Static task
static1
Behavioral task
behavioral1
Sample
6ceea245b7f76a35739e4ba796224c085a9fb7d507c898ff202ee2e1dbc766d2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6ceea245b7f76a35739e4ba796224c085a9fb7d507c898ff202ee2e1dbc766d2.exe
Resource
win10v2004-20220812-en
General
-
Target
6ceea245b7f76a35739e4ba796224c085a9fb7d507c898ff202ee2e1dbc766d2
-
Size
863KB
-
MD5
101cc844951740577220354b7232d73c
-
SHA1
17b11ca7b965978e35a2764705ed8979fe563425
-
SHA256
6ceea245b7f76a35739e4ba796224c085a9fb7d507c898ff202ee2e1dbc766d2
-
SHA512
5bc176181301dd8fc8e992e97aa4ed8bde465da6259129e12c7509db661adf1dba47603027ee2e7e88e7669042ab530810231914752d8d144b094e0d63dbbbdd
-
SSDEEP
24576:Y3Yw0iH9CAtEoMdcgUnIcvx58w0lotfsO+mcb:+0i6uBnIEP0loJsMc
Malware Config
Signatures
Files
-
6ceea245b7f76a35739e4ba796224c085a9fb7d507c898ff202ee2e1dbc766d2.exe windows x86
f51af8ccbdc2909c681606b4c4485d0a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt40
_rotl
??_7strstreambuf@@6B@
??0filebuf@@QAE@H@Z
??4ifstream@@QAEAAV0@ABV0@@Z
_getws
_mbctype
_stat
_stricmp
?setb@streambuf@@IAEXPAD0H@Z
?setbuf@strstreambuf@@UAEPAVstreambuf@@PADH@Z
_gcvt
_CIasin
_fstat
_creat
??_7iostream@@6B@
wcstombs
_execlpe
putwc
?ignore@istream@@QAEAAV1@HH@Z
_assert
_getmaxstdio
abs
??4ostream_withassign@@QAEAAVostream@@PAVstreambuf@@@Z
??_Estrstreambuf@@UAEPAXI@Z
free
?snextc@streambuf@@QAEHXZ
?sputn@streambuf@@QAEHPBDH@Z
??1istream@@UAE@XZ
_get_osfhandle
?fd@fstream@@QBEHXZ
?close@filebuf@@QAEPAV1@XZ
_ismbcalpha
??_8fstream@@7Bostream@@@
??_Dostream_withassign@@QAEXXZ
_ismbchira
??_Gexception@@UAEPAXI@Z
_heapset
?setbuf@fstream@@QAEPAVstreambuf@@PADH@Z
__p__winmajor
_mbschr
_copysign
_strnicoll
?rdbuf@ifstream@@QBEPAVfilebuf@@XZ
?read@istream@@QAEAAV1@PAEH@Z
?rdbuf@ofstream@@QBEPAVfilebuf@@XZ
_wcsnset
?blen@streambuf@@IBEHXZ
??Bios@@QBEPAXXZ
??4filebuf@@QAEAAV0@ABV0@@Z
??0istream_withassign@@QAE@ABV0@@Z
_j1
??0ios@@IAE@XZ
??0ofstream@@QAE@XZ
??_Dostrstream@@QAEXXZ
_rotr
__iscsym
freopen
?sync@filebuf@@UAEHXZ
__threadhandle
wcscmp
_dup
localeconv
?good@ios@@QBEHXZ
??3@YAXPAX@Z
??2@YAPAXI@Z
?writepad@ostream@@AAEAAV1@PBD0@Z
_wtempnam
?seekoff@filebuf@@UAEJJW4seek_dir@ios@@H@Z
__p__wenviron
??4istream@@IAEAAV0@PAVstreambuf@@@Z
??_Dstdiostream@@QAEXXZ
_wfindfirst
_endthreadex
kernel32
GetCurrentConsoleFont
FindFirstFileA
GetUserDefaultLCID
SetFileAttributesW
GetThreadPriority
SetLocalPrimaryComputerNameW
OpenMutexW
GetACP
GetSystemDefaultLangID
WaitForSingleObjectEx
FreeEnvironmentStringsA
HeapLock
GetSystemDirectoryW
GetSystemDefaultLCID
BaseUpdateAppcompatCache
CreateFileA
GetStartupInfoW
Module32Next
AllocateUserPhysicalPages
GetProfileSectionA
DisconnectNamedPipe
GlobalUnfix
SetThreadExecutionState
GetStartupInfoA
GetDevicePowerState
GetDiskFreeSpaceExA
DebugBreakProcess
QueryInformationJobObject
DeviceIoControl
VirtualAlloc
VirtualAllocEx
GetProcessPriorityBoost
Heap32ListFirst
LoadLibraryA
BindIoCompletionCallback
Heap32ListNext
GetVolumeInformationW
TransactNamedPipe
CreateMailslotW
GetNumaAvailableMemoryNode
SetupComm
shlwapi
PathFindExtensionA
SHOpenRegStream2W
PathCanonicalizeW
PathIsUNCServerA
UrlCombineA
StrFromTimeIntervalW
StrCatChainW
wnsprintfA
StrStrA
StrFormatKBSizeA
StrCpyNW
SHQueryValueExW
SHSetThreadRef
SHRegSetPathW
StrPBrkW
PathSetDlgItemPathW
wvnsprintfA
SHRegCreateUSKeyA
SHDeleteEmptyKeyA
PathBuildRootW
SHRegEnumUSValueW
StrCmpW
SHRegDeleteEmptyUSKeyA
PathFindOnPathW
StrRChrW
SHAutoComplete
StrIsIntlEqualW
SHRegGetPathA
PathIsLFNFileSpecW
PathCompactPathA
PathIsContentTypeA
UrlIsNoHistoryA
AssocQueryKeyW
StrCSpnIW
SHEnumValueA
PathRemoveFileSpecW
SHDeleteOrphanKeyW
SHSkipJunction
msdart
?SetDefaultSpinCount@CSpinLock@@SGXG@Z
?IsReadUnlocked@CReaderWriterLock3@@QBE_NXZ
?TryReadLock@CReaderWriterLock3@@QAE_NXZ
?ConvertExclusiveToShared@CLKRLinearHashTable@@QBEXXZ
?GetSpinCount@CReaderWriterLock3@@QBEGXZ
?IsWin98@CMdVersionInfo@@SAHXZ
?_WriteLockSpin@CReaderWriterLock2@@AAEXXZ
?GetSpinCount@CSpinLock@@QBEGXZ
?sm_llGlobalList@CLKRHashTable@@0VCLockedDoubleList@@A
?sm_wDefaultSpinCount@CReaderWriterLock2@@1GA
?ReleaseVersionInfo@CMdVersionInfo@@SAXXZ
?IsWriteLocked@CCritSec@@QBE_NXZ
??0CSmallSpinLock@@QAE@XZ
?ReadLock@CReaderWriterLock@@QAEXXZ
mpMalloc
?_TryReadLock@CReaderWriterLock3@@AAE_NXZ
?SetDefaultSpinCount@CFakeLock@@SGXG@Z
?GetDefaultSpinCount@CReaderWriterLock3@@SGGXZ
?ReadOrWriteLock@CReaderWriterLock3@@QAE_NXZ
?_ReadOrWriteUnlock@CLKRLinearHashTable@@ABEX_N@Z
??1CSmallSpinLock@@QAE@XZ
MPInitializeCriticalSection
?SetDefaultSpinAdjustmentFactor@CSmallSpinLock@@SGXN@Z
?WriteUnlock@CSpinLock@@QAEXXZ
?_CmpExch@CReaderWriterLock3@@AAE_NJJ@Z
??0CLKRHashTableStats@@QAE@XZ
?IsEmpty@CSingleList@@QBE_NXZ
??4CCritSec@@QAEAAV0@ABV0@@Z
?TryReadLock@CReaderWriterLock@@QAE_NXZ
?ReadOrWriteLock@CFakeLock@@QAE_NXZ
?ReadOrWriteUnlock@CCritSec@@QAEX_N@Z
?IsReadUnlocked@CLKRHashTable@@QBE_NXZ
?_ReadLockSpin@CReaderWriterLock3@@AAEXW4SPIN_TYPE@1@@Z
?MaxSize@CLKRLinearHashTable@@QBEKXZ
?IsWriteUnlocked@CReaderWriterLock@@QBE_NXZ
?WriteLock@CCritSec@@QAEXXZ
??1CDoubleList@@QAE@XZ
?RemoveHead@CDoubleList@@QAEQAVCListEntry@@XZ
?IsWriteLocked@CLKRLinearHashTable@@QBE_NXZ
MPInitializeCriticalSectionAndSpinCount
?IsReadUnlocked@CSpinLock@@QBE_NXZ
?_FindRecord@CLKRLinearHashTable@@ABE?AW4LK_RETCODE@@PBXK@Z
?_SegIndex@CLKRLinearHashTable@@ABEKK@Z
user32
DialogBoxParamA
EnumDisplaySettingsA
SetWindowLongW
EnumDesktopsW
GetRegisteredRawInputDevices
UserRegisterWowHandlers
GetDoubleClickTime
RemovePropW
CopyImage
GetAsyncKeyState
PaintMenuBar
BroadcastSystemMessageW
CountClipboardFormats
GetKeyboardLayoutNameA
SystemParametersInfoW
OpenIcon
RegisterTasklist
SetWindowsHookExW
LoadStringW
DrawTextA
GetKeyboardLayoutList
RegisterWindowMessageA
FindWindowExA
EnumPropsExW
KillTimer
MapWindowPoints
SwitchToThisWindow
BroadcastSystemMessageExW
EnumWindows
InternalGetWindowText
ChangeMenuA
CharToOemBuffA
WindowFromPoint
SubtractRect
LoadRemoteFonts
ArrangeIconicWindows
EnumClipboardFormats
SendMessageW
Sections
.tixt Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 314KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ