Behavioral task
behavioral1
Sample
7ff5b26e812b8492b1f88dedb77ba88d6b1d926761c4def10e6ad19782aa22ae.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7ff5b26e812b8492b1f88dedb77ba88d6b1d926761c4def10e6ad19782aa22ae.exe
Resource
win10v2004-20220812-en
General
-
Target
7ff5b26e812b8492b1f88dedb77ba88d6b1d926761c4def10e6ad19782aa22ae
-
Size
220KB
-
MD5
91d227651553a2d4c251886eda3cda22
-
SHA1
789ba98da27a459546227650efe1627754554487
-
SHA256
7ff5b26e812b8492b1f88dedb77ba88d6b1d926761c4def10e6ad19782aa22ae
-
SHA512
b0b92af00cce89036eadcab720a96fd062e2e7cd08f68eafc9aa58dfa4501540bd9045051f352d1440769ba54d87201e3903d4ced9a7e1fe6b45f464acb0addd
-
SSDEEP
6144:dY8mjCMLSWBHxDOwJQIvlKZPJSZhKIyi2:nmlS6hJQ1f7Bi2
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
7ff5b26e812b8492b1f88dedb77ba88d6b1d926761c4def10e6ad19782aa22ae.exe windows x86
4d59a86b1a0111af365c4556cf62d8ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
WideCharToMultiByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcpynA
IsDBCSLeadByte
InitializeCriticalSection
lstrcpyA
lstrcatA
LoadLibraryA
WaitForMultipleObjects
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetConsoleCtrlHandler
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
GetProcAddress
FreeLibrary
GetLastError
CreateEventA
WaitForSingleObject
CreateThread
CloseHandle
GetVersionExA
CompareFileTime
InterlockedDecrement
Sleep
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
HeapSize
GetCurrentProcess
TerminateProcess
RaiseException
ExitProcess
GetVersion
GetStartupInfoA
HeapReAlloc
LocalFree
RtlUnwind
HeapFree
HeapAlloc
user32
KillTimer
EnumDisplaySettingsA
PostMessageA
PostThreadMessageA
CharNextA
RegisterClassA
CreateWindowExA
ChangeDisplaySettingsExA
DispatchMessageA
SetTimer
PostQuitMessage
RegisterWindowMessageA
DefWindowProcA
GetMessageA
FindWindowA
SendNotifyMessageA
ChangeDisplaySettingsA
advapi32
RegEnumValueA
RegQueryInfoKeyA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
ole32
CoTaskMemFree
CoCreateInstance
CoSuspendClassObjects
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
oleaut32
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocString
SysFreeString
VariantClear
CreateErrorInfo
VariantChangeType
SetErrorInfo
GetErrorInfo
VariantInit
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE