Static task
static1
Behavioral task
behavioral1
Sample
6978fe4455ead55e477feb2fc5f89f26c856490bb48c281cfd3688f6bb4d49b7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6978fe4455ead55e477feb2fc5f89f26c856490bb48c281cfd3688f6bb4d49b7.exe
Resource
win10v2004-20220812-en
General
-
Target
6978fe4455ead55e477feb2fc5f89f26c856490bb48c281cfd3688f6bb4d49b7
-
Size
903KB
-
MD5
43fe56bd883cd2c7e6b3df65e2e23a13
-
SHA1
86f2643ffe8c051e4e0b5ad37ed433512c09c59b
-
SHA256
6978fe4455ead55e477feb2fc5f89f26c856490bb48c281cfd3688f6bb4d49b7
-
SHA512
3d9c383c623c8ad53a5f6ac1840c2a3f0a7610b0d2024060692978d5bd608b2368484a3f2ec1ff8c576ac9228b2d06fc2a7c261d453618f282c96a4bbe9252ef
-
SSDEEP
12288:CG/oHZId8zgYzkTC25RpKnnKUxE/EgnL3ZX9fnKiW9FdUVyFKwaB:CGNicYzk+7vxE/NXnlW9oVcG
Malware Config
Signatures
Files
-
6978fe4455ead55e477feb2fc5f89f26c856490bb48c281cfd3688f6bb4d49b7.exe windows x86
0686b803c1c4f0a884a06153cbf2902d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
wcscpy
wcscat
wcscmp
iswspace
memmove
_ftol
_beginthreadex
_CxxThrowException
_wcsicmp
_wfindfirst
_findclose
_purecall
wcslen
__CxxFrameHandler
realloc
free
malloc
_snwprintf
_wtol
wcschr
wcsstr
_strdup
sprintf
strncpy
_controlfp
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
wcsncpy
swprintf
_wcsnicmp
wcsncat
wcsrchr
swscanf
_wtoi
_wcsdup
wcsncmp
_vsnwprintf
advapi32
RegEnumKeyExW
AddAuditAccessObjectAce
AddAccessDeniedObjectAce
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDeriveKey
AddAccessAllowedObjectAce
AddAuditAccessAceEx
CryptEncrypt
CryptDecrypt
CryptDestroyHash
DeregisterEventSource
RegOpenKeyExA
RegQueryValueExA
CryptGenRandom
QueryServiceStatus
StartServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
CryptDestroyKey
CryptReleaseContext
ConvertSidToStringSidW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
InitializeAcl
InitializeSecurityDescriptor
RegQueryValueExW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorDacl
GetAce
GetLengthSid
GetAclInformation
IsValidAcl
EqualSid
RegConnectRegistryW
RegEnumKeyW
OpenProcessToken
AddAce
SetThreadToken
CopySid
GetTokenInformation
OpenThreadToken
AddAccessAllowedAceEx
AddAccessDeniedAceEx
kernel32
InitializeCriticalSection
DeleteCriticalSection
lstrcmpiW
LoadLibraryW
lstrcpynW
HeapDestroy
lstrcatW
GetModuleFileNameW
FreeLibrary
InterlockedIncrement
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
GetShortPathNameW
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
GetSystemDirectoryW
GetSystemWindowsDirectoryW
GetLocaleInfoW
GetUserDefaultUILanguage
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InterlockedExchange
Sleep
WaitForMultipleObjects
SetEvent
CloseHandle
CreateEventW
WaitForSingleObject
GetCurrentThread
SetEnvironmentVariableW
GetTempPathW
GetEnvironmentVariableW
GetSystemTime
GetLocalTime
QueryPerformanceFrequency
GlobalMemoryStatusEx
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GetCommandLineW
GetFileAttributesExW
LeaveCriticalSection
GetTimeZoneInformation
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempFileNameW
WideCharToMultiByte
LocalFree
DuplicateHandle
ReadFile
WriteFile
SetFilePointer
GetFileInformationByHandle
CreateFileW
CopyFileW
SetFileAttributesW
DeleteFileW
MoveFileExW
RemoveDirectoryW
GlobalFree
GetModuleHandleA
GetStartupInfoW
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
VirtualFree
VirtualAlloc
EnterCriticalSection
lstrcpyW
lstrlenW
MultiByteToWideChar
lstrcmpiA
SetLastError
GetVersionExW
GetModuleHandleW
GetSystemDefaultLCID
FindNextChangeNotification
lstrcmpW
LocalAlloc
RaiseException
ReleaseMutex
FlushViewOfFile
UnmapViewOfFile
OpenMutexW
CreateMutexW
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
ResetEvent
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
HeapReAlloc
FindFirstChangeNotificationW
FindCloseChangeNotification
TlsSetValue
TlsFree
TlsAlloc
ExitProcess
GlobalReAlloc
GetUserDefaultLCID
SetThreadPriority
FlushFileBuffers
GetProcAddress
TlsGetValue
gdi32
CreateDIBSection
CreateSolidBrush
CreateCompatibleBitmap
SelectObject
BitBlt
GetStockObject
GetObjectW
CreateCompatibleDC
DeleteObject
CreateRectRgnIndirect
CreateDCW
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
SetLayout
user32
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
PtInRect
GetParent
RegisterClassExW
wsprintfW
LoadCursorW
GetClassInfoExW
CreateWindowExW
MessageBoxW
IntersectRect
GetKeyboardState
EndPaint
GetClientRect
BeginPaint
GetClassNameW
SendMessageTimeoutW
RegisterWindowMessageW
EnumChildWindows
GetWindowRect
SendMessageW
MoveWindow
CharUpperW
IsWindowVisible
DestroyMenu
TrackPopupMenu
MapWindowPoints
DestroyWindow
SetKeyboardState
DefWindowProcW
GetWindowLongW
CallWindowProcW
ShowWindow
IsWindow
AppendMenuW
CreatePopupMenu
InsertMenuItemW
LoadStringW
GetSystemMetrics
MsgWaitForMultipleObjects
DispatchMessageW
GetKeyState
DestroyAcceleratorTable
InvalidateRect
SetFocus
IsChild
GetFocus
GetDC
ReleaseDC
CharNextW
GetMenuItemCount
GetSystemMenu
SystemParametersInfoW
EnumDisplaySettingsW
SystemParametersInfoA
CharUpperBuffW
CharLowerW
SetWindowTextW
LoadIconW
LoadImageW
SetForegroundWindow
IsIconic
PostMessageW
GetSysColor
GetProcessDefaultLayout
GetCursorPos
GetWindow
GetWindowTextW
GetWindowTextLengthW
ReleaseCapture
SetCapture
InvalidateRgn
GetDesktopWindow
GetDlgItem
FillRect
RedrawWindow
CreateAcceleratorTableW
TranslateMessage
SetWindowLongW
CopyImage
PeekMessageW
comctl32
ImageList_Create
ImageList_DrawIndirect
InitCommonControlsEx
ImageList_LoadImageW
ImageList_Destroy
ImageList_GetImageCount
ImageList_AddMasked
uxtheme
IsThemeActive
GetThemeDocumentationProperty
GetCurrentThemeName
urlmon
URLOpenBlockingStreamW
RegisterBindStatusCallback
CreateURLMoniker
ReleaseBindInfo
CopyBindInfo
CoInternetQueryInfo
CoInternetGetSession
wininet
InternetCloseHandle
InternetCanonicalizeUrlW
InternetSetOptionW
InternetQueryOptionW
InternetSetOptionA
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetGetConnectedState
InternetSetStatusCallbackW
CommitUrlCacheEntryW
DeleteUrlCacheEntryW
CreateUrlCacheEntryW
InternetCombineUrlW
InternetCrackUrlW
InternetAutodial
InternetAutodialHangup
ole32
CLSIDFromProgID
OleLockRunning
OleUninitialize
OleInitialize
StringFromCLSID
CLSIDFromString
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
StgOpenStorageEx
StgCreateStorageEx
GetRunningObjectTable
CreateClassMoniker
CoTaskMemAlloc
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
OleLoadFromStream
WriteClassStm
OleSaveToStream
CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance
CoInitializeEx
CreateStreamOnHGlobal
CoGetCallContext
GetHGlobalFromStream
CoGetClassObject
CreateBindCtx
oleaut32
OleCreateFontIndirect
DispCallFunc
VariantInit
VariantTimeToSystemTime
VariantChangeTypeEx
SafeArrayCreateVector
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SystemTimeToVariantTime
VariantCopy
OleCreatePropertyFrame
SysStringLen
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
SysAllocString
SysFreeString
shlwapi
UrlGetPartW
UrlCombineW
StrStrIW
PathIsRelativeW
shell32
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
ShellExecuteExW
msimg32
GradientFill
Sections
.text Size: 565KB - Virtual size: 565KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 33KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ