Static task
static1
Behavioral task
behavioral1
Sample
a6b26bfb9b17ef01ef600dae7b2be798e658f7b850261eb755a6a01230e48dd2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a6b26bfb9b17ef01ef600dae7b2be798e658f7b850261eb755a6a01230e48dd2.exe
Resource
win10v2004-20221111-en
General
-
Target
a6b26bfb9b17ef01ef600dae7b2be798e658f7b850261eb755a6a01230e48dd2
-
Size
312KB
-
MD5
451bf11163b63fa960bbecbdd4fa0814
-
SHA1
15229cbfbc628cada306b06bb0792227e431789f
-
SHA256
a6b26bfb9b17ef01ef600dae7b2be798e658f7b850261eb755a6a01230e48dd2
-
SHA512
6b537058bc386fc02cb84400fa3b40c759222403a5bd52e5838bfa69877c626b32984c303f86fff5cf07ac454f82ff9d54b28f367105ccddf2aa0dff310f806d
-
SSDEEP
6144:686kObXKZavLRgdm5B96xA2BHOBO2o7wp2FG0JVShULY2ilc:dKK0vFim5jkH9Oc/Joas2ilc
Malware Config
Signatures
Files
-
a6b26bfb9b17ef01ef600dae7b2be798e658f7b850261eb755a6a01230e48dd2.exe windows x86
85799f3bc0dc7b42ad34750c298dad2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeGetTime
stlport_x5.5.2
??6?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?empty@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBE_NXZ
?append@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@ABV12@II@Z
?clear@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEXXZ
?push_back@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEXD@Z
?clear@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEXXZ
?push_back@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEX_W@Z
?put@?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV12@D@Z
??1?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@XZ
?_M_put_nowiden@?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEXPBD@Z
?_M_put_widen@?$basic_ostream@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QAEXPBD@Z
??0?$allocator@_W@stlp_std@@QAE@XZ
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@PB_WABV?$allocator@_W@1@@Z
??1?$allocator@_W@stlp_std@@QAE@XZ
?c_str@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QBEPB_WXZ
??1?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@XZ
??Y?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEAAV01@PB_W@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@PBDABV?$allocator@D@1@@Z
?width@ios_base@stlp_std@@QAE_J_J@Z
??0?$basic_ofstream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAE@PBDH@Z
?is_open@?$basic_ofstream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAE_NXZ
??_D?$basic_ofstream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEXXZ
?flush@?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV12@XZ
??6?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV01@H@Z
??6?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV01@I@Z
?close@?$basic_ofstream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEXXZ
?assign@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@PBD@Z
??0?$basic_stringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@H@Z
??6?$basic_ostream@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QAEAAV01@H@Z
??_D?$basic_stringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEXXZ
??Y?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@PBD@Z
?get_allocator@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBE?AV?$allocator@D@2@XZ
?size@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBEIXZ
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@U_String_reserve_t@priv@1@IABV?$allocator@D@1@@Z
?append@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@ABV01@@Z
??4?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@ABV01@@Z
?c_str@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBEPBDXZ
??0?$allocator@D@stlp_std@@QAE@XZ
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@ABV?$allocator@D@1@@Z
??1?$allocator@D@stlp_std@@QAE@XZ
??4?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@PBD@Z
??Y?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@D@Z
msvcr90
tolower
sscanf
memmove
strstr
strtoul
strchr
_iob
fopen
fread
strrchr
__CxxFrameHandler3
_findfirst32
_snprintf
strlen
_findclose
_findnext32
_access
printf
sprintf
memset
_time32
_localtime32_s
_vsnprintf
_purecall
memcpy
wcscmp
sprintf_s
strncpy
isxdigit
free
wcslen
atoi
fclose
fwrite
fopen_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
fseek
_strtoi64
strncmp
fgets
qsort
fputs
isdigit
strtol
fputc
_errno
isspace
memchr
fflush
getenv
strerror
_sys_nerr
isalnum
isalpha
_beginthreadex
_stat32i64
_gmtime32
_strdup
realloc
calloc
_mkdir
_stricmp
malloc
kernel32
WaitForSingleObject
CloseHandle
FormatMessageA
ExpandEnvironmentStringsA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetSystemDirectoryA
SetLastError
SleepEx
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
FreeLibrary
LoadLibraryA
GetCurrentProcess
SetPriorityClass
GetLastError
Sleep
CreateThread
GetStartupInfoA
user32
EndPaint
BeginPaint
DefWindowProcA
DestroyWindow
DialogBoxParamA
EndDialog
DispatchMessageW
TranslateMessage
PostQuitMessage
PeekMessageW
MessageBoxA
ShowWindow
UpdateWindow
RegisterClassExA
LoadCursorA
LoadIconA
GetMessageW
CreateWindowExA
gdi32
DeleteObject
vfsdllproj
?ShutdownVFS@VFS@@YAXXZ
?InitVFS@VFS@@YAHPBD@Z
ws2_32
recv
send
getsockname
ntohs
bind
htons
getsockopt
setsockopt
connect
socket
inet_addr
WSAGetLastError
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
__WSAFDIsSet
select
ioctlsocket
WSAStartup
WSACleanup
gethostbyname
closesocket
Sections
.text Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 143KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE