Static task
static1
Behavioral task
behavioral1
Sample
6613e6ed78f24b2334296b3d62bc71c3328af36ca828ad5e0fd1ed7d99f7c2c4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6613e6ed78f24b2334296b3d62bc71c3328af36ca828ad5e0fd1ed7d99f7c2c4.exe
Resource
win10v2004-20221111-en
General
-
Target
6613e6ed78f24b2334296b3d62bc71c3328af36ca828ad5e0fd1ed7d99f7c2c4
-
Size
293KB
-
MD5
6a2a277d4dbd058939f8478fd4177a01
-
SHA1
0288099a9fe5fda31265af15688fdffac5e88066
-
SHA256
6613e6ed78f24b2334296b3d62bc71c3328af36ca828ad5e0fd1ed7d99f7c2c4
-
SHA512
26162cd33933b20061538923869d2fcf58a073816994c5926e5a57177b74394771bb3e29cb2f4602d6d3357ea3f1d232c8d26780a2acec67f6ab835d42adb205
-
SSDEEP
6144:DYgNYWnEXoOkylyCzFUAye6zNrLbv5BVuoqzUIkSlX4V8:DYgNYANO7lysuBzv5BTqzN4V8
Malware Config
Signatures
Files
-
6613e6ed78f24b2334296b3d62bc71c3328af36ca828ad5e0fd1ed7d99f7c2c4.exe windows x86
40785ddb28c45d2a1ae79fb70f2d2db7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetCommandLineA
HeapDestroy
WriteConsoleA
SuspendThread
CloseHandle
HeapCreate
GetCommandLineA
lstrlenW
CreateSemaphoreA
GetModuleHandleA
EnumResourceTypesW
DeleteFileA
CloseHandle
OpenEventA
SetLastError
FindVolumeClose
FileTimeToSystemTime
GetEnvironmentVariableA
GetStartupInfoA
advapi32
IsValidAcl
IsValidSid
CreateServiceW
RegCreateKeyExW
RegEnumKeyA
CloseEventLog
IsValidSid
IsValidSid
IsValidSid
RegDeleteValueA
InitializeSid
ControlService
IsValidSid
ddrawex
DllRegisterServer
DllRegisterServer
DllRegisterServer
DllRegisterServer
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 287KB - Virtual size: 286KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ