Static task
static1
Behavioral task
behavioral1
Sample
b060fd7e02332e211d20dcc8aa84991d8cfb3e620282f963b0ad7a46f6bbd68f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b060fd7e02332e211d20dcc8aa84991d8cfb3e620282f963b0ad7a46f6bbd68f.exe
Resource
win10v2004-20220812-en
General
-
Target
b060fd7e02332e211d20dcc8aa84991d8cfb3e620282f963b0ad7a46f6bbd68f
-
Size
866KB
-
MD5
e7472867a9443510f88ec57264e9ee3c
-
SHA1
ecfb9062b512764e76c6708488507d85f146a769
-
SHA256
b060fd7e02332e211d20dcc8aa84991d8cfb3e620282f963b0ad7a46f6bbd68f
-
SHA512
327c98af2832f2006c228f9c14cc7503fa72653170f2da30ca906b03aaeb6cde4681353500960110c1e4173fd83a04d9a238380605820904de4fe91a6a6ba9e6
-
SSDEEP
24576:qIJcxsaRE8Gs/qeYqadKmHEmjJabeiua3vpKddJqBnLlC:VgsaRE89b1aMmHLMqin3s4BLlC
Malware Config
Signatures
Files
-
b060fd7e02332e211d20dcc8aa84991d8cfb3e620282f963b0ad7a46f6bbd68f.exe windows x86
283dd55fe72ddc6757d44857e651b8e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp60
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Addstd@ios_base@std@@IAEXXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?do_decimal_point@?$_Mpunct@D@std@@MBEDXZ
??Y?$_Complex_base@M@std@@QAEAAV01@ABM@Z
?denorm_min@?$numeric_limits@D@std@@SADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??Nstd@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
_LPoly
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBGI@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGPAGG@Z
?is_open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
??Gstd@@YA?AV?$complex@M@0@ABV10@@Z
??0?$moneypunct@D$0A@@std@@QAE@ABV_Locinfo@1@I@Z
?overflow@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGG@Z
?do_out@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
?_Incref@facet@locale@std@@QAEXXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??0?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
??Nstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ
?infinity@?$numeric_limits@I@std@@SAIXZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?epsilon@?$numeric_limits@J@std@@SAJXZ
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
??0?$basic_filebuf@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z
??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@
?pow@std@@YA?AV?$complex@O@1@ABV21@H@Z
??1?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
?_Infv@?$_Ctr@O@std@@SAOO@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?real@std@@YAMABV?$complex@M@1@@Z
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
??0_Timevec@std@@QAE@ABV01@@Z
ntdll
NtSetHighEventPair
LdrFindResourceDirectory_U
NtCancelTimer
NtOpenThreadTokenEx
RtlConsoleMultiByteToUnicodeN
NtSetInformationProcess
ZwDuplicateToken
ZwUnlockVirtualMemory
RtlHashUnicodeString
DbgUiWaitStateChange
NtImpersonateClientOfPort
ZwOpenDirectoryObject
RtlAllocateHeap
RtlUpperString
RtlUnhandledExceptionFilter2
NtPlugPlayControl
NtPulseEvent
RtlSetTimer
RtlGetSaclSecurityDescriptor
RtlZeroHeap
_itow
ZwReadVirtualMemory
ZwAlertResumeThread
NtDeleteFile
RtlSetCurrentDirectory_U
RtlGetCurrentPeb
advapi32
SaferiPopulateDefaultsInRegistry
EnumServicesStatusW
SystemFunction036
AddAuditAccessObjectAce
AdjustTokenPrivileges
EnumServicesStatusExA
CreateRestrictedToken
SetNamedSecurityInfoExA
WmiQueryAllDataW
SystemFunction004
StartTraceA
ObjectCloseAuditAlarmA
GetKernelObjectSecurity
GetWindowsAccountDomainSid
SystemFunction015
GetLocalManagedApplications
LsaOpenPolicySce
ObjectPrivilegeAuditAlarmA
EnumerateTraceGuids
LsaSetQuotasForAccount
RegSaveKeyExW
OpenTraceA
I_ScIsSecurityProcess
UpdateTraceA
LookupPrivilegeValueW
EncryptionDisable
RegisterServiceCtrlHandlerW
CloseEventLog
AccessCheck
RegisterEventSourceW
SystemFunction040
LsaCreateAccount
ObjectDeleteAuditAlarmA
CredIsMarshaledCredentialA
BuildImpersonateTrusteeA
LsaEnumeratePrivileges
BuildTrusteeWithObjectsAndSidA
RegQueryValueW
RegFlushKey
AllocateLocallyUniqueId
LookupAccountNameA
LsaQueryTrustedDomainInfo
CredWriteA
ElfOpenEventLogW
kernel32
CreateFileW
GetGeoInfoA
ScrollConsoleScreenBufferW
DeleteCriticalSection
CloseConsoleHandle
FindVolumeMountPointClose
LeaveCriticalSection
LocalFlags
InterlockedDecrement
CmdBatNotification
GetTickCount
EnumResourceLanguagesA
GlobalUnWire
FormatMessageW
VirtualAlloc
AssignProcessToJobObject
EnterCriticalSection
TzSpecificLocalTimeToSystemTime
GetFileType
SetFileApisToOEM
GetSystemWow64DirectoryW
VerifyVersionInfoW
GetConsoleSelectionInfo
SetSystemPowerState
DeleteFiber
RemoveLocalAlternateComputerNameA
CreateWaitableTimerW
GlobalAddAtomW
SetConsoleNumberOfCommandsA
AddLocalAlternateComputerNameW
DeleteVolumeMountPointW
HeapCompact
OpenFileMappingW
RegisterWaitForSingleObjectEx
OpenWaitableTimerA
GetAtomNameA
FreeLibraryAndExitThread
LoadLibraryA
_hwrite
FatalAppExitA
ZombifyActCtx
QueryPerformanceCounter
SetTimerQueueTimer
HeapValidate
FormatMessageA
ReadConsoleOutputA
SetCommState
dbnetlib
InitSSPIPackage
ConnectionRead
InitSession
ConnectionMode
GetNextEnumeration
ConnectionTransact
ConnectionVer
ConnectionSqlVer
ConnectionOption
ConnectionError
InitEnumServers
TermSession
ConnectionFlushCache
ConnectionErrorW
ConnectionCheckForData
ConnectionOpen
ConnectionServerEnumW
ConnectionClose
TermSSPIPackage
ConnectionServerEnum
ConnectionWriteOOB
CloseEnumServers
ConnectionWrite
ConnectionGetSvrUser
ConnectionOpenW
ole32
CreateBindCtx
HMETAFILE_UserUnmarshal
UtGetDvtd32Info
ReadStringStream
CoGetClassObject
OleDuplicateData
CoMarshalInterThreadInterfaceInStream
CoPushServiceDomain
CoReleaseServerProcess
MonikerRelativePathTo
OleCreateLinkFromDataEx
CreateObjrefMoniker
CoCreateInstanceEx
DcomChannelSetHResult
CoInstall
HGLOBAL_UserFree
OleCreateMenuDescriptor
HBITMAP_UserSize
OleRegGetUserType
HBRUSH_UserMarshal
StgOpenPropStg
CoDisconnectObject
WdtpInterfacePointer_UserFree
OleConvertIStorageToOLESTREAM
OpenOrCreateStream
CoGetMarshalSizeMax
CoRevokeClassObject
CoUnmarshalHresult
OleRegEnumFormatEtc
OleMetafilePictFromIconAndLabel
StgConvertVariantToProperty
CoSetCancelObject
CoGetCurrentLogicalThreadId
PropVariantCopy
StgPropertyLengthAsVariant
StringFromGUID2
CoRegisterMallocSpy
OleGetIconOfFile
OleIsRunning
OleQueryCreateFromData
CoImpersonateClient
OleSetAutoConvert
cfgmgr32
CM_Get_Version_Ex
CM_Get_Device_Interface_ListW
CM_Add_Range
CM_Get_Log_Conf_Priority_Ex
CM_Get_Class_Key_Name_ExA
CM_Free_Res_Des
CM_Register_Device_Driver_Ex
CM_Get_DevNode_Registry_Property_ExW
CM_Get_Device_Interface_Alias_ExA
CM_Query_Arbitrator_Free_Data_Ex
CM_Get_Next_Log_Conf
CM_Query_And_Remove_SubTreeA
CM_Add_ID_ExA
CM_Get_Class_Registry_PropertyA
CM_Get_Device_Interface_List_SizeW
CM_Move_DevNode
CM_Set_DevNode_Problem_Ex
CM_Get_Class_Name_ExA
CM_Open_DevNode_Key
CM_Get_Res_Des_Data_Ex
CM_Set_Class_Registry_PropertyW
CM_Detect_Resource_Conflict_Ex
CM_Run_Detection_Ex
CM_Open_DevNode_Key_Ex
CMP_WaitServicesAvailable
CM_Modify_Res_Des
CM_Get_Device_ID_Size_Ex
CM_Add_Empty_Log_Conf_Ex
CM_Modify_Res_Des_Ex
CM_Get_Device_IDW
CM_Unregister_Device_InterfaceW
CM_Locate_DevNode_ExA
CMP_Report_LogOn
CM_Get_Res_Des_Data_Size
CM_Disable_DevNode
CM_Invert_Range_List
CM_Get_Device_ID_Size
CMP_Init_Detection
CM_Locate_DevNodeW
msvcrt
exit
sfc
SRSetRestorePointW
SRSetRestorePointA
SfcIsFileProtected
SfpVerifyFile
SfcGetNextProtectedFile
SRSetRestorePoint
Sections
.text Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 334KB - Virtual size: 333KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 371KB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ