Static task
static1
Behavioral task
behavioral1
Sample
347fc355c3ee5eaa2fb69de47da21995806bb7036ae87ce6d15e67557eab8093.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
347fc355c3ee5eaa2fb69de47da21995806bb7036ae87ce6d15e67557eab8093.exe
Resource
win10v2004-20221111-en
General
-
Target
347fc355c3ee5eaa2fb69de47da21995806bb7036ae87ce6d15e67557eab8093
-
Size
51KB
-
MD5
f0412a543ca13a931961ec8f25f46b21
-
SHA1
c368989179f31c6ef4af37488a34d1f764dc206b
-
SHA256
347fc355c3ee5eaa2fb69de47da21995806bb7036ae87ce6d15e67557eab8093
-
SHA512
ac88b4784008610c11a5e7d4254268c78bad93791ec7f186d5bd005cd14f37d777c91092d410826d584e0e415a15d33b6f59751f8053b1e8d7f76ede13dd73c2
-
SSDEEP
768:CLRLYpzJtruxTmPdDMoJ4LMOiFnToIf1L08t3OrGwq:CTT4DMowcFnToIfeG3OrG
Malware Config
Signatures
Files
-
347fc355c3ee5eaa2fb69de47da21995806bb7036ae87ce6d15e67557eab8093.exe windows x86
f7b0967943ec5a8dd7f2c0a07a3ea158
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpynA
SetThreadPriority
GetCurrentThread
CloseHandle
GlobalMemoryStatus
GetStartupInfoA
GetModuleHandleA
DeleteFileA
GetProcAddress
GetCurrentProcess
GetCurrentThreadId
OutputDebugStringA
CreateThread
ExitThread
Sleep
GetTickCount
LoadLibraryA
user32
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
OpenWindowStationA
GetThreadDesktop
GetProcessWindowStation
CloseWindowStation
CloseDesktop
wsprintfA
GetSystemMetrics
gdi32
CreateDCA
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDIBits
DeleteDC
DeleteObject
advapi32
RegOpenKeyExA
msvcrt
_acmdln
malloc
_itoa
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
rand
printf
srand
time
strncpy
strcspn
strstr
atoi
sprintf
strchr
strncat
__CxxFrameHandler
_CxxThrowException
_except_handler3
??2@YAPAXI@Z
??3@YAXPAX@Z
_ftol
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
free
__getmainargs
_initterm
ws2_32
htons
WSAStartup
htonl
socket
WSACleanup
setsockopt
WSASocketA
send
gethostname
shutdown
connect
sendto
inet_addr
gethostbyname
inet_ntoa
closesocket
Sections
.text Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE