Static task
static1
Behavioral task
behavioral1
Sample
75827a1abd0a40051c0a92a6f998a5082843348c9711995e60009ef16ac9140e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
75827a1abd0a40051c0a92a6f998a5082843348c9711995e60009ef16ac9140e.exe
Resource
win10v2004-20221111-en
General
-
Target
75827a1abd0a40051c0a92a6f998a5082843348c9711995e60009ef16ac9140e
-
Size
1.0MB
-
MD5
68cb654564a20e6d88eb6dce33022f17
-
SHA1
849bd1c269b214c9003513994f1f7e2273c36873
-
SHA256
75827a1abd0a40051c0a92a6f998a5082843348c9711995e60009ef16ac9140e
-
SHA512
9fed1039856453c9da1f2836bd6fe9dd2ce3416ccc61c3ab34c83796510dad426181497f0c6268eb316d74a66eb125e532149e022cbd88be8531b55e4babf7ad
-
SSDEEP
12288:lp7n3XULWCkR1R0IAjzmUta4mJpcSgTBL:lpbC4R0IKzmARBL
Malware Config
Signatures
Files
-
75827a1abd0a40051c0a92a6f998a5082843348c9711995e60009ef16ac9140e.exe windows x86
abb4f7efd9b2a19667aff943f432feba
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
HeapAlloc
HeapSize
RtlUnwind
GetStringTypeW
Sleep
HeapFree
GetCurrentProcess
TerminateProcess
GetPrivateProfileIntW
CreateEventA
GetTimeFormatA
GetCPInfo
GetACP
ChangeTimerQueueTimer
GetSystemDirectoryA
GetVolumePathNameW
FlushInstructionCache
GetCPInfoExA
DefineDosDeviceA
GetPrivateProfileSectionW
GetFileType
GetOEMCP
GetCPInfoExW
MapViewOfFile
CreateDirectoryExA
MultiByteToWideChar
EnumCalendarInfoW
GetConsoleCP
GetCurrentDirectoryA
GetProfileStringW
FoldStringA
SetProcessAffinityMask
CreateNamedPipeW
SetConsoleCtrlHandler
FreeEnvironmentStringsA
SetVolumeMountPointA
GetDriveTypeW
GetTempPathA
DnsHostnameToComputerNameW
GetProfileIntA
VirtualQuery
GetPriorityClass
QueryInformationJobObject
CreateMailslotA
CreateToolhelp32Snapshot
SearchPathA
FindNextChangeNotification
FreeConsole
GetEnvironmentStrings
GetBinaryTypeA
VirtualAlloc
SetHandleInformation
GetProfileStringA
ExpandEnvironmentStringsA
MapUserPhysicalPagesScatter
ReplaceFileA
GetNumberFormatW
CreateJobObjectA
GetCalendarInfoA
GetSystemDirectoryW
CreateNamedPipeA
PostQueuedCompletionStatus
GetNamedPipeInfo
LCMapStringW
GetConsoleAliasesW
IsValidCodePage
GetCommandLineA
HeapSetInformation
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
user32
EnableWindow
SetPropA
GetDlgCtrlID
UnhookWindowsHookEx
DestroyAcceleratorTable
InsertMenuItemW
SetScrollPos
GetAsyncKeyState
GetAltTabInfoA
advapi32
FreeSid
InitializeAcl
AddAccessDeniedAce
GetSecurityDescriptorControl
RegisterEventSourceW
GetSidSubAuthorityCount
SetNamedSecurityInfoW
GetCurrentHwProfileA
RegEnumKeyW
SetSecurityDescriptorOwner
RegQueryMultipleValuesW
SetThreadToken
RegEnumKeyExW
RegDeleteValueA
AddAuditAccessAce
SetTokenInformation
CryptHashData
CryptAcquireContextW
RegDeleteKeyA
GetUserNameW
StartServiceW
CryptAcquireContextA
CryptDestroyHash
RegSetValueA
RegQueryValueExA
AddAccessAllowedAce
RegOpenKeyA
LsaClose
SetSecurityDescriptorGroup
ControlService
GetSecurityDescriptorLength
RegQueryInfoKeyW
OpenServiceA
LsaOpenPolicy
CryptReleaseContext
CloseServiceHandle
ImpersonateLoggedOnUser
CryptDestroyKey
OpenProcessToken
IsValidSid
InitializeSecurityDescriptor
CopySid
CreateWellKnownSid
QueryServiceConfigW
AllocateAndInitializeSid
RegCreateKeyExW
RegNotifyChangeKeyValue
GetSidIdentifierAuthority
GetSidLengthRequired
SetKernelObjectSecurity
RegSetValueW
RegSetKeySecurity
AreAllAccessesGranted
GetSidSubAuthority
RegQueryMultipleValuesA
AreAnyAccessesGranted
GetTokenInformation
RegSetValueExA
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 15KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CODE Size: 883KB - Virtual size: 882KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.BSS Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ