Static task
static1
Behavioral task
behavioral1
Sample
876268476dfd58e0012dd1b950a1a11599e8c5aa106629614e2a1c15e86e2c38.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
876268476dfd58e0012dd1b950a1a11599e8c5aa106629614e2a1c15e86e2c38.exe
Resource
win10v2004-20220812-en
General
-
Target
876268476dfd58e0012dd1b950a1a11599e8c5aa106629614e2a1c15e86e2c38
-
Size
137KB
-
MD5
be488d3d382e34c0bb51b694cf9ee2e9
-
SHA1
4272f0ce09d64a7dac23146ddb93a7105b8f0401
-
SHA256
876268476dfd58e0012dd1b950a1a11599e8c5aa106629614e2a1c15e86e2c38
-
SHA512
0ecb159a6b3a117b1ba638c65e7ccca5605b7ffd3de963a5dd66d10139cf9eba53c10812e6a0e3716e40223e0842cec92062f1abf4754935a6ed5f60ddfe17e4
-
SSDEEP
3072:LKpzYK+cGI5Sc3zHzJXktBwpDE9lIYmgzcvjtZqtw50uR:MJ+cdESHlkzU2WYncvjnIw5J
Malware Config
Signatures
Files
-
876268476dfd58e0012dd1b950a1a11599e8c5aa106629614e2a1c15e86e2c38.exe windows x86
b913c17d4f81bdad9bf30ba948e4a2b4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
odbctrac
TraceSQLSetPos
TraceSQLGetEnvAttr
TraceSQLForeignKeysW
TraceSQLForeignKeys
TraceSQLPutData
TraceSQLAllocConnect
TraceSQLFetchScroll
TraceSQLGetConnectOptionW
TraceSQLSetConnectAttrW
TraceSQLFreeStmt
TraceSQLExecDirectW
TraceSQLSpecialColumnsW
TraceSQLSpecialColumns
TraceSQLGetStmtAttrW
TraceSQLTables
TraceSQLGetInfo
TraceCloseLogFile
TraceSQLGetDiagRecW
TraceSQLExtendedFetch
TraceSQLGetDescFieldW
TraceSQLGetConnectAttr
TraceSQLBindParam
TraceReturn
TraceSQLGetCursorNameW
FireVSDebugEvent
TraceSQLBindParameter
TraceSQLCancel
TraceSQLSetEnvAttr
TraceSQLPrimaryKeys
TraceSQLAllocHandleStd
TraceSQLProcedures
TraceSQLParamOptions
TraceSQLError
TraceSQLGetDiagRec
TraceSQLExecDirect
TraceSQLDriverConnectW
TraceSQLGetDescRec
msvcp60
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??_7money_base@std@@6B@
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?id@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
?exp@std@@YA?AV?$complex@N@1@ABV21@@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAE@Z
?is_open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QBE_NXZ
?_Nomemory@std@@YAXXZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?max@?$numeric_limits@J@std@@SAJXZ
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?do_decimal_point@?$numpunct@D@std@@MBEDXZ
?do_grouping@?$numpunct@G@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
??Mstd@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXIG@Z
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
?signaling_NaN@?$numeric_limits@I@std@@SAIXZ
?exp@?$_Ctr@O@std@@SAOO@Z
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0?$_Mpunct@D@std@@QAE@I_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
??1?$_Mpunct@D@std@@UAE@XZ
?do_length@?$codecvt@GDH@std@@MBEHAAHPBG1I@Z
?quiet_NaN@?$numeric_limits@M@std@@SAMXZ
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z
?_Init@?$messages@G@std@@IAEXABV_Locinfo@2@@Z
?do_pos_format@?$_Mpunct@D@std@@MBE?AUpattern@money_base@2@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBDI@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
??_7?$numpunct@G@std@@6B@
??9std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?imag@?$_Complex_base@O@std@@QAEOABO@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??4?$complex@N@std@@QAEAAV01@ABN@Z
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z
??1_Locinfo@std@@QAE@XZ
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
?flush@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
??Nstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?sqrt@std@@YA?AV?$complex@N@1@ABV21@@Z
??_8?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@7B@
?_Cosh@?$_Ctr@M@std@@SAMMM@Z
??9std@@YA_NABV?$complex@O@0@ABO@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@C@Z
??0money_base@std@@QAE@I@Z
?hash@?$collate@G@std@@QBEJPBG0@Z
?setf@ios_base@std@@QAEHHH@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ
?_Init@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
_Stold
?_Getmonths@_Locinfo@std@@QBEPBDXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
?_Infv@?$_Ctr@O@std@@SAOO@Z
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?log@std@@YA?AV?$complex@O@1@ABV21@@Z
??Dstd@@YA?AV?$complex@N@0@ABV10@0@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??_F?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1messages_base@std@@UAE@XZ
_FEps
??_Fmessages_base@std@@QAEXXZ
??0?$complex@M@std@@QAE@ABV?$complex@O@1@@Z
?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?unget@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z
?thousands_sep@?$numpunct@D@std@@QBEDXZ
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
msvcrt20
?eatwhite@istream@@QAEXXZ
_wspawnlpe
_getsystime
wcsncat
_mbslen
_chmod
longjmp
?isfx@istream@@QAEXXZ
_tcslwr
_commit
_winmajor
__p__winmajor
_mbsspn
_wpopen
_CIatan2
??_8ostream_withassign@@7B@
_mbsnbcpy
isspace
??_8strstream@@7Bistream@@@
_strnicoll
??_7filebuf@@6B@
_memicmp
_XcptFilter
_hypot
?_query_new_handler@@YAP6AHI@ZXZ
?rdbuf@fstream@@QBEPAVfilebuf@@XZ
kernel32
LeaveCriticalSection
WritePrivateProfileStructA
SetMailslotInfo
EnumLanguageGroupLocalesW
GetVolumePathNameW
GetTapeParameters
AllocConsole
EnterCriticalSection
RtlFillMemory
CloseProfileUserMapping
GetThreadSelectorEntry
GetFileAttributesExA
ResetEvent
LocalHandle
GetThreadTimes
PeekConsoleInputW
VirtualAllocEx
GetTapePosition
FindAtomW
AddAtomW
DeleteFileW
BaseFlushAppcompatCache
GetComputerNameA
lstrcmpA
QueryInformationJobObject
UTRegister
GetConsoleAliasesW
HeapCompact
SetFileAttributesA
VerifyVersionInfoA
CopyFileA
CreateFileA
GetBinaryType
ReplaceFileA
InterlockedDecrement
Thread32First
CreateHardLinkA
OpenProfileUserMapping
FindResourceA
BaseDumpAppcompatCache
MoveFileExW
LoadLibraryA
SetCommState
GetNumberFormatW
DebugBreakProcess
GetNumaAvailableMemoryNode
GetDevicePowerState
BaseCheckAppcompatCache
InterlockedPushEntrySList
GetCurrentConsoleFont
FindNextFileW
WriteProfileStringA
GlobalHandle
GetNumberOfConsoleMouseButtons
UnregisterConsoleIME
SetCalendarInfoW
PrivMoveFileIdentityW
EnumSystemGeoID
ConvertThreadToFiber
UTUnRegister
GetConsoleFontInfo
GetSystemDefaultLCID
ActivateActCtx
GetCPInfo
Module32First
GetConsoleKeyboardLayoutNameW
CreateMailslotA
DebugSetProcessKillOnExit
GetThreadPriority
LZClose
MapViewOfFileEx
FillConsoleOutputCharacterW
WaitForSingleObjectEx
VirtualAlloc
ReadConsoleInputExA
GetProcessHeap
QueryPerformanceFrequency
GetModuleHandleA
DeleteCriticalSection
msvcrt40
_mbsnextc
_CIatan
?is_open@fstream@@QBEHXZ
fwprintf
?doallocate@strstreambuf@@MAEHXZ
??0ostream@@QAE@PAVstreambuf@@@Z
_isatty
_wtol
_yn
_safe_fdivr
__mb_cur_max
?setlock@streambuf@@QAEXXZ
_ismbbgraph
?ends@@YAAAVostream@@AAV1@@Z
_memicmp
_adj_fdiv_m16i
??0ofstream@@QAE@ABV0@@Z
__p__pgmptr
?precision@ios@@QAEHH@Z
?lockptr@streambuf@@IAEPAU_CRT_CRITICAL_SECTION@@XZ
?x_lockc@ios@@0U_CRT_CRITICAL_SECTION@@A
_ismbbkprint
?flush@@YAAAVostream@@AAV1@@Z
memchr
_setmaxstdio
??_Eios@@UAEPAXI@Z
strcmp
?sync@filebuf@@UAEHXZ
mblen
_CIfmod
??_8istrstream@@7B@
msdart
?SetSpinCount@CSpinLock@@QAE_NG@Z
?_SegIndex@CLKRLinearHashTable@@ABEKK@Z
?TryReadLock@CSpinLock@@QAE_NXZ
?WriteUnlock@CCritSec@@QAEXXZ
?IsWriteUnlocked@CReaderWriterLock@@QBE_NXZ
?InsertHead@CDoubleList@@QAEXQAVCListEntry@@@Z
mpRealloc
?SetSpinCount@CReaderWriterLock3@@QAE_NG@Z
?sm_llGlobalList@CLKRHashTable@@0VCLockedDoubleList@@A
mpMalloc
?ReadUnlock@CFakeLock@@QAEXXZ
?SetBucketLockSpinCount@CLKRLinearHashTable@@QAEXG@Z
?WriteUnlock@CReaderWriterLock2@@QAEXXZ
?_BucketAddress@CLKRLinearHashTable@@ABEKK@Z
?sm_lpOSVERSIONINFO@CMdVersionInfo@@0PAU_OSVERSIONINFOW@@A
?ReadLock@CSpinLock@@QAEXXZ
?IsReadUnlocked@CCritSec@@QBE_NXZ
?IsWriteLocked@CReaderWriterLock@@QBE_NXZ
?_H1@CLKRLinearHashTable@@ABEKK@Z
?ConvertSharedToExclusive@CReaderWriterLock2@@QAEXXZ
?IsEmpty@CSingleList@@QBE_NXZ
?Pop@CSingleList@@QAEQAVCSingleListEntry@@XZ
?DeleteRecord@CLKRLinearHashTable@@QAE?AW4LK_RETCODE@@PBX@Z
?IsReadUnlocked@CReaderWriterLock@@QBE_NXZ
?_InsertThisIntoGlobalList@CLKRLinearHashTable@@AAEXXZ
?_WriteLockSpin@CReaderWriterLock2@@AAEXXZ
?WriteLock@CReaderWriterLock@@QAEXXZ
?ReadLock@CReaderWriterLock@@QAEXXZ
?Unlock@CLockedDoubleList@@QAEXXZ
?SetTableLockSpinCount@CLKRHashTable@@QAEXG@Z
?_DeleteKey@CLKRLinearHashTable@@AAE?AW4LK_RETCODE@@KK@Z
?IsWinNT4@CMdVersionInfo@@SAHXZ
?_EqualKeys@CLKRLinearHashTable@@ABE_NKK@Z
?ConvertSharedToExclusive@CFakeLock@@QAEXXZ
?InsertTail@CDoubleList@@QAEXQAVCListEntry@@@Z
?TryWriteLock@CSpinLock@@QAE_NXZ
??0CLKRHashTableStats@@QAE@XZ
?RemoveHead@CLockedDoubleList@@QAEQAVCListEntry@@XZ
_DllMain@12
??0CFakeLock@@QAE@XZ
avifil32
AVIFileRelease
CreateEditableStream
AVIBuildFilterW
AVIFileWriteData
AVISaveOptionsFree
AVIStreamGetFrame
AVIFileEndRecord
AVIFileReadData
EditStreamSetNameA
AVIStreamOpenFromFileA
IID_IAVIFile
AVISaveW
AVIClearClipboard
IID_IAVIStream
AVIBuildFilterA
AVIStreamOpenFromFileW
AVIMakeCompressedStream
IID_IAVIEditStream
AVIStreamRead
AVIMakeFileFromStreams
EditStreamSetName
AVISaveOptions
AVIStreamInfoA
AVIFileOpenW
AVIStreamReadFormat
AVIStreamAddRef
EditStreamClone
IID_IGetFrame
AVIFileInfoA
AVIBuildFilter
AVISave
AVISaveVA
AVIStreamStart
AVIStreamOpenFromFile
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 85KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 988B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ