Static task
static1
Behavioral task
behavioral1
Sample
c472304380527977ce5b1f2819d8bded8a5b9bd0e70cc0dff31d29f993a63238.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c472304380527977ce5b1f2819d8bded8a5b9bd0e70cc0dff31d29f993a63238.exe
Resource
win10v2004-20221111-en
General
-
Target
c472304380527977ce5b1f2819d8bded8a5b9bd0e70cc0dff31d29f993a63238
-
Size
32KB
-
MD5
be9e81ad36205776ff33dece60ab7c22
-
SHA1
695c3679be6fb8e7b2ab24894a08a985939180d2
-
SHA256
c472304380527977ce5b1f2819d8bded8a5b9bd0e70cc0dff31d29f993a63238
-
SHA512
5e51c62ce70258fd451d32ef847ab738ef87e75b6678a3cfcda86f5f7c8cbd498bee5d73a8849c31133d82033c1441434ab18f14d356c64665c65bd5e3970e51
-
SSDEEP
768:BP0M7mfPc+dRK0oP7sLpcWxZcnXsCx8vMIb:+M7qPc4oPyjcTivMw
Malware Config
Signatures
Files
-
c472304380527977ce5b1f2819d8bded8a5b9bd0e70cc0dff31d29f993a63238.exe windows x86
4d138c7055438a949ef2423004463987
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AreAllAccessesGranted
UnlockServiceDatabase
StopTraceA
UpdateTraceA
BuildTrusteeWithNameA
I_ScSetServiceBitsW
InitializeSecurityDescriptor
RegCreateKeyA
EqualDomainSid
AddUsersToEncryptedFile
RegDeleteValueA
QueryServiceStatus
RegCreateKeyExW
CryptEnumProviderTypesW
WmiMofEnumerateResourcesW
LookupPrivilegeNameW
CredpConvertTargetInfo
LsaGetQuotasForAccount
WmiOpenBlock
NotifyChangeEventLog
ChangeServiceConfigW
GetEventLogInformation
EnumerateTraceGuids
MSChapSrvChangePassword2
AddAce
mprapi
MprAdminServerGetCredentials
MprDomainQueryRasServer
MprInfoBlockRemove
MprAdminBufferFree
MprAdminMIBEntryGetNext
MprAdminUpgradeUsers
MprConfigBufferFree
RasPrivilegeAndCallBackNumber
MprConfigInterfaceSetInfo
MprAdminIsServiceRunning
MprAdminUserOpen
MprAdminMIBEntrySet
MprAdminInterfaceUpdatePhonebookInfo
MprAdminDeviceEnum
MprAdminServerConnect
MprInfoDelete
MprAdminInterfaceDelete
MprConfigServerRefresh
MprAdminInterfaceSetCredentials
MprConfigServerBackup
MprAdminConnectionClearStats
MprConfigInterfaceCreate
MprAdminInterfaceDeviceGetInfo
MprAdminUserServerDisconnect
MprAdminUserReadProfFlags
MprAdminGetPDCServer
MprAdminEstablishDomainRasServer
MprAdminInterfaceGetCredentialsEx
MprConfigInterfaceTransportGetHandle
MprConfigTransportGetInfo
MprAdminInterfaceCreate
MprAdminUserServerConnect
MprAdminTransportSetInfo
MprConfigGetFriendlyName
MprAdminPortGetInfo
netapi32
NetServiceGetInfo
NetLocalGroupGetInfo
NetpMergeFtinfo
NetpInitFtinfoContext
NetApiBufferSize
NetpOpenConfigData
NetDfsGetInfo
NetpCopyFtinfoContext
NetEnumerateComputerNames
I_NetlogonComputeServerDigest
I_NetDatabaseDeltas
I_NetServerReqChallenge
NetLocalGroupAddMembers
I_BrowserQueryStatistics
NetDfsManagerSendSiteInfo
NetMessageBufferSend
I_NetLogonSamLogoff
NetDfsManagerGetConfigInfo
NetGroupGetInfo
I_NetDatabaseSync2
RxNetUserPasswordSet
NetLocalGroupGetMembers
NetWkstaUserGetInfo
NetReplSetInfo
NetLocalGroupSetMembers
DsGetDcNameWithAccountW
NetShareEnumSticky
NetEnumerateTrustedDomains
NetAuditWrite
NetAuditRead
NetAuditClear
opengl32
glMap1f
glIsList
glNewList
glEndList
glVertex4fv
glFrustum
glTexCoord2i
glCullFace
glPixelTransferi
glTexCoord3i
wglCopyContext
glVertex3i
glRectd
glCallLists
glColor3sv
glDrawElements
glMapGrid1d
glVertex4iv
glRasterPos2iv
glReadPixels
glColor3ui
glRotatef
GlmfBeginGlsBlock
wglDescribeLayerPlane
glColor3usv
glVertex3sv
glLoadMatrixf
glGetError
GlmfEndGlsBlock
glBitmap
glRectfv
glEvalMesh1
glGetMapiv
glColor4s
glColor4dv
glScissor
glGetIntegerv
glIndexubv
glIsEnabled
glIndexdv
glTexCoord3sv
rasapi32
RasGetCountryInfoW
RasGetErrorStringA
RasGetCustomAuthDataW
RasClearLinkStatistics
RasDialA
RasEnumDevicesA
DwEnumEntryDetails
RasGetCountryInfoA
RasValidateEntryNameW
RasGetSubEntryHandleW
RasSetEapUserDataW
RasGetAutodialEnableW
RasDeleteSubEntryA
RasGetProjectionInfoW
RasGetLinkStatistics
RasSetEntryPropertiesA
RasEnumEntriesA
RasEnumConnectionsA
RasScriptReceive
RasGetSubEntryPropertiesA
RasSetAutodialParamW
RasSetCustomAuthDataA
RasSetAutodialEnableA
RasSetSharedAutoDial
RasDeleteEntryA
RasDeleteEntryW
RasSetAutodialAddressW
RasAutodialAddressToNetwork
RasInvokeEapUI
RasScriptInit
DDMGetPhonebookInfo
RasScriptGetIpAddress
RasGetConnectStatusA
RasGetAutodialParamW
RasGetEapUserIdentityW
ntdll
RtlInitializeSListHead
NtSetQuotaInformationFile
ZwAccessCheckByTypeResultListAndAuditAlarmByHandle
LdrShutdownThread
RtlGetCurrentDirectory_U
NtFreeUserPhysicalPages
RtlTraceDatabaseFind
RtlTraceDatabaseLock
RtlAssert
RtlFindMessage
ZwSetInformationDebugObject
NtQueryPortInformationProcess
RtlCreateRegistryKey
NtDeviceIoControlFile
RtlFillMemory
DbgPrintEx
ZwQuerySystemTime
_ultow
wcsspn
LdrEnumResources
RtlReAllocateHeap
_strupr
ZwSetBootEntryOrder
ZwEnumerateKey
RtlTimeToSecondsSince1980
NtUnloadDriver
RtlDeleteAtomFromAtomTable
NtSetSystemEnvironmentValueEx
RtlIpv6AddressToStringW
ZwClearEvent
ZwOpenSemaphore
RtlAddVectoredExceptionHandler
RtlOemToUnicodeN
RtlAppendUnicodeToString
kernel32
GetNumaProcessorNode
GetTimeFormatA
VirtualAlloc
SetPriorityClass
RemoveDirectoryW
SetFirmwareEnvironmentVariableA
VirtualProtectEx
GetThreadLocale
CopyFileA
FreeEnvironmentStringsW
ConvertFiberToThread
DeleteAtom
TzSpecificLocalTimeToSystemTime
GetConsoleAliasExesLengthA
IsWow64Process
UnmapViewOfFile
GetLogicalDrives
GetThreadSelectorEntry
Sleep
lstrcpyA
WideCharToMultiByte
GetPrivateProfileSectionW
TryEnterCriticalSection
GetVersion
Beep
HeapFree
SetCalendarInfoA
GetCurrentThread
GetNextVDMCommand
GetOverlappedResult
msvcp60
?_Addstd@ios_base@std@@IAEXXZ
??4?$_Complex_base@M@std@@QAEAAV01@ABV01@@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??_F?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@JFF@Z
??Gstd@@YA?AV?$complex@M@0@ABV10@ABM@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??0?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE_NXZ
?widen@?$ctype@G@std@@QBEGD@Z
??8locale@std@@QBE_NABV01@@Z
??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?max_length@codecvt_base@std@@QBEHXZ
??_F?$moneypunct@G$0A@@std@@QAEXXZ
?ws@std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@1@AAV21@@Z
?good@ios_base@std@@QBE_NXZ
??4?$_Complex_base@O@std@@QAEAAV01@ABV01@@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?what@logic_error@std@@UBEPBDXZ
?xalloc@ios_base@std@@SAHXZ
??0_Locinfo@std@@QAE@ABV01@@Z
??0runtime_error@std@@QAE@ABV01@@Z
?round_error@?$numeric_limits@D@std@@SADXZ
?cosh@std@@YA?AV?$complex@M@1@ABV21@@Z
??Dstd@@YA?AV?$complex@M@0@ABMABV10@@Z
??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@
?do_is@?$ctype@G@std@@MBE_NFG@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
?epsilon@?$numeric_limits@K@std@@SAKXZ
?overflow@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGG@Z
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ
??1?$collate@G@std@@UAE@XZ
?not_eof@?$char_traits@D@std@@SAHABH@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z
?what@runtime_error@std@@UBEPBDXZ
?compare@?$char_traits@D@std@@SAHPBD0I@Z
?infinity@?$numeric_limits@G@std@@SAGXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??4?$numeric_limits@M@std@@QAEAAV01@ABV01@@Z
?seekpos@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@MAE?AV?$fpos@H@2@V32@H@Z
??Hstd@@YA?AV?$complex@N@0@ABNABV10@@Z
??_F?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??Nstd@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?round_error@?$numeric_limits@J@std@@SAJXZ
?epsilon@?$numeric_limits@_N@std@@SA_NXZ
?_Isnan@?$_Ctr@O@std@@SA_NO@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?close@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?_Init@?$ctype@G@std@@IAEXABV_Locinfo@2@@Z
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??_7?$ctype@G@std@@6B@
?_Getcat@?$_Mpunct@D@std@@SAIXZ
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
??0ostrstream@std@@QAE@PADHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??_8?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@7B@
?abs@std@@YAMABV?$complex@M@1@@Z
?_Doraise@out_of_range@std@@MBEXXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@GABV10@@Z
??0Init@ios_base@std@@QAE@XZ
?min@?$numeric_limits@H@std@@SAHXZ
??Pstd@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?do_truename@?$numpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
wmvcore
WMCreateIndexer
WMCreateProfileManager
WMCreateBackupRestorerPrivate
WMCreateEditor
WMCreateReaderPriv
DllRegisterServer
WMCreateWriterNetworkSink
WMCheckURLExtension
WMCreateWriterFileSink
WMCreateWriterPriv
WMValidateData
user32
PostMessageW
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE