cGp2EAOL
Malware Config
Signatures
Files
-
8f8508ef9dc6c9269a72cf4a89334355a291a4bb5a702390bfebd989682d49c8.exe windows x86
e1161c8e992e13742be36ab403f3d61e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlAdjustPrivilege
strstr
memset
kernel32
SetFilePointer
VirtualFree
ExpandEnvironmentStringsA
WriteFile
Sleep
CreateProcessA
ReadFile
CreateFileA
GetLastError
VirtualAlloc
CopyFileA
GetTempFileNameA
ExitProcess
GetModuleFileNameA
GetModuleHandleA
CloseHandle
DeleteFileA
FlushFileBuffers
MoveFileA
shlwapi
PathFindFileNameA
advapi32
ControlService
OpenSCManagerA
StartServiceA
OpenServiceA
winspool.drv
AddPrintProcessorA
DeletePrintProcessorA
GetPrintProcessorDirectoryA
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 298B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ