Behavioral task
behavioral1
Sample
6a09fba1c786451e92e215a529c95513836d0bc64e15ed1ee463afa8bbcd3984.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6a09fba1c786451e92e215a529c95513836d0bc64e15ed1ee463afa8bbcd3984.exe
Resource
win10v2004-20220812-en
General
-
Target
6a09fba1c786451e92e215a529c95513836d0bc64e15ed1ee463afa8bbcd3984
-
Size
952KB
-
MD5
0b1e7fc75fa4b4204b73ac076dae5057
-
SHA1
40735575df013b4b08cd977b2b3434e75ad4e399
-
SHA256
6a09fba1c786451e92e215a529c95513836d0bc64e15ed1ee463afa8bbcd3984
-
SHA512
c66c46dfd2dc380f73682ca6049c7e2c117050efb8ffbe352050ece7c3598da83ad1c4077f179218e82e640e9eb544d8f8bf0ae56e19b34620e3113c51ed02ad
-
SSDEEP
24576:fGYiJh0lNU5NYR2VuK9R1plaBcTYK5aXO5:fGY2h0lNaNYAVv9HGO/8XO
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
6a09fba1c786451e92e215a529c95513836d0bc64e15ed1ee463afa8bbcd3984.exe windows x86
0e494a1507adac9022a7a40c5bb6986f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedIncrement
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
lstrlenW
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
SetCurrentDirectoryA
GetTickCount
ResetEvent
MapViewOfFileEx
OpenFileMappingA
CreateFileMappingA
UnmapViewOfFile
GetModuleFileNameA
ReadProcessMemory
GetThreadSelectorEntry
GetLastError
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateEventA
CreateThread
WaitForSingleObject
GetCurrentProcessId
GetProcAddress
FreeLibrary
VirtualQueryEx
GetCurrentProcess
GetCurrentThread
CreateFileA
ReadFile
SetFilePointer
VirtualQuery
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue
DeleteFileA
WritePrivateProfileStringA
SetErrorMode
SetUnhandledExceptionFilter
OpenProcess
Sleep
TerminateProcess
CloseHandle
InterlockedDecrement
GetStartupInfoA
SetEvent
user32
CharNextA
PostThreadMessageA
DispatchMessageA
GetMessageA
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
ole32
CoRevokeClassObject
StringFromCLSID
CoRegisterClassObject
CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
oleaut32
SafeArrayUnaccessData
SysFreeString
LoadRegTypeLi
SafeArrayAccessData
SysStringLen
ws2_32
closesocket
htons
WSACleanup
recv
WSAGetLastError
__WSAFDIsSet
inet_ntoa
accept
listen
getpeername
ntohs
bind
socket
inet_addr
WSAStartup
gethostbyname
gethostname
htonl
ntohl
select
ioctlsocket
setsockopt
sendto
recvfrom
connect
send
msvcp60
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??0Init@ios_base@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1Init@ios_base@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
msvcrt
memset
strlen
strrchr
__CxxFrameHandler
strncat
memcpy
_purecall
??2@YAPAXI@Z
memcmp
_CxxThrowException
strncpy
_beginthreadex
fclose
fwrite
fopen
fread
isdigit
_mbsnbcpy
_mbsrchr
_snprintf
_mbsnbcat
strftime
localtime
time
printf
fputc
_iob
srand
rand
strstr
atoi
memmove
_ftol
_mbslwr
calloc
free
_except_handler3
fgetc
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strlwr
strcmp
wcstombs
imagehlp
StackWalk
SymGetModuleInfo
SymLoadModule
SymInitialize
SymSetOptions
SymFunctionTableAccess
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
iphlpapi
GetIfEntry
GetAdaptersInfo
wininet
InternetGetConnectedState
Sections
.text Size: 612KB - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE