Static task
static1
Behavioral task
behavioral1
Sample
81b5e92fde064b833199f60a7e860c13a2ba777eac08c0d7c1e9261271b8978f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
81b5e92fde064b833199f60a7e860c13a2ba777eac08c0d7c1e9261271b8978f.exe
Resource
win10v2004-20220901-en
General
-
Target
81b5e92fde064b833199f60a7e860c13a2ba777eac08c0d7c1e9261271b8978f
-
Size
85KB
-
MD5
59ebb98249115a99b6dd9cc758b74346
-
SHA1
cbc95b1846af02d6766895cf967d9edf46f1d1fa
-
SHA256
81b5e92fde064b833199f60a7e860c13a2ba777eac08c0d7c1e9261271b8978f
-
SHA512
16fe8b173b10de53ac77d412d616ab700e7a7658ba879037137078c09bb04baa1cd53f08bb67bf3fe163733c3f70ae9d2e347b7cfeda6c9095c6c7e2d6a22424
-
SSDEEP
1536:iylFW/+9FOyVp1Z1NqejQ/G1PpNyenNj9oK0DcNTsZOYd0AvjGUXklLP7TJ:OaN1Z2ejQ6RNF9oK0oZsZO3fiklT71
Malware Config
Signatures
Files
-
81b5e92fde064b833199f60a7e860c13a2ba777eac08c0d7c1e9261271b8978f.exe windows x86
999c6c515c50cf5a3681430a33984388
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
strstr
NtMapViewOfSection
isprint
tolower
isspace
_snprintf
memset
memcpy
_chkstk
RtlUnwind
NtQueryVirtualMemory
kernel32
CreateProcessA
VirtualFree
CreateToolhelp32Snapshot
lstrcmpiW
Process32NextW
Process32FirstW
lstrcpyA
ExitProcess
MoveFileExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
lstrlenA
CreateFileA
GetLastError
DeviceIoControl
CloseHandle
GetThreadContext
SetThreadContext
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
TerminateProcess
GetSystemDirectoryA
GetProcAddress
VirtualAlloc
CreateFileMappingA
WriteProcessMemory
ResumeThread
user32
CharUpperBuffA
advapi32
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
shell32
ShellExecuteA
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE