Static task
static1
Behavioral task
behavioral1
Sample
48ce94843bcb0e3748cff172a9c5753d5f966d984954af43abda1771899d4b49.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
48ce94843bcb0e3748cff172a9c5753d5f966d984954af43abda1771899d4b49.exe
Resource
win10v2004-20221111-en
General
-
Target
48ce94843bcb0e3748cff172a9c5753d5f966d984954af43abda1771899d4b49
-
Size
303KB
-
MD5
2d5ddec64473f2f9e5f922c88e143820
-
SHA1
bfcd0843cc54ba9313b5f83b2ed90df833db5dd5
-
SHA256
48ce94843bcb0e3748cff172a9c5753d5f966d984954af43abda1771899d4b49
-
SHA512
4a29429d184eab2f563826f0e43cc99adc78458901df71a0130ddc67f19d0b84824822c7d4532aa61917b7eb596a3b4a27374fc77d3e58ea4a9ade0bbd79a341
-
SSDEEP
6144:NEEVGQACGqZzqefmeoshRhayn6w8aEK1IW:NzVGIR7meoshmMMe
Malware Config
Signatures
Files
-
48ce94843bcb0e3748cff172a9c5753d5f966d984954af43abda1771899d4b49.exe windows x86
c7c783c8fdb9730e0aef06f86e2cb38c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetExitCodeProcess
GetStdHandle
LocalFree
GlobalFree
VirtualAlloc
GetEnvironmentVariableW
CreateMutexA
InterlockedExchange
GetModuleHandleW
GetCommandLineA
ResetEvent
GlobalSize
lstrlenA
FindVolumeClose
GetACP
CreateEventA
GetPrivateProfileIntW
CloseHandle
ResumeThread
WriteFile
advapi32
ControlService
RegCloseKey
RegCreateKeyExW
RegQueryValueW
RegEnumKeyW
ClearEventLogW
CreateServiceA
RegDeleteValueA
IsTextUnicode
CloseEventLog
IsValidSecurityDescriptor
IsValidSid
RegDeleteKeyA
asycfilt
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
hdwwiz.cpl
InstallNewDevice
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 293KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ