Behavioral task
behavioral1
Sample
aefd6973c089beb057a1444a15563bbc2a9eaaedb42c402d00188f2b85be2b6f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
aefd6973c089beb057a1444a15563bbc2a9eaaedb42c402d00188f2b85be2b6f.exe
Resource
win10v2004-20220812-en
General
-
Target
aefd6973c089beb057a1444a15563bbc2a9eaaedb42c402d00188f2b85be2b6f
-
Size
868KB
-
MD5
603b2d2d9b85b9d58c3614018b47abe8
-
SHA1
1aec4d355c23a5aed45911e02459067ec4e62757
-
SHA256
aefd6973c089beb057a1444a15563bbc2a9eaaedb42c402d00188f2b85be2b6f
-
SHA512
7782ce044b6176103449cfa52892980bedbf5cfc235319d3ecc408778d54370e3f7dada900b3a144fffcc625f75cd89a6695a714bb1d4e7362df29b5f29e9cd7
-
SSDEEP
24576:uGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVMMMY2:RMMHMMMvMMZMMMlmMMMiMMMYJMMHMMMN
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
aefd6973c089beb057a1444a15563bbc2a9eaaedb42c402d00188f2b85be2b6f.exe windows x86
cf48faf31fedc857a9cc3c55b1a8bce0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
EventWrite
GetTraceEnableFlags
RegQueryValueExW
EventUnregister
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
RegOpenKeyExW
EventRegister
GetTraceEnableLevel
RegCloseKey
RegisterTraceGuidsW
kernel32
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
TerminateProcess
CreateFileW
lstrlenW
VerifyVersionInfoW
GetLastError
GetProcAddress
LocalAlloc
IsWow64Process
HeapSetInformation
GetFileTime
DeleteCriticalSection
CloseHandle
GetWindowsDirectoryW
LocalFree
ExpandEnvironmentStringsW
LoadLibraryW
InitializeCriticalSection
GetModuleHandleW
GetCurrentProcess
VerSetConditionMask
SetDllDirectoryW
CreateProcessW
SetErrorMode
RaiseException
LoadLibraryA
GetSystemDefaultLCID
GetUserDefaultLCID
EnterCriticalSection
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetVersionExA
FreeLibrary
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
GetCurrentDirectoryW
GetCommandLineW
user32
IsWindowEnabled
LoadStringW
CharNextW
GetWindowThreadProcessId
AllowSetForegroundWindow
SendMessageTimeoutW
FindWindowExW
MessageBoxW
IsWindowVisible
msvcrt
??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
iswalpha
_onexit
_lock
__dllonexit
_unlock
_controlfp
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
wcsncmp
iswspace
_vsnwprintf
memset
shlwapi
ord154
SHGetValueW
SHRegGetValueW
SHSetValueW
UrlApplySchemeW
PathIsURLW
ord158
PathFindFileNameW
UrlCreateFromPathW
StrStrW
UrlCanonicalizeW
shell32
CommandLineToArgvW
ole32
CoUninitialize
CoInitialize
urlmon
ord410
ord111
iertutil
ord42
ord32
ord44
ord325
ord9
ord31
ord163
ord650
ord58
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 693KB - Virtual size: 693KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE