Static task
static1
Behavioral task
behavioral1
Sample
979ad5eda81cc519a454bd229419722020c673b626b107a844d2388c56c78125.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
979ad5eda81cc519a454bd229419722020c673b626b107a844d2388c56c78125.exe
Resource
win10v2004-20220812-en
General
-
Target
979ad5eda81cc519a454bd229419722020c673b626b107a844d2388c56c78125
-
Size
299KB
-
MD5
8107232dca62ee5e045ed60fe83e62b7
-
SHA1
a3ef9ba6a4ad85d79fba66a1c69ccdd8d2913dc2
-
SHA256
979ad5eda81cc519a454bd229419722020c673b626b107a844d2388c56c78125
-
SHA512
3e481d00509421cdce85c386889ae79448f09af44ad6c9ae02ee96eadbf0b7fc297ce991dcdd1253c8ab21f446c495d13c3a0a76292e162ffe8f8c7936967ee5
-
SSDEEP
6144:AQVacQV7BoIHL407Y2qDsXII68X08UK6tw+eSklLqsYyeUA:AGa7yIHUAYjDsYI6my9w+QLqNnU
Malware Config
Signatures
Files
-
979ad5eda81cc519a454bd229419722020c673b626b107a844d2388c56c78125.exe windows x86
b48c30db554155ad80000e37b11fbe3d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFree
GetEnvironmentVariableA
LocalSize
GetCommandLineW
GetPrivateProfileIntA
CreateEventW
GetSystemInfo
LoadLibraryW
SuspendThread
WriteFile
ResetEvent
GetStdHandle
VirtualAllocEx
CreateMutexW
LocalFree
InterlockedExchange
ReleaseMutex
lstrlenA
FreeConsole
CloseHandle
advapi32
RegCloseKey
IsValidSid
IsValidSecurityDescriptor
IsTextUnicode
CloseEventLog
ControlService
RegQueryValueW
RegEnumKeyA
RegDeleteValueA
CreateServiceW
InitializeSid
RegCreateKeyExW
ClearEventLogW
InitializeSid
fwcfg
InitHelperDll
InitHelperDll
InitHelperDll
InitHelperDll
InitHelperDll
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 288KB - Virtual size: 287KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ