Static task
static1
Behavioral task
behavioral1
Sample
bca7ab08801211335453e264ecdb717d6694522080967af4f24c0840356ff395.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bca7ab08801211335453e264ecdb717d6694522080967af4f24c0840356ff395.exe
Resource
win10v2004-20220812-en
General
-
Target
bca7ab08801211335453e264ecdb717d6694522080967af4f24c0840356ff395
-
Size
454KB
-
MD5
c065ff8f0eb20da758eb0e4189cf7e16
-
SHA1
33be69a20cb8a84100946a6678d1d578b0f5decd
-
SHA256
bca7ab08801211335453e264ecdb717d6694522080967af4f24c0840356ff395
-
SHA512
197445335061a1d19f9259a24980b6d02f90591bf9ff102e9e563b3d4c402919a5252ae6df54d9553f90aacefdcbc38dd998c986cae2d3939c1a401f28cea3f2
-
SSDEEP
12288:6R2oQVhX3UnWp0wfVjZbAScbH44uRhObnmqZP8:zoQVhX3Uw0wfVjZbAS0H44yObnw
Malware Config
Signatures
Files
-
bca7ab08801211335453e264ecdb717d6694522080967af4f24c0840356ff395.exe windows x86
fe5a66ed30052a1f05cf5f25509f0649
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
RaiseException
CloseHandle
WaitForSingleObject
CreateSemaphoreW
ReleaseSemaphore
GetCommandLineW
DeleteFileW
TlsGetValue
TlsFree
DecodePointer
EncodePointer
GetLastError
TlsAlloc
Sleep
GetLocaleInfoW
FoldStringW
GetCurrentThreadId
GetProcAddress
LoadLibraryW
LoadLibraryExW
GetSystemDirectoryW
LocalFree
FormatMessageA
LoadLibraryA
FreeLibrary
GetModuleHandleW
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LocalAlloc
oleaut32
SysAllocString
RegisterActiveObject
LoadTypeLi
LoadRegTypeLi
RevokeActiveObject
user32
MessageBoxA
IsIconic
ShowWindow
SetWindowPos
DestroyWindow
IsZoomed
SetWindowPlacement
GetWindowPlacement
GetParent
UpdateWindow
LoadImageW
GetSystemMetrics
LoadIconW
PostMessageW
SetForegroundWindow
IsWindow
MapVirtualKeyW
msocf
?CreateTheApp@Frame@MsoCF@@YGXAAUCreateTheAppArgs@12@@Z
?TheApp@Frame@MsoCF@@YGPAUAFrameApp@2@XZ
??0CToolbarData@MsoCF@@QAE@XZ
?Init@CToolbarData@MsoCF@@QAGXPBUStaticToolbarDesc@2@IPBUStaticMenuDesc@2@I@Z
?TerminateTheApp@Frame@MsoCF@@YGXXZ
?Finish@Frame@MsoCF@@YGXXZ
?Finish@Utilities@MsoCF@@YGXXZ
?g_FixedBufferAllocator@MsoCF@@3VCFixedBufferAllocator@1@A
?g_FastBufferAllocator@MsoCF@@3VCFastBufferAllocator@1@A
?SetWzFromNumber@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@IHHPAH@Z
??1CToolbarData@MsoCF@@QAE@XZ
?AppendArrayOfCharactersToWz@Strings@MsoCF@@YGXPB_WHAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAH@Z
?SetWzFromResource@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IPAH@Z
?CreateActionManager@MsoCF@@YGXPAPAUIActionManager@1@@Z
?SetWtzFromPattern@Strings@MsoCF@@YGXAAV?$CWtzInBuffer_Template@V?$CBuffer@_W@MsoCF@@@2@PAUHINSTANCE__@@IQAPB_WH@Z
?SetWzFromPattern@Strings@MsoCF@@YGXAAV?$CWzInBuffer_T@V?$String@UWzTraits@MsoCF@@@MsoCF@@V?$CBuffer@_W@2@@2@PAUHINSTANCE__@@IQAPB_WHPAH@Z
?Free@Allocator@Memory@MsoCF@@YGXPAX@Z
?Start@Utilities@MsoCF@@YGXHPAU_msotcfcf@@@Z
?Start@Frame@MsoCF@@YGXXZ
?TheActionManager@MsoCF@@YGPAUIActionManager@1@XZ
?LookupProperty@MsoCF@@YGABUPropertyInfo@1@I@Z
?Set@Properties@MsoCF@@YGXPAUIPropertySet@2@ABUPropertyInfo@2@PBXW4PropertyType@2@@Z
oisapp
?CdlWorkPaneCallback@OISAppApi@@YGHHHPAX00@Z
?RFMDisableApp@COISApp@@QAEXXZ
?CdlDoEvent@OISAppApi@@YG_NAAUtagMSG@@@Z
?FDoShutdown@OISAppApi@@YG_NXZ
?DoBrowseMode@COISApp@@SGXABV?$TArray@VCVarStr@Ofc@@@Ofc@@@Z
?DoUploadMode@COISApp@@QAEXABV?$TArray@VCVarStr@Ofc@@@Ofc@@@Z
?DoDownloadMode@COISApp@@QAEXAAUDownloadSettings@@@Z
?DoSendToMode@COISApp@@QAEXABUDownloadSettings@@@Z
?DoEditMode@COISApp@@QAEXABV?$TArray@VCVarStr@Ofc@@@Ofc@@_N@Z
?GetOISSelectionContext@OISAppApi@@YGXPAPAUIActionContext@MsoCF@@@Z
?InitInstance@OISAppApi@@YGXPAUMSOINST@@PAUHINSTANCE__@@ABVCThreadLocalStorage@Ofc@@@Z
?SetFrameHwnd@OISAppApi@@YGXPAUHWND__@@@Z
?SetContextMenuCallback@OISAppApi@@YGXP6GXHABUtagPOINT@@H@Z@Z
?SetShowToolbar@OISAppApi@@YGXP6GXH@Z@Z
?OnSetFocus@OISAppApi@@YGXXZ
?CreateMediaWindow@OISAppApi@@YGPAUHWND__@@PAU2@@Z
?ExitInstance@OISAppApi@@YGXXZ
?Singleton@CAppOA@@SGPAV1@XZ
?GetRootCollection@CAppOA@@SGXPAPB_W@Z
?CdlDoIdle@OISAppApi@@YGXXZ
?GetCDLContext@OISAppApi@@YGPAUICdlContext@Cdl@@XZ
?GetApp@OISAppApi@@YGPAVCOISApp@@XZ
?DgRedEyePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgRotatePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgRenamePaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@_N@Z
?DgHueSatPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgBrightContrastPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgCropPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgFileFormatOptDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgResizeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@_N@Z
?DgEditHomeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgNavigationPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgPublishDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgUploadDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgEditModeButtonBar@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgUploadModeButtonBar@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgCompressPicsDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgLocatePicturesDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgHomeDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgEmailDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DgPropertiesPaneDialog@OISAppApi@@YGPAVDLDialog@Cdl@@AAUICdlContext@3@@Z
?DoNormalMode@COISApp@@SGXXZ
msvcr90
_cexit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
memset
_CxxThrowException
wcsncpy_s
memcpy
vswprintf_s
_vscwprintf
memmove
_amsg_exit
__getmainargs
__CxxFrameHandler3
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
Sections
.text Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 192KB - Virtual size: 1.3MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE