Static task
static1
Behavioral task
behavioral1
Sample
d86fe24de4393ea4c5883d06427ac9c83d2dd976115f026907a0902c2ff82db9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d86fe24de4393ea4c5883d06427ac9c83d2dd976115f026907a0902c2ff82db9.exe
Resource
win10v2004-20220901-en
General
-
Target
d86fe24de4393ea4c5883d06427ac9c83d2dd976115f026907a0902c2ff82db9
-
Size
866KB
-
MD5
407294eaafa3804703a2446cf7a3b009
-
SHA1
d18775783546a72226136e3194c15a3809f8e1e6
-
SHA256
d86fe24de4393ea4c5883d06427ac9c83d2dd976115f026907a0902c2ff82db9
-
SHA512
b560c2d8d1b82e6f84ef5b3552f8b80da9af461967ac31f5ece5fecf02d8b2f642d11be2edad4229762e6da0603ff6059f5fb85beebaeb625f2d33ee0191b6b6
-
SSDEEP
24576:7sL8PROuwQOWltUpn88pBvsf1RUqgVYBlIIrxeYF:75Rlg8tU86ydWqguBxei
Malware Config
Signatures
Files
-
d86fe24de4393ea4c5883d06427ac9c83d2dd976115f026907a0902c2ff82db9.exe windows x86
2c1103007cb831db058903cb3fea044d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
query
?WritePrimaryProperty@CPropStoreManager@@QAEJKKABVCStorageVariant@@@Z
?MakePrivileged@CImpersonateSystem@@AAEXXZ
?DumpWorkId@@YGJPBGKPAEAAK00K@Z
??0CGetDbProps@@QAE@XZ
?PutWString@CDbCmdTreeNode@@SGXAAVPSerStream@@PBG@Z
?MakePath@CFullPath@@QAEXPBGI@Z
??0CPropertyRestriction@@QAE@KABVCFullPropSpec@@ABVCStorageVariant@@@Z
??1CPhraseRestriction@@QAE@XZ
??1CDbSortSet@@QAE@XZ
?ParseExpression@CParseCommandTree@@QAEPAVCRestriction@@PAVCDbCmdTreeNode@@@Z
?Marshall@CContentRestriction@@QBEXAAVPSerStream@@@Z
DoneFILTERPerformanceData
?SetPhrase@CNatLanguageRestriction@@QAEXPBG@Z
?SetProperties@CDbProperties@@UAGJKQAUtagDBPROPSET@@@Z
?Release@CImpersonateRemoteAccess@@QAEXXZ
?ChangeCurrentScope@CCatState@@QAEXPBG@Z
??1CInternalPropertyRestriction@@QAE@XZ
?MakeISearch@@YGJPAPAUISearchQueryHits@@PAVCDbRestriction@@PBG@Z
?SetNumberOfSortProps@CCatState@@QAEXI@Z
_LoadBHIFilter@16
?QuerySdidLookupTable@CiStorage@@QAEPAVPRcovStorageObj@@K@Z
?ResetBuffer@CQueryScanner@@QAEXPBG@Z
?Commit@CRcovStrmMDTrans@@QAEXXZ
?BorrowNewBuffer@CPhysStorage@@QAEPAKK@Z
??0CDbNatLangRestriction@@QAE@PBGABVCDbColumnNode@@K@Z
?GetGlobalStaticPropertyList@@YGPAVCStaticPropertyList@@XZ
??1CDFA@@QAE@XZ
?GetLocation@CCatalogAdmin@@QAEPBGXZ
?GetOffset@CKeyDeComp@@QAEXAAUBitOffset@@@Z
?Find@CCombinedPropertyList@@UAEPBVCPropEntry@@PBG@Z
?GetTotalSizeInKB@CPropStoreManager@@QAEKXZ
??0CPropNameArray@@QAE@I@Z
??1CColumns@@QAE@XZ
?SkipLong@CMemDeSerStream@@UAEXXZ
?DecodeHtmlNumeric@@YGXPAG@Z
?ParseCatalogURL@@YGJPBGAAV?$XPtrST@G@@1@Z
?AddArg@CFwEventItem@@QAEXPBG@Z
?AddRef@CFwPropertyMapper@@UAGKXZ
?DataWriteRead@CRequestClient@@QAEXPAXK0KAAK@Z
??1CCatalogAdmin@@QAE@XZ
?GetFloat@CMemDeSerStream@@UAEMXZ
??1CPropertyStoreWids@@QAE@XZ
?Write@CDynStream@@QAEXPAXK@Z
?Clone@CDbCmdTreeNode@@QBEPAV1@H@Z
clbcatq
InprocServer32FromString
GetSimpleTableDispenser
ComPlusMigrate
ServerGetApplicationType
OpenComponentLibraryOnStreamEx
UpdateFromComponentChange
CreateComponentLibraryEx
CoRegCleanup
ActivatorUpdateForIsRouterChanges
CLSIDFromStringByBitness
GetCatalogObject
GetCatalogObject2
GetComputerObject
DowngradeAPL
OpenComponentLibraryEx
UpdateFromAppChange
SetupOpen
CheckMemoryGates
SetSetupSave
SetupSave
DllGetClassObject
DeleteAllActivatorsForClsid
OpenComponentLibraryOnMemEx
SetSetupOpen
msvcrt40
_ismbcalpha
??6ostream@@QAEAAV0@F@Z
_ismbcspace
getc
_ismbcl2
_timezone
??4ostream_withassign@@QAEAAVostream@@ABV1@@Z
_swab
??_Distrstream@@QAEXXZ
_ismbcpunct
??4Iostream_init@@QAEAAV0@ABV0@@Z
_mbscmp
_yn
?sputn@streambuf@@QAEHPBDH@Z
?seekoff@filebuf@@UAEJJW4seek_dir@ios@@H@Z
??7ios@@QBEHXZ
?cerr@@3Vostream_withassign@@A
??0ofstream@@QAE@HPADH@Z
?setbuf@strstreambuf@@UAEPAVstreambuf@@PADH@Z
??_7ofstream@@6B@
_pwctype
??_Dstrstream@@QAEXXZ
??0ofstream@@QAE@ABV0@@Z
_wfindfirsti64
?underflow@strstreambuf@@UAEHXZ
_wsearchenv
_wtempnam
?pword@ios@@QBEAAPAXH@Z
vsprintf
$I10_OUTPUT
?dec@@YAAAVios@@AAV1@@Z
?pcount@ostrstream@@QBEHXZ
free
??_Gbad_cast@@UAEPAXI@Z
_wstrtime
??1istream@@UAE@XZ
?x_statebuf@ios@@0PAJA
_mbbtype
_wrmdir
_strnicmp
_purecall
?rdbuf@stdiostream@@QBEPAVstdiobuf@@XZ
??1istream_withassign@@UAE@XZ
??0ostream@@IAE@ABV0@@Z
??_8fstream@@7Bistream@@@
_cwait
?unbuffered@streambuf@@IBEHXZ
_mbsinc
_fgetwchar
__argc
div
_controlfp
_wfindfirst
_findfirst
localeconv
_adj_fdivr_m32i
__wargv
??4logic_error@@QAEAAV0@ABV0@@Z
_CIpow
raise
??4filebuf@@QAEAAV0@ABV0@@Z
??4strstreambuf@@QAEAAV0@ABV0@@Z
??_Eostream@@UAEPAXI@Z
??_Eofstream@@UAEPAXI@Z
printf
??_8stdiostream@@7Bistream@@@
_snprintf
_getdrives
??1strstreambuf@@UAE@XZ
_mbsnccnt
_wpgmptr
rpcns4
RpcNsGroupMbrInqDone
RpcNsEntryObjectInqBeginW
RpcNsGroupMbrRemoveW
RpcNsMgmtHandleSetExpAge
RpcNsBindingUnexportW
RpcNsProfileEltRemoveA
RpcNsBindingExportPnPW
RpcNsProfileEltInqNextW
RpcNsMgmtSetExpAge
RpcNsBindingImportNext
RpcNsMgmtEntryDeleteW
RpcNsGroupMbrInqBeginW
RpcNsMgmtEntryCreateW
RpcNsMgmtBindingUnexportW
RpcNsBindingUnexportA
RpcNsEntryObjectInqNext
I_RpcNsSendReceive
RpcNsProfileEltAddA
RpcNsProfileEltInqBeginW
RpcNsGroupMbrRemoveA
RpcNsMgmtEntryCreateA
RpcNsBindingImportBeginW
RpcIfIdVectorFree
I_RpcNsGetBuffer
RpcNsBindingImportDone
RpcNsProfileEltRemoveW
RpcNsProfileEltInqBeginA
RpcNsBindingLookupDone
RpcNsBindingExportA
RpcNsBindingLookupBeginA
RpcNsGroupMbrInqBeginA
RpcNsMgmtEntryDeleteA
RpcNsMgmtEntryInqIfIdsW
RpcNsProfileDeleteA
RpcNsMgmtInqExpAge
RpcNsGroupDeleteW
I_RpcNsNegotiateTransferSyntax
RpcNsBindingExportPnPA
RpcNsEntryObjectInqBeginA
RpcNsGroupMbrAddW
RpcNsProfileEltAddW
RpcNsProfileEltInqDone
RpcNsGroupDeleteA
untfs
?QueryVolumeFlagsAndLabel@NTFS_SA@@QAEGPAE00PAVWSTRING@@@Z
?AddExtent@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@00@Z
FormatEx
?QueryLcnFromVcn@NTFS_EXTENT_LIST@@QBEEVBIG_INT@@PAV2@1@Z
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEVBIG_INT@@PAVNTFS_MASTER_FILE_TABLE@@@Z
??1NTFS_ATTRIBUTE_RECORD@@UAE@XZ
?Flush@NTFS_MFT_FILE@@QAEEXZ
?QueryDefaultClustersPerIndexBuffer@NTFS_SA@@SGKPBVDP_DRIVE@@K@Z
?ReadSet@NTFS_FRS_STRUCTURE@@QAEEPAVTLINK@@@Z
?Initialize@NTFS_BAD_CLUSTER_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?QueryExtent@NTFS_EXTENT_LIST@@QBEEKPAVBIG_INT@@00@Z
?AddFileNameAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAU_FILE_NAME@@@Z
?QueryEntry@NTFS_INDEX_TREE@@QAEEKPAXKPAPAU_INDEX_ENTRY@@PAPAVNTFS_INDEX_BUFFER@@PAE@Z
?QuerySegmentReference@NTFS_MFT_INFO@@SG?AU_MFT_SEGMENT_REFERENCE@@PAX@Z
Extend
??1NTFS_BITMAP@@UAE@XZ
?Initialize@NTFS_MFT_INFO@@QAEEXZ
Chkdsk
?Write@NTFS_BITMAP@@QAEEPAVNTFS_ATTRIBUTE@@PAV1@@Z
?AddSecurityDescriptor@NTFS_FILE_RECORD_SEGMENT@@QAEEW4_CANNED_SECURITY_TYPE@@PAVNTFS_BITMAP@@@Z
?QueryAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAEKPBVWSTRING@@@Z
??0NTFS_LOG_FILE@@QAE@XZ
??1NTFS_ATTRIBUTE_DEFINITION_TABLE@@UAE@XZ
?IsFree@NTFS_BITMAP@@QBEEVBIG_INT@@0@Z
??1NTFS_UPCASE_TABLE@@UAE@XZ
?QueryName@NTFS_ATTRIBUTE_RECORD@@QBEEPAVWSTRING@@@Z
?Initialize@NTFS_REFLECTED_MASTER_FILE_TABLE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?NtfsUpcaseCompare@@YGJPBGK0KPBVNTFS_UPCASE_TABLE@@E@Z
?Initialize@NTFS_BITMAP_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?QueryAttributeListAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAE@Z
??0NTFS_BITMAP_FILE@@QAE@XZ
?CompareFileName@NTFS_MFT_INFO@@SGEPAXKPAU_FILE_NAME@@PAG@Z
kernel32
CloseHandle
SetNamedPipeHandleState
ReadConsoleOutputAttribute
lstrcat
BeginUpdateResourceA
CompareStringA
AttachConsole
LocalAlloc
GetSystemDefaultUILanguage
BuildCommDCBA
SetCriticalSectionSpinCount
CreateActCtxW
FlushInstructionCache
RtlCaptureContext
GetLocaleInfoW
GetFileAttributesA
DeleteTimerQueueTimer
SetFirmwareEnvironmentVariableA
Module32First
IsDBCSLeadByte
GetProcessShutdownParameters
CreatePipe
BackupWrite
ReadConsoleOutputA
lstrcmpiA
GetBinaryTypeW
TzSpecificLocalTimeToSystemTime
WriteConsoleOutputW
RtlMoveMemory
HeapCreate
VirtualAlloc
OpenFileMappingA
SetThreadUILanguage
FindAtomA
HeapSummary
CancelWaitableTimer
GetSystemTimeAsFileTime
GetVolumePathNameA
UnlockFile
LoadLibraryA
GlobalHandle
Sections
.text Size: 342KB - Virtual size: 342KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 298KB - Virtual size: 298KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ