Static task
static1
Behavioral task
behavioral1
Sample
59cdf692be97084d71b6839d9fc563befaaf96681bc2a4f0bbc5bdaf97e1193b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
59cdf692be97084d71b6839d9fc563befaaf96681bc2a4f0bbc5bdaf97e1193b.exe
Resource
win10v2004-20221111-en
General
-
Target
59cdf692be97084d71b6839d9fc563befaaf96681bc2a4f0bbc5bdaf97e1193b
-
Size
854KB
-
MD5
7972f3b33d665983f0075302c60c1c40
-
SHA1
c71e526103b8d57fb42aca8a9d3ca88ce30dc4a2
-
SHA256
59cdf692be97084d71b6839d9fc563befaaf96681bc2a4f0bbc5bdaf97e1193b
-
SHA512
05f61409af5b8a52709b32b9a770572f17a5aa6f46fea3972c86ceb223a7a5aa490059b59fdd3e7a5329c018e6f82614a11d31fc6ee8b7a86d51118be06c1ed0
-
SSDEEP
3072:qP/+c5L+biRYCLggkX7CU+PVZFM57JiE1iKTN964kz96dUIGnVSgaQXWy:qPnR+biRYgkX7deO7iKJ9qIUIU0y
Malware Config
Signatures
Files
-
59cdf692be97084d71b6839d9fc563befaaf96681bc2a4f0bbc5bdaf97e1193b.exe windows x86
468828ee375112b45ea80b715cf9397b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CreateRestrictedToken
CryptGetHashParam
LsaEnumerateAccountsWithUserRight
LsaGetSystemAccessAccount
RegUnLoadKeyA
AdjustTokenPrivileges
CloseTrace
InitiateSystemShutdownExW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
kernel32
CopyFileExA
DisableThreadLibraryCalls
FindNextVolumeW
GetACP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
GlobalAlloc
GlobalFree
IsDBCSLeadByteEx
QueryPerformanceCounter
SetHandleInformation
SetProcessPriorityBoost
SetSystemPowerState
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
WaitForSingleObject
lstrlenW
CloseHandle
CreateDirectoryW
CreateProcessW
CreateThread
FindClose
FreeLibrary
GetCommandLineW
GetEnvironmentVariableW
GetExitCodeProcess
GetFullPathNameW
GetProcAddress
GetSystemTime
GetWindowsDirectoryW
HeapDestroy
LoadLibraryW
LocalFree
MoveFileExW
OutputDebugStringA
Sleep
VirtualAlloc
RtlUnwind
GetLastError
WideCharToMultiByte
GetModuleHandleW
ExitProcess
GetCommandLineA
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
HeapAlloc
IsDebuggerPresent
HeapSize
HeapFree
HeapReAlloc
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
RaiseException
GetCPInfo
GetOEMCP
IsValidCodePage
SetStdHandle
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
GetStdHandle
GetModuleFileNameA
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
VirtualFree
GetModuleHandleA
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
GetTimeZoneInformation
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
ole32
OleRegEnumVerbs
GetHookInterface
oleaut32
VarUI1FromDisp
VarUI2FromStr
rpcrt4
NdrPointerBufferSize
NdrUserMarshalUnmarshall
user32
MessageBoxW
GetWindowThreadProcessId
wvsprintfW
IsClipboardFormatAvailable
IsWindowUnicode
LoadIconW
LoadMenuIndirectW
OpenWindowStationW
SetWindowTextW
Sections
.text Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 345KB - Virtual size: 344KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 317KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE