Static task
static1
Behavioral task
behavioral1
Sample
8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489.exe
Resource
win10v2004-20220812-en
General
-
Target
8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489
-
Size
863KB
-
MD5
b55ed7d43380eef1611705494ed3e6a2
-
SHA1
f8aeb39c299c41b5cdc3ab951d4c4489cb7b1ba9
-
SHA256
8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489
-
SHA512
89fc94ba138f4e1c329f3833bf03e5412100c24be90a1d94c2908aeefda3f7ec9af6741697c10e742f085f2aa928f0ea56565380bf050ac615bf7f469f0998df
-
SSDEEP
24576:chdTBERwhrCvGgP3LxdbTY7FNCweaFcpVGTajhCx3fNM:ODrIP3jTY7TCoUGaMK
Malware Config
Signatures
Files
-
8381b8e4c30d15ec23cd8ccd5adf3da7a85797d4f88db02063b5f94fe48e7489.exe windows x86
c08161a7d29a2357b1721e3dfa9579f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlDestroyHandleTable
ZwCreateFile
NtAllocateUuids
RtlSetUserFlagsHeap
ZwStopProfile
RtlQueryProcessBackTraceInformation
NtCreateTimer
NtQueryVolumeInformationFile
RtlNormalizeProcessParams
NtAccessCheckByTypeAndAuditAlarm
wcsncmp
_strupr
NtCreateJobObject
wcspbrk
NtQueryPerformanceCounter
NtCreateMailslotFile
RtlClearAllBits
RtlCustomCPToUnicodeN
ZwSetInformationKey
iscntrl
ZwSaveKeyEx
NtFlushVirtualMemory
RtlCheckForOrphanedCriticalSections
RtlStringFromGUID
NtSetHighWaitLowEventPair
NtUnloadKey
RtlEqualUnicodeString
ZwCreateSemaphore
NtCreateMutant
NtEnumerateKey
NtOpenFile
NtReleaseMutant
RtlCopyLuidAndAttributesArray
_alloca_probe
NtRestoreKey
RtlReAllocateHeap
_CIsqrt
abs
NtCompactKeys
RtlValidateHeap
ZwCreateIoCompletion
DbgUiWaitStateChange
RtlResetRtlTranslations
RtlInitializeSid
ZwCreateMailslotFile
cos
NtSetSecurityObject
RtlAddAccessDeniedAceEx
tolower
NtCreateJobSet
_allrem
NtModifyBootEntry
RtlDosSearchPath_U
ZwQueryVirtualMemory
RtlSetControlSecurityDescriptor
wcsncpy
NtUnloadDriver
NtCreateToken
NtQueryDefaultUILanguage
pow
RtlAddAccessAllowedAce
RtlpNtEnumerateSubKey
LdrUnlockLoaderLock
RtlLocalTimeToSystemTime
NtLockFile
RtlCopyString
RtlNumberOfSetBits
LdrLockLoaderLock
ZwSetIntervalProfile
RtlDeleteTimer
ZwDeleteBootEntry
NtQueryMultipleValueKey
NtTerminateJobObject
ZwSetInformationProcess
RtlIpv4AddressToStringA
opengl32
glColor3ubv
glPointSize
glGetMapiv
glStencilFunc
glColor3fv
glTexParameterf
glColor4b
glTexCoord1iv
glColor4iv
wglSwapMultipleBuffers
glColor3b
glMapGrid2f
glVertex2fv
glIndexsv
glGetTexGendv
glTexImage2D
glDrawPixels
glVertex4sv
glTexCoord4dv
wglSetLayerPaletteEntries
glRasterPos4fv
glVertex3s
wglGetCurrentDC
wglSetPixelFormat
glRasterPos3d
glClearDepth
glAccum
glTexCoord2d
glVertex4dv
glTexEnvi
glTexCoord1dv
glMap1f
glShadeModel
glStencilMask
wglDeleteContext
glRotated
GlmfPlayGlsRecord
glGetTexEnviv
glRasterPos4i
query
??0CTransaction@@QAE@XZ
?VT_VARIANT_NE@@YGHABUtagPROPVARIANT@@0@Z
?GetCategory@CCatState@@QBEPBGI@Z
?LokUpdate@CCatStateInfo@@QAEHXZ
?Done@CFwAsyncWorkItem@@QAEXXZ
?QueryInterface@CEnumString@@UAGJABU_GUID@@PAPAX@Z
?GetOleDBErrorInfo@@YGJPAUIUnknown@@ABU_GUID@@KIPAUtagERRORINFO@@PAPAUIErrorInfo@@@Z
??0CSynRestriction@@QAE@ABVCKey@@KKKH@Z
?OpenFileFromPath@@YGPAU_iobuf@@PBG@Z
??4CDbColId@@QAEAAV0@ABV0@@Z
??1COccRestriction@@QAE@XZ
?FormQueryTree@@YGPAVCDbCmdTreeNode@@AAV1@AAVCCatState@@PAUIColumnMapper@@HH@Z
??0CSvcQuery@@QAE@PBGPAUIDBProperties@@@Z
?OpenExclusive@CMmStream@@QAEXPAGH@Z
?ParseOneLine@CPropertyList@@SGXAAVCQueryScanner@@HAAV?$XPtr@VCPropEntry@@@@@Z
?LokNewWorkId@CPropertyStore@@AAEKKHH@Z
?EnableVPathNotify@CMetaDataMgr@@QAEXPAVCMetaDataVPathChangeCallBack@@@Z
CITextToSelectTreeEx
?Value@CDbScalarValue@@QAEXAAVCStorageVariant@@@Z
?GetStartupData@CGenericCiProxy@@QAEPBEAAU_GUID@@AAK@Z
?AddKey@CSynRestriction@@QAEXABVCKeyBuf@@@Z
??1CRegNotify@@MAE@XZ
?AllocAndCopyWString@CDbCmdTreeNode@@SGPAGPBG@Z
??3CDbColId@@SGXPAX@Z
?TunePerformance@CMachineAdmin@@QAEXHGG@Z
?GetLPSTR@CAllocStorageVariant@@QBEPADI@Z
?ciNew@@YGPAXI@Z
?RemoveCatalogFiles@CMachineAdmin@@QAEXPBG@Z
??1CQueryUnknown@@QAE@XZ
?IsValid@CNodeRestriction@@QBEHXZ
?Set@CPidRemapper@@QAEXAAV?$XArray@K@@@Z
?BuildRegistryPropertiesKey@@YGXAAV?$XArray@G@@PBG@Z
??1CSort@@QAE@XZ
?Init@CSdidLookupTable@@QAEHPAVCiStorage@@@Z
??1CParseCommandTree@@QAE@XZ
?AddTable@CDbNestingNode@@QAEHPAVCDbCmdTreeNode@@@Z
?SetR4@CStorageVariant@@QAEXMI@Z
?CheckHasIndexTable@CiStorage@@SGHPBG@Z
?GetStringFromLCID@@YGXKPAG@Z
?SetProperty@CDbPropBaseRestriction@@QAEHABVCDbColumnNode@@@Z
?Size@CDbQueryResults@@QAEKXZ
?SetI4@CStorageVariant@@QAEXJI@Z
??8CDbColId@@QBEHABV0@@Z
sqlunirl
_CreatePropertySheetPage_@4
_QueryDosDevice_@12
_CallNamedPipe_@28
_CreateProcessAsUser_@44
_PostThreadMessage_@16
_GetDateFormat_@24
_EnumResourceTypes_@12
_CreateFile@28
_tfopen
_RegSaveKey_@12
_ChangeMenu_@20
_lstrcat_@8
_GetTabbedTextExtent_@20
_RegEnumKey_@16
_SetClassLong_@12
_GetCharABCWidthsFloat_@16
_RemoveFontResource_@4
_GetProp@8
_DeleteFile@4
_FindResourceEx_@16
_BeginUpdateResource_@8
_UnregisterClass_@8
_PolyTextOut_@12
_ExtractIcon_@12
_DefDlgProc_@16
_IsCharUpper_@4
_CreateWindowEx@48
_GetPrivateProfileStruct_@20
_RegLoadKey_@12
_EnumProps_@8
_lstrcpy_@8
_RegQueryValueEx_@24
_GetFileVersionInfo_@16
kernel32
CreateSemaphoreA
HeapUnlock
GetDriveTypeW
GetSystemWow64DirectoryW
GetVersionExW
GetProcessShutdownParameters
CreateJobSet
BeginUpdateResourceW
GenerateConsoleCtrlEvent
CreateDirectoryExA
GetModuleHandleA
IsBadWritePtr
WritePrivateProfileStringA
LocalReAlloc
SetCommBreak
GetProcessPriorityBoost
SetVolumeMountPointA
AreFileApisANSI
EnumResourceTypesA
TermsrvAppInstallMode
SetConsoleOS2OemFormat
FreeEnvironmentStringsA
lstrcmpW
EndUpdateResourceW
DeleteAtom
SetFileShortNameW
GlobalAlloc
GetProcessId
GlobalWire
lstrcmp
OpenEventW
DeleteVolumeMountPointA
DeleteFileA
DebugActiveProcess
SetThreadAffinityMask
GetCurrentProcessId
TerminateThread
LoadLibraryA
CreateSemaphoreW
UnregisterWait
VirtualAlloc
SetNamedPipeHandleState
GetSystemDefaultLCID
InterlockedFlushSList
ActivateActCtx
SetThreadIdealProcessor
Sections
.text Size: 547KB - Virtual size: 547KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 306KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ