Static task
static1
Behavioral task
behavioral1
Sample
9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
Resource
win10v2004-20221111-en
General
-
Target
9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740
-
Size
276KB
-
MD5
410b46097e1eed5ea26e26e39266f3f0
-
SHA1
905eb502653c0d08d92417336e6b88466901d20e
-
SHA256
9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740
-
SHA512
d9d28c8660b1d5ca8246c70d1a2656200ab019f504c85cb276d838c51d8362ba1a10990c9150194bc71f7f08b18cc5aac25f3f78a1aa3f2a15472b64311107d3
-
SSDEEP
6144:K/1HnOBywO+PnbfMIQFSQMX0Wy6XtdFCGJvi5w:KNQuU1XXdyvGJo
Malware Config
Signatures
Files
-
9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe windows x86
913e409d02f20275af7ee12984334a9c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoRevertToSelf
CoGetInterfaceAndReleaseStream
CoQueryProxyBlanket
CoCreateGuid
CoSetProxyBlanket
CoCreateInstance
StringFromGUID2
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoImpersonateClient
kernel32
RaiseException
GetACP
HeapAlloc
EnterCriticalSection
ResetEvent
CreateEventW
FindVolumeMountPointClose
HeapReAlloc
LeaveCriticalSection
CloseHandle
FindFirstVolumeMountPointW
FormatMessageW
HeapDestroy
GetDriveTypeW
SetUnhandledExceptionFilter
FindNextVolumeMountPointW
DeleteCriticalSection
CreateThread
GetVolumeNameForVolumeMountPointW
WaitForSingleObject
IsDebuggerPresent
HeapFree
GetSystemTime
lstrlenW
GetLogicalDriveStringsW
ResumeThread
HeapSize
GetThreadLocale
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetProcessHeap
GetCurrentThreadId
SetThreadLocale
TerminateThread
GetStartupInfoW
VirtualAlloc
oleaut32
SafeArrayRedim
SysStringByteLen
SafeArrayGetUBound
SafeArrayDestroy
SysStringLen
VariantCopy
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayGetVartype
VariantClear
SafeArrayLock
VarBstrCmp
VariantCopyInd
SysAllocString
SafeArrayUnlock
SysFreeString
SystemTimeToVariantTime
SafeArrayCopy
SafeArrayCreate
LoadTypeLi
VariantInit
SafeArrayGetLBound
SysAllocStringByteLen
LoadRegTypeLi
advapi32
OpenProcessToken
GetTokenInformation
IsValidSid
CopySid
SetThreadToken
GetLengthSid
EqualSid
RegSetValueExW
OpenThreadToken
RegOpenKeyExW
RegCloseKey
user32
UnregisterClassA
wsprintfW
userenv
UnloadUserProfile
esent
JetCreateTable
JetGetLogInfoInstance2
JetOpenDatabase
JetStopService
JetInit
JetGetCurrentIndex
JetDupCursor
JetDBUtilities
JetAttachDatabase
JetCreateDatabase2
JetResetTableSequential
JetFreeBuffer
JetCommitTransaction
JetTerm2
jscript
DllRegisterServer
DllCanUnloadNow
DllGetClassObject
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 245KB - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 13KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ