Static task
static1
Behavioral task
behavioral1
Sample
0972bd76d7ffbc77a110b62a6aca20c3fb3d9da4c84a7b06b371571874d370e8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0972bd76d7ffbc77a110b62a6aca20c3fb3d9da4c84a7b06b371571874d370e8.exe
Resource
win10v2004-20221111-en
General
-
Target
0972bd76d7ffbc77a110b62a6aca20c3fb3d9da4c84a7b06b371571874d370e8
-
Size
304KB
-
MD5
3734e10d8bd5c2833814811f08f0b5f6
-
SHA1
0ba78d9c61dbccf3cd97dbd2b21daa8cf4ff7591
-
SHA256
0972bd76d7ffbc77a110b62a6aca20c3fb3d9da4c84a7b06b371571874d370e8
-
SHA512
8d202f618c60b7265fd8cb33bce279bd3527c746726a9d12b42de91e94d8157ee904b38fd146cce3f41d274ccd4ecc96fb72edf93d73fe410b2201d62907428d
-
SSDEEP
6144:aNM7fZtBfbFDIYfN7W2OKX0+3Wec2amXbtkRsuT+3AW:mifBfbmkN71HJJb45B
Malware Config
Signatures
Files
-
0972bd76d7ffbc77a110b62a6aca20c3fb3d9da4c84a7b06b371571874d370e8.exe windows x86
ff59ee45b2116990841dffeffc1f9063
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindVolumeClose
GetPrivateProfileIntW
InterlockedExchange
ResumeThread
GlobalSize
CreateEventA
CloseHandle
LocalFree
GetACP
lstrlenA
ResetEvent
VirtualAlloc
GetCommandLineA
GlobalFree
GetEnvironmentVariableW
GetModuleHandleW
GetStdHandle
WriteFile
GetExitCodeProcess
CreateMutexA
advapi32
IsTextUnicode
CloseEventLog
RegCreateKeyExW
CreateServiceA
RegDeleteKeyA
ControlService
RegCloseKey
IsValidSid
RegEnumKeyW
IsValidAcl
RegDeleteValueA
ClearEventLogA
RegQueryValueW
admparse
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
AdmClose
appwiz.cpl
ConfigStartMenu
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 295KB - Virtual size: 294KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ