Static task
static1
Behavioral task
behavioral1
Sample
57440e3993568eb33159d12fdd04381b0e1f40dbdddca79d4b2a0628b2f22864.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
57440e3993568eb33159d12fdd04381b0e1f40dbdddca79d4b2a0628b2f22864.exe
Resource
win10v2004-20221111-en
General
-
Target
57440e3993568eb33159d12fdd04381b0e1f40dbdddca79d4b2a0628b2f22864
-
Size
30KB
-
MD5
02afa46e014d823a4d08344af2cd12b9
-
SHA1
dfd82acc9d7efca85d5202cc36dbd28e09aade57
-
SHA256
57440e3993568eb33159d12fdd04381b0e1f40dbdddca79d4b2a0628b2f22864
-
SHA512
b58bc94edc948ffafb4829ee882d82ab08894ceb28c5f1a560d08907601ba4f10e82fe0eb8db53980ce86cfd76bb1cc6842e6edef27ce3b0bc77e465719a1955
-
SSDEEP
768:fbN69mLJ2m/u45l6S4G5DOKjXNef1kyi9grTEi:fbLIm/u45l6S5JO+XNef11iUT
Malware Config
Signatures
Files
-
57440e3993568eb33159d12fdd04381b0e1f40dbdddca79d4b2a0628b2f22864.exe windows x86
b7de0b66ab7fae8261dfcaad84eab7a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
adsldpc
ADsFreeColumn
msvcrt
isxdigit
_adjust_fdiv
strncpy
bsearch
_initterm
_wcsnicmp
strncmp
_ltow
memmove
wcschr
atol
_ltoa
__dllonexit
wcslen
wcscpy
isdigit
wcscat
_snprintf
malloc
_ultoa
memcpy
_wcsicmp
free
_onexit
isupper
wcscmp
qsort
_except_handler3
_snwprintf
sprintf
strtoul
_itow
kernel32
CompareStringA
lstrlenA
GetTempPathA
SystemTimeToFileTime
EnterCriticalSection
TerminateProcess
ReleaseMutex
SetUnhandledExceptionFilter
GetTimeFormatA
UnmapViewOfFile
FreeLibrary
CreateFileA
GetFileAttributesA
OpenMutexW
GetComputerNameA
GetSystemDefaultLangID
lstrlenW
GetFileAttributesW
CompareFileTime
GetVersionExA
TlsGetValue
MultiByteToWideChar
GetLocalTime
CreateMutexA
TlsAlloc
PulseEvent
ExitThread
FindNextFileA
InterlockedIncrement
GetDateFormatW
WaitForSingleObjectEx
SetEvent
ExpandEnvironmentStringsA
LocalReAlloc
WaitForSingleObject
ReadFile
lstrcmpA
CompareStringW
OpenFileMappingW
lstrcpyA
FindFirstFileW
ExpandEnvironmentStringsW
TlsFree
GetTimeFormatW
CreateThread
GetCurrentThreadId
GetCurrentThread
CreateDirectoryA
DuplicateHandle
DeleteFileA
SetEndOfFile
GetTickCount
InterlockedCompareExchange
GetComputerNameW
GetTempFileNameA
GetLastError
OutputDebugStringA
SetFilePointer
MapViewOfFile
DeleteCriticalSection
TlsSetValue
GetSystemTime
FindFirstChangeNotificationW
FormatMessageA
SetFileAttributesA
VirtualAlloc
FindFirstChangeNotificationA
FindCloseChangeNotification
GetFileAttributesExW
LocalAlloc
FreeLibraryAndExitThread
LoadLibraryA
DeleteFileW
GetFileSize
LeaveCriticalSection
FileTimeToSystemTime
GetEnvironmentVariableA
Sleep
LocalFree
CreateEventA
GetSystemTimeAsFileTime
LoadLibraryExW
SetLastError
GetProcAddress
GetDateFormatA
QueryPerformanceCounter
OpenEventA
CreateMutexW
SetFileAttributesW
UnhandledExceptionFilter
CreateFileMappingA
WaitForMultipleObjectsEx
DelayLoadFailureHook
LocalSize
InitializeCriticalSection
InterlockedExchange
CloseHandle
FindClose
WideCharToMultiByte
CreateFileW
GetUserDefaultLCID
GetCurrentProcess
FindNextChangeNotification
OpenMutexA
InterlockedDecrement
CreateDirectoryW
GetModuleFileNameW
FileTimeToLocalFileTime
GetCurrentProcessId
WriteFile
LoadLibraryExA
CreateFileMappingW
lstrcatA
FormatMessageW
GetACP
GetModuleFileNameA
GetModuleHandleA
FindNextFileW
user32
MessageBoxA
GetProcessDefaultLayout
LoadStringA
wsprintfA
GetSystemMetrics
wsprintfW
MessageBoxW
LoadStringW
advapi32
CryptCreateHash
RegSetValueExW
QueryServiceStatus
CryptGetHashParam
CryptSetKeyParam
InitializeSecurityDescriptor
CryptGetDefaultProviderW
RegDeleteValueA
StartServiceA
OpenServiceW
StartServiceW
RegDeleteKeyW
OpenSCManagerW
RegQueryInfoKeyW
MD5Final
FreeSid
SystemFunction040
CryptGetKeyParam
CryptSetProviderA
MD5Init
RegCreateKeyExA
SetSecurityDescriptorGroup
EqualSid
CryptDestroyHash
InitializeAcl
RegEnumValueA
RegSetValueExA
GetLengthSid
A_SHAFinal
MD5Update
CryptSignHashA
RegQueryInfoKeyA
RegEnumKeyA
GetSidIdentifierAuthority
CryptReleaseContext
IsValidSid
A_SHAInit
RegEnumValueW
ControlService
RegConnectRegistryA
CryptAcquireContextA
OpenThreadToken
CryptSetProvParam
GetSidSubAuthorityCount
RegConnectRegistryW
RegEnumKeyExW
RegDeleteKeyA
RegCreateKeyExW
CopySid
RegDeleteValueW
GetUserNameW
SetSecurityDescriptorOwner
LsaNtStatusToWinError
CryptGetUserKey
CryptImportKey
LookupAccountSidW
GetSecurityDescriptorOwner
GetSidSubAuthority
GetTokenInformation
RegCloseKey
A_SHAUpdate
AllocateAndInitializeSid
RegNotifyChangeKeyValue
CryptHashData
RegOpenKeyExW
CryptGetProvParam
AddAccessAllowedAce
CloseServiceHandle
ChangeServiceConfigA
UnlockServiceDatabase
AdjustTokenPrivileges
CryptDestroyKey
RegQueryValueExA
CryptSetHashParam
RegQueryValueExW
LockServiceDatabase
QueryServiceConfigA
SetSecurityDescriptorDacl
RegEnumKeyExA
CryptExportKey
CryptGenKey
CryptDeriveKey
LookupPrivilegeValueA
CryptEncrypt
OpenProcessToken
CryptVerifySignatureA
RegSetKeySecurity
CryptDecrypt
RegOpenKeyExA
CryptGenRandom
GetAce
SystemFunction041
RegGetKeySecurity
GetSecurityDescriptorDacl
GetUserNameA
msasn1
ASN1BERDecEndOfContents
ASN1_CloseEncoder
ASN1BERDecCharString
ASN1BERDecPeekTag
ASN1BERDecBool
ASN1_CreateModule
ASN1objectidentifier2_cmp
ASN1CEREncUTCTime
ASN1BERDecU32Val
ASN1BEREncEndOfContents
ASN1_SetEncoderOption
ASN1BERDecUTF8String
ASN1BEREncU32
ASN1BERDecOpenType
ASN1intx_free
ASN1CEREncNewBlkElement
ASN1BEREoid2DotVal
ASN1CEREncBeginBlk
ASN1BERDecObjectIdentifier2
ASN1DecSetError
ASN1CEREncGeneralizedTime
ASN1bitstring_free
ASN1DecRealloc
ASN1BERDecChar16String
ASN1open_free
ASN1BERDecOpenType2
ASN1BEREncBool
ASN1BEREncOctetString
ASN1BERDecOctetString
ASN1BEREncChar32String
ASN1_CreateDecoder
ASN1char16string_free
ASN1utf8string_free
ASN1_Encode
ASN1_FreeEncoded
ASN1BEREncOpenType
ASN1BEREncChar16String
ASN1Free
ASN1BEREncObjectIdentifier2
ASN1BERDecMultibyteString
ASN1CEREncEndBlk
ASN1BEREncCharString
ASN1BERDecEoid
ASN1BERDecBitString
ASN1BEREncMultibyteString
ASN1BERDecSXVal
ASN1char32string_free
ASN1BERDecBitString2
ASN1BERDecNotEndOfContents
ASN1_CreateEncoder
ASN1BERDotVal2Eoid
ASN1BERDecS32Val
ASN1BEREoid_free
ASN1BERDecChar32String
ASN1_CloseModule
ASN1BEREncEoid
ASN1_CloseDecoder
ASN1BERDecUTCTime
ASN1_Decode
ASN1BEREncUTF8String
ASN1BEREncExplicitTag
ASN1_FreeDecoded
ASN1BERDecZeroCharString
ASN1EncSetError
ASN1BERDecOctetString2
ASN1octetstring_free
ASN1ztcharstring_free
ASN1CEREncFlushBlkElement
ASN1BEREncS32
ASN1BEREncBitString
ASN1BEREncSX
ASN1BERDecGeneralizedTime
ASN1BERDecExplicitTag
ASN1charstring_free
rpcrt4
RpcEpResolveBinding
RpcStringFreeW
RpcStringBindingComposeW
RpcStringBindingComposeA
RpcStringFreeA
RpcBindingFromStringBindingW
UuidToStringA
RpcImpersonateClient
RpcRevertToSelf
NdrClientCall2
RpcBindingFromStringBindingA
UuidCreate
RpcBindingSetAuthInfoExW
RpcBindingFree
Sections
.textbss Size: - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 512B - Virtual size: 416B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 196B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE