Static task
static1
Behavioral task
behavioral1
Sample
21538dc4063759292fe511ec2aea302a8fb1e8c35ad63d9d08f05fb8a94f35e8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
21538dc4063759292fe511ec2aea302a8fb1e8c35ad63d9d08f05fb8a94f35e8.exe
Resource
win10v2004-20221111-en
General
-
Target
21538dc4063759292fe511ec2aea302a8fb1e8c35ad63d9d08f05fb8a94f35e8
-
Size
509KB
-
MD5
2887721532c4eb8e13fe48b5e70497d0
-
SHA1
977c2defb22740734114aa14564253ee4c625541
-
SHA256
21538dc4063759292fe511ec2aea302a8fb1e8c35ad63d9d08f05fb8a94f35e8
-
SHA512
5ed1531fa8cd5753d541d5a610f45c18a260c5f4a75092c26eae3febe99c948b14186275647590ed6b28ac5909f0b70b275ae8e6a8211b686347a09a0193842e
-
SSDEEP
12288:Zm5H7Zt0/K83pMSz7R8xiRy8h48oeCaxyWnSwQwl1KdzxWQpjFC:ZmZ7f0FMyR8w4MbxyWSwc1xW6FC
Malware Config
Signatures
Files
-
21538dc4063759292fe511ec2aea302a8fb1e8c35ad63d9d08f05fb8a94f35e8.exe windows x86
86f59f175ec508d95773668b3756716d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptBinaryToStringA
user32
GetDC
LoadAcceleratorsA
LoadCursorA
LoadIconA
RegisterClassA
ws2_32
WSACleanup
WSAStartup
kernel32
DeleteFileA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
LoadLibraryA
VirtualProtect
GetModuleHandleW
ntdll
NtClose
NtCreateFile
NtOpenKey
NtOpenSymbolicLinkObject
NtQueryInformationFile
NtQuerySymbolicLinkObject
NtQueryValueKey
NtQueryVirtualMemory
NtSetInformationFile
NtTerminateProcess
RtlAllocateHeap
RtlFreeHeap
RtlInitUnicodeString
RtlOemToUnicodeN
RtlUnicodeStringToAnsiString
NtOpenFile
ulib
??0ARGUMENT_LEXEMIZER@@QAE@XZ
??0ARRAY@@QAE@XZ
??0DSTRING@@QAE@XZ
??0FLAG_ARGUMENT@@QAE@XZ
??0STRING_ARGUMENT@@QAE@XZ
?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
?Initialize@ARRAY@@QAEEKK@Z
?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z
?Initialize@STRING_ARGUMENT@@QAEEPAD@Z
?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z
?Put@ARRAY@@UAEEPAVOBJECT@@@Z
?QueryDriveType@SYSTEM@@SG?AW4DRIVE_TYPE@@PBVWSTRING@@@Z
?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z
?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z
Sections
AUTO Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DGROUP Size: 120KB - Virtual size: 364KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ