?GetNormalizedPathImpl@detail@@YGHABU?$AvgMutableStringRefBase@_W$0A@@@PB_WIPAVIPathTreeTableRoot@1@_N33@Z
Static task
static1
Behavioral task
behavioral1
Sample
0c3e498f3e1d1b49b52c502c31dae70c17dde8b6fec90ee42efc0f7a64950ad1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0c3e498f3e1d1b49b52c502c31dae70c17dde8b6fec90ee42efc0f7a64950ad1.exe
Resource
win10v2004-20221111-en
General
-
Target
0c3e498f3e1d1b49b52c502c31dae70c17dde8b6fec90ee42efc0f7a64950ad1
-
Size
580KB
-
MD5
682156f2f3a3decd18d9369a1d1f4c85
-
SHA1
f62cef3099c250a9e1a8e6b4c4a237389880d013
-
SHA256
0c3e498f3e1d1b49b52c502c31dae70c17dde8b6fec90ee42efc0f7a64950ad1
-
SHA512
46f78b3ecbe17f70c71c84668fd28de5d81b25406597072512bc6a5d7d12069f35f66d50ae52246ab9917a3dfb89ccc4c65bae0b52b52eb29856cd6fea091372
-
SSDEEP
12288:Tsaz4j0SdL3cKQDRI/q4LFPMdV4FgDRChV9BXK9JF5:Tsoe0SdrcKkRyJkdV4KDREvB69L5
Malware Config
Signatures
Files
-
0c3e498f3e1d1b49b52c502c31dae70c17dde8b6fec90ee42efc0f7a64950ad1.exe windows x86
67342f115ea01661ee8a7854e7caa159
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlCreateUnicodeString
ZwFsControlFile
ZwReadFile
RtlInitUnicodeString
ZwCreateNamedPipeFile
ZwSetInformationFile
RtlFreeUnicodeString
ZwSetInformationThread
ZwFlushBuffersFile
ZwOpenFile
ZwWriteFile
ZwCancelIoFile
ZwSetEvent
ZwWaitForSingleObject
ZwCreateEvent
RtlAllocateHeap
RtlReAllocateHeap
RtlFreeHeap
ZwClose
RtlNtStatusToDosError
_allmul
memset
_aulldiv
memcpy
_chkstk
memmove
avgsysx
?GetFullPath@AvgBasPath@@YGHAAU_AVG_UTF16CHAR_STR@@PB_WIPAI@Z
?GetTempDirPath@AvgBasPath@@YGHAAU_AVG_UTF16CHAR_STR@@PAI@Z
?GetDirectoryPathFromFilenamePath@AvgBasPath@@YGHAAU_AVG_UTF16CHAR_STR@@PB_WIPAI@Z
?GetRandomName@AvgBasPath@@YGHAAU_AVG_UTF16CHAR_STR@@PAI@Z
?GetRandomNameSize@AvgBasPath@@YGIXZ
?IsPathRooted@AvgBasPath@@YG_NPB_WI@Z
??1AvgSpinLockLocker@@QAE@XZ
??0AvgSpinLockLocker@@QAE@PAUAvgSpinLock@@_N@Z
?AvgDestroySysMini@@YGXXZ
?AvgInitializeSysMini@@YGHXZ
?InitializeEnvironment@AvgEnvironment@@YGHXZ
?DestroyEnvironment@AvgEnvironment@@YGXXZ
?GetValue@AvgUtf16CharHeapBuffer@@QBGPB_WXZ
?GetSize@AvgUtf16CharHeapBuffer@@QBGIXZ
??1AvgUtf16CharHeapBuffer@@QAE@XZ
??0AvgUtf16CharHeapBuffer@@QAE@XZ
?AvgBasGetStackFrameModulePath@@YGHAAV?$IAvgString@_W$0A@@@ABUAvgBasStackFrameX86@@@Z
?AvgCompareStringNoCase@@YGHW4AvgCodePage@@PB_W1II@Z
?AvgConvertString2Number@@YGHAAHPB_WIHPAPB_W@Z
?Set@AvgBasEvent@@QAGHXZ
?AvgCreateErrorCodeFromWin32@@YGHK@Z
?GetForward@AvgBasWaitable@@IBGPAV1@XZ
?GetResourceType@AvgBasWaitable@@IBG?AW4AvgBasWaitableResourceType@@XZ
?Destroy@AvgBasWaitable@@UAGHXZ
?GetThreadExitCode@AvgBasThread@@QAGHAAH@Z
?StopThread@AvgBasThread@@QAGHH@Z
?StartThread@AvgBasThread@@QAGHW4AvgPriority@@PAVAvgSecurityCtx@@V?$AvgFlags@W4ThreadFlag@AvgBasThread@@@@PBD@Z
?Initialize@AvgBasThread@@QAGHPAVAvgBasEvent@@@Z
?Cleanup@AvgBasThread@@MAGXXZ
?Reset@AvgBasEvent@@QAGHXZ
?AvgGetSystemTime@@YGHAA_K@Z
?Acquire@AvgBasCriticalSection@@QAGHXZ
?Create@AvgBasCriticalSection@@QAGHXZ
??1AvgBasCriticalSection@@QAE@XZ
??0AvgBasCriticalSection@@QAE@XZ
?Initialize@AvgWinSecurityIdentifier@@QAGHW4WellKnownSidType@1@PBV1@@Z
?Assign@AvgWinSecurityDescriptor@@QAGHABVAvgSecurityCtx@@@Z
?AddDaclAce@AvgWinSecurityDescriptor@@QAGHABVAvgWinAce@@@Z
?Release@AvgBasMutex@@QAGHXZ
?Acquire@AvgBasMutex@@QAGHH@Z
?Create@AvgBasMutex@@QAGH_N@Z
?IsInitialized@AvgBasWaitable@@QBG_NXZ
?IsInitialized@AvgBasCriticalSection@@QBG_NXZ
?WaitForThreadToStop@AvgBasThread@@QAGHH@Z
?Assign@AvgUtf16CharHeapBuffer@@QAGHPB_WI@Z
?AvgGetTimestamp@@YGKXZ
?GetPathRootLength@AvgBasPath@@YGIPB_WI@Z
?Append@AvgUtf16CharHeapBuffer@@QAGHPB_WI@Z
?Append@AvgUtf16CharHeapBuffer@@QAGH_W@Z
??AAvgUtf16CharHeapBuffer@@QAGAA_WI@Z
?ReserveElements@AvgUtf16CharHeapBuffer@@QAGHI@Z
?GetDirectoryItem@AvgBasFs@@YGHAAVItem@1@PB_W@Z
?GetName@Item@AvgBasFs@@QBGPB_WXZ
??1Item@AvgBasFs@@QAE@XZ
??0Item@AvgBasFs@@QAE@XZ
?FreeResource@AvgBasWaitable@@IAGHXZ
?ParseWinSecDes@AvgWinSecurityDescriptor@@KGHAAV1@PBXV?$AvgFlags@W4InformationValues@AvgWinSecurityDescriptor@@@@@Z
?ReleaseClonedObject@AvgWinSecurityDescriptor@@UAEXXZ
?ClearSecurityAttributes@AvgWinSecurityDescriptor@@QAGXXZ
?CloneImpl@AvgWinSecurityDescriptor@@MBEHAAPAVAvgSecurityCtx@@@Z
?GetInformationType@AvgWinSecurityDescriptor@@QBG?AV?$AvgFlags@W4InformationValues@AvgWinSecurityDescriptor@@@@XZ
?AvgMemXor@@YGXPAEPBEI@Z
?InternalWait@AvgBasWaitable@@IAGHH@Z
?Destroy@AvgBasCriticalSection@@QAGHXZ
?AvgGenerateRandomBuffer@@YGXPAEI@Z
?GetCurrentProcessId@AvgProcess@@YGKXZ
?GetCurrentSessionId@AvgEnvironment@@YGHAAK@Z
?GetCurrentThreadId@AvgBasThread@@SGKXZ
?AvgPrintV@@YGHPB_WPAD@Z
?CreateLuid@AvgGuidUtils@@YGHAAU_AvgGuid@@@Z
?Assign@AvgGuidUtils@@YGXAAU_AvgGuid@@ABU2@@Z
?GetCurrentModuleHandle@AvgProcess@@YGPAXXZ
?GetHandle@AvgBasWaitable@@IBGPAXXZ
?AvgCreateErrorCodeFromWin32@@YGHW4_AvgErrorCodeSeverity@@K@Z
?Create@AvgBasEvent@@QAGHW4ResetType@1@_N@Z
?Wait@AvgBasEvent@@QAGHH@Z
??0AvgBasObjectFactoryImpl@detail@@QAE@XZ
??1AvgBasObjectFactoryImpl@detail@@QAE@XZ
?Initialize@AvgBasObjectFactoryImpl@detail@@QAGHPBUAvgBasObjectFactoryMapping@@I@Z
?SetProgramPath@AvgBasObjectFactoryImpl@detail@@QAGHPB_W@Z
?GetAvgObject@AvgBasObjectFactoryImpl@detail@@QAGHABU_AvgGuid@@PAPAX@Z
?UnloadSharedLibraries@AvgBasObjectFactoryImpl@detail@@QAGX_N@Z
?Sleep@AvgBasThread@@SGHH@Z
?GetSpecialFolder@AvgEnvironment@@YGHW4SpecialFolder@1@AAV?$IAvgString@_W$0A@@@@Z
?GetMaxPathLength@AvgEnvironment@@YGHAAIPB_W@Z
?IsWindows8OrHigher@OsInfo@AvgEnvironment@@YG_NXZ
??0AvgBasSharedLibraryLoader@@QAE@PB_W@Z
??1AvgBasSharedLibraryLoader@@UAE@XZ
?Load@AvgBasSharedLibraryLoader@@QAGHPB_W@Z
?Unload@AvgBasSharedLibraryLoader@@UAGXXZ
?AttachTo@AvgBasSharedLibraryLoader@@QAGHPBDPCRAX@Z
?Parse@AvgGuidUtils@@YGHAAU_AvgGuid@@PB_W@Z
??0AvgBasWinRegistryHandle@@QAE@W4AvgBasWinRegistryRootType@@@Z
??1AvgBasWinRegistryHandle@@QAE@XZ
?OpenKeyIfExists@AvgBasWinRegistryHandle@@QAGHABU?$AvgStringRefBase@_W$0A@@@@Z
?IsWow64ViewModeSupported@AvgBasWinRegistryHandle@@SG_NXZ
?SetViewMode@AvgBasWinRegistryHandle@@QAGHV?$AvgFlags@W4AvgBasWinRegistryViewModeValues@@@@@Z
?GetStringValue@AvgBasWinRegistryHandle@@QAGHAAV?$IAvgString@_W$0A@@@ABU?$AvgStringRefBase@_W$0A@@@@Z
?CloseKey@AvgBasWinRegistryHandle@@QAGXXZ
?AvgCompareString@@YGHPB_W0II@Z
?AvgFormatStringV@@YGHW4AvgCodePage@@PA_WIPB_WPAIPAD@Z
?DirectoryExists@AvgBasFs@@YGHPB_W@Z
?AvgGetStringSizeInElements@@YGIPB_W@Z
?AddDaclAce@AvgWinSecurityDescriptor@@QAGHW4WellKnownSidType@AvgWinSecurityIdentifier@@HW4Type@AvgWinAce@@V?$AvgFlags@W4FlagsValues@AvgWinAce@@@@@Z
?AvgCopyString@@YGHPA_WIPB_WI@Z
?AvgNtdll_RtlDosPathNameToNtPathName_T_EliminateDosDevice@@YGHPB_WPAU_UNICODE_STRING@@@Z
?AvgWinZwOpenFile@@YGHPB_WPAPAXKPAU_IO_STATUS_BLOCK@@KK@Z
?GetSecurityDescriptor@AvgWinSecurityDescriptor@@QAGHAAPAX@Z
?AvgBufferXor@@YGXPAEPBEI1I_J@Z
?GetString@AvgGuidUtils@@YGHABU_AvgGuid@@AAU_AVG_UTF16CHAR_STR@@@Z
?GetModuleDirectory@AvgModule@@YGHPAXAAU_AVG_UTF16CHAR_STR@@PAI@Z
?Release@AvgBasCriticalSection@@QAGHXZ
mfc100u
ord6140
ord266
ord3416
ord5261
ord11228
ord7391
ord11240
ord11209
ord890
ord13568
ord13571
ord13569
ord13572
ord13567
ord13570
ord7179
ord11469
ord13267
ord10976
ord14162
ord1739
ord7126
ord11864
ord3625
ord3684
ord8530
ord13387
ord7108
ord13381
ord11477
ord11476
ord2164
ord9447
ord4744
ord13854
ord7176
ord4086
ord11784
ord11845
ord9498
ord11236
ord7548
ord1292
ord6869
ord7624
ord8346
ord9328
ord7393
ord4792
ord6922
ord6932
ord6931
ord4623
ord4794
ord4645
ord5118
ord4901
ord8483
ord5115
ord4923
ord4642
ord1300
ord1934
ord2089
msvcr100
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
__CxxFrameHandler3
??2@YAPAXI@Z
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_CxxThrowException
_purecall
kernel32
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
QueryPerformanceCounter
SetUnhandledExceptionFilter
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
GetTickCount
InterlockedCompareExchange
Sleep
InterlockedExchange
WaitForMultipleObjectsEx
CloseHandle
CancelIo
DeviceIoControl
GetLastError
GetOverlappedResult
CreateFileW
comctl32
InitCommonControlsEx
Exports
Exports
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 192KB - Virtual size: 496KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE