Static task
static1
Behavioral task
behavioral1
Sample
95c8c5302f4d4ff1f71034c55fb5561d2363f9a6615390ea4b5e86a62417a8f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
95c8c5302f4d4ff1f71034c55fb5561d2363f9a6615390ea4b5e86a62417a8f4.exe
Resource
win10v2004-20221111-en
General
-
Target
95c8c5302f4d4ff1f71034c55fb5561d2363f9a6615390ea4b5e86a62417a8f4
-
Size
30KB
-
MD5
6f6a96204c75925ef74851b5e2a4ac4b
-
SHA1
abfe67ff664c785bc80b19ffdcb2c07bc66d74cf
-
SHA256
95c8c5302f4d4ff1f71034c55fb5561d2363f9a6615390ea4b5e86a62417a8f4
-
SHA512
2d7f7139a0361aeab8d6b0a21811fc93e2b27ca1b84cb8205234683e268c4a9842f86159393f69d96fbd30e881736d357e09bf0c6bf3b2a8742257dbadd0ffc2
-
SSDEEP
768:iEFp0oisprliByzlHaCdbqXpFmvJFDb/hbtvCoqGlP051hBARHIL9kQ:im/iByzl6ZCJFDbZMvmG6Q9r
Malware Config
Signatures
Files
-
95c8c5302f4d4ff1f71034c55fb5561d2363f9a6615390ea4b5e86a62417a8f4.exe windows x86
bcce0968bdaa479e918646790a9d273b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
RpcStringBindingComposeW
NdrClientCall2
UuidToStringA
RpcEpResolveBinding
RpcStringBindingComposeA
RpcStringFreeW
RpcBindingFromStringBindingA
UuidCreate
RpcStringFreeA
RpcRevertToSelf
RpcBindingSetAuthInfoExW
RpcImpersonateClient
RpcBindingFree
RpcBindingFromStringBindingW
kernel32
MapViewOfFile
SetEvent
DeleteCriticalSection
LocalFree
TlsSetValue
UnhandledExceptionFilter
PulseEvent
GetLastError
OpenFileMappingW
SetEndOfFile
SetFileAttributesA
CreateEventA
CloseHandle
FindFirstChangeNotificationA
CreateFileMappingA
LocalSize
InterlockedIncrement
GetTempFileNameA
EnterCriticalSection
FormatMessageW
InterlockedDecrement
GetModuleFileNameW
FormatMessageA
GetProcAddress
CreateDirectoryW
WideCharToMultiByte
TlsGetValue
LeaveCriticalSection
DeleteFileW
ExitThread
FindNextChangeNotification
FindCloseChangeNotification
OpenEventA
GetFileSize
GetVersionExA
lstrcmpA
LoadLibraryA
FindFirstFileA
lstrlenW
UnmapViewOfFile
SetLastError
WaitForSingleObject
CreateDirectoryA
FindFirstChangeNotificationW
FindNextFileA
GetCurrentThreadId
GetTickCount
CompareStringW
SystemTimeToFileTime
OutputDebugStringA
OpenMutexW
ReleaseMutex
OpenMutexA
DeleteFileA
GetComputerNameA
WaitForSingleObjectEx
GetSystemDefaultLangID
ExpandEnvironmentStringsA
CreateFileW
TerminateProcess
LoadLibraryExA
CreateMutexW
ReadFile
lstrcpyA
CreateMutexA
GetSystemTimeAsFileTime
DuplicateHandle
Sleep
CreateThread
GetTimeFormatW
VirtualAlloc
GetDateFormatA
GetUserDefaultLCID
GetEnvironmentVariableA
CreateFileA
LocalAlloc
FreeLibraryAndExitThread
GetModuleHandleA
GetCurrentProcessId
GetFileAttributesExW
lstrcatA
LocalReAlloc
GetTimeFormatA
InterlockedCompareExchange
GetLocalTime
GetDateFormatW
FreeLibrary
SetFilePointer
TlsAlloc
GetTempPathA
FileTimeToLocalFileTime
GetComputerNameW
GetACP
SetUnhandledExceptionFilter
GetFileAttributesA
lstrlenA
QueryPerformanceCounter
CompareFileTime
FindNextFileW
ExpandEnvironmentStringsW
LoadLibraryExW
FindClose
WaitForMultipleObjectsEx
WriteFile
FileTimeToSystemTime
CreateFileMappingW
GetModuleFileNameA
MultiByteToWideChar
GetSystemTime
DelayLoadFailureHook
CompareStringA
GetCurrentThread
GetFileAttributesW
SetFileAttributesW
InitializeCriticalSection
TlsFree
GetCurrentProcess
FindFirstFileW
user32
GetSystemMetrics
LoadStringA
wsprintfA
MessageBoxA
wsprintfW
LoadStringW
MessageBoxW
GetProcessDefaultLayout
advapi32
AddAccessAllowedAce
RegCreateKeyExA
QueryServiceStatus
OpenProcessToken
RegEnumValueA
GetSidSubAuthority
CryptVerifySignatureA
ControlService
EqualSid
SystemFunction041
RegSetValueExA
CloseServiceHandle
LookupPrivilegeValueA
RegQueryInfoKeyW
CryptSetHashParam
CryptDeriveKey
RegQueryValueExA
CryptGenKey
CryptAcquireContextA
CryptGetKeyParam
RegQueryValueExW
RegOpenKeyExW
GetAce
CryptReleaseContext
RegDeleteKeyW
FreeSid
OpenServiceW
QueryServiceConfigA
RegQueryInfoKeyA
A_SHAFinal
A_SHAInit
SetSecurityDescriptorOwner
CryptSetKeyParam
LockServiceDatabase
RegGetKeySecurity
RegDeleteKeyA
CryptSetProvParam
InitializeSecurityDescriptor
OpenSCManagerW
GetUserNameA
IsValidSid
RegCloseKey
SetSecurityDescriptorDacl
GetLengthSid
GetSecurityDescriptorDacl
StartServiceW
CryptHashData
CryptEncrypt
RegNotifyChangeKeyValue
CryptDestroyHash
CryptGetDefaultProviderW
CryptGetUserKey
AllocateAndInitializeSid
SetSecurityDescriptorGroup
RegEnumKeyA
RegConnectRegistryW
CryptGetProvParam
CryptSignHashA
A_SHAUpdate
OpenThreadToken
GetSidIdentifierAuthority
RegEnumKeyExA
RegConnectRegistryA
GetSidSubAuthorityCount
CryptExportKey
RegSetValueExW
AdjustTokenPrivileges
CryptCreateHash
RegEnumValueW
CryptSetProviderA
UnlockServiceDatabase
CryptDecrypt
ChangeServiceConfigA
SystemFunction040
MD5Init
MD5Update
GetTokenInformation
InitializeAcl
RegDeleteValueW
LookupAccountSidW
RegEnumKeyExW
LsaNtStatusToWinError
CryptImportKey
GetSecurityDescriptorOwner
RegSetKeySecurity
CryptGetHashParam
RegCreateKeyExW
RegOpenKeyExA
CryptDestroyKey
CopySid
GetUserNameW
StartServiceA
CryptGenRandom
MD5Final
RegDeleteValueA
msvcrt
_ultoa
wcschr
sprintf
_initterm
malloc
_snwprintf
wcscpy
memcpy
wcslen
atol
_ltoa
memmove
bsearch
_ltow
_wcsnicmp
_itow
_snprintf
isupper
isdigit
_adjust_fdiv
_wcsicmp
strncpy
strncmp
isxdigit
__dllonexit
free
_except_handler3
_onexit
wcscmp
wcscat
strtoul
qsort
msasn1
ASN1BERDotVal2Eoid
ASN1DecRealloc
ASN1BERDecOpenType2
ASN1BERDecSXVal
ASN1BERDecOpenType
ASN1BEREncS32
ASN1intx_free
ASN1BEREncOctetString
ASN1BEREncChar16String
ASN1BERDecChar16String
ASN1CEREncNewBlkElement
ASN1BERDecBitString2
ASN1BEREncBool
ASN1BEREncU32
ASN1CEREncGeneralizedTime
ASN1BERDecEoid
ASN1BERDecChar32String
ASN1octetstring_free
ASN1ztcharstring_free
ASN1BERDecOctetString2
ASN1_FreeDecoded
ASN1CEREncUTCTime
ASN1BEREoid_free
ASN1charstring_free
ASN1CEREncBeginBlk
ASN1BEREncEoid
ASN1EncSetError
ASN1BERDecEndOfContents
ASN1CEREncEndBlk
ASN1BERDecS32Val
ASN1CEREncFlushBlkElement
ASN1char16string_free
ASN1utf8string_free
ASN1BEREncEndOfContents
ASN1BEREncExplicitTag
ASN1BERDecBitString
ASN1_CloseEncoder
ASN1open_free
ASN1BEREncOpenType
ASN1BERDecExplicitTag
ASN1DecSetError
ASN1char32string_free
ASN1BEREncSX
ASN1_CloseModule
ASN1BERDecUTF8String
ASN1_Decode
ASN1BERDecObjectIdentifier2
ASN1_Encode
ASN1BEREncChar32String
ASN1BERDecMultibyteString
ASN1_SetEncoderOption
ASN1BEREoid2DotVal
ASN1BERDecUTCTime
ASN1BEREncBitString
ASN1bitstring_free
ASN1BERDecZeroCharString
ASN1BERDecU32Val
ASN1Free
ASN1BERDecBool
ASN1BEREncMultibyteString
ASN1_FreeEncoded
ASN1BEREncCharString
ASN1BERDecOctetString
ASN1BERDecPeekTag
ASN1_CloseDecoder
ASN1_CreateEncoder
ASN1BERDecNotEndOfContents
ASN1BERDecCharString
ASN1_CreateModule
ASN1BERDecGeneralizedTime
ASN1BEREncUTF8String
ASN1BEREncObjectIdentifier2
ASN1objectidentifier2_cmp
ASN1_CreateDecoder
adsldpc
ADsFreeColumn
Sections
.textbss Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 412B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 28KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE