Static task
static1
Behavioral task
behavioral1
Sample
d587a887ecac5b953b8ddfec23a674bff9b805977a5f66319dab506c8364e00d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d587a887ecac5b953b8ddfec23a674bff9b805977a5f66319dab506c8364e00d.exe
Resource
win10v2004-20221111-en
General
-
Target
d587a887ecac5b953b8ddfec23a674bff9b805977a5f66319dab506c8364e00d
-
Size
467KB
-
MD5
fa6993f6781a8026a87b3f257cd44548
-
SHA1
1474f26522968eea9d2a04543f2370b92ed90c16
-
SHA256
d587a887ecac5b953b8ddfec23a674bff9b805977a5f66319dab506c8364e00d
-
SHA512
f58e0c4c4640e2915861c743ec29f20d896a83b7b253daaac81f00b8119e1f49aab6b64c2cee05653b669e0dc021a259f59ef9ebcfa99e1ed33236dc9825532f
-
SSDEEP
12288:g3ryKYTSZOFu5VUFbZzSQLQd4b/H4IGOf0ABTTIl:YzYTug9ZpQycy/F8l
Malware Config
Signatures
Files
-
d587a887ecac5b953b8ddfec23a674bff9b805977a5f66319dab506c8364e00d.exe windows x86
f6f9c303d875da8d2e2e870f5af91854
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
Sleep
ReadProcessMemory
CreateProcessA
IsBadWritePtr
TerminateProcess
lstrcatA
MultiByteToWideChar
FlushFileBuffers
FindFirstFileA
GetLogicalDriveStringsA
GetLastError
lstrcmpiA
GetProcAddress
FindClose
LoadLibraryA
Process32Next
WritePrivateProfileStringA
GetModuleFileNameA
QueryFullProcessImageNameA
FindNextFileA
GetModuleHandleA
CreateToolhelp32Snapshot
OutputDebugStringA
DuplicateHandle
CloseHandle
DeleteFileA
lstrcpyA
GetCommandLineW
VirtualQuery
CreateEventA
OpenMutexA
lstrcmpiW
QueueUserWorkItem
CreateMutexA
LocalFree
ExitProcess
OutputDebugStringW
OpenProcess
CreateThread
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEndOfFile
LoadLibraryW
CreateFileW
WriteConsoleW
SetStdHandle
ReadConsoleW
WriteFile
ExpandEnvironmentStringsA
IsBadReadPtr
WaitForSingleObject
Process32First
QueryDosDeviceA
GetCurrentProcess
FreeLibrary
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentDirectoryW
lstrlenA
CreateFileA
GetModuleFileNameW
GetCurrentThread
GetOEMCP
GetFileAttributesExW
GetACP
IsValidCodePage
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetCurrentThreadId
EncodePointer
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetStringTypeW
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
HeapAlloc
GetDriveTypeW
GetFullPathNameA
RtlUnwind
GetCPInfo
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetModuleHandleW
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
CreateEventW
GetStartupInfoW
GetTickCount
CreateSemaphoreW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetProcessHeap
GetModuleHandleExW
AreFileApisANSI
ReadFile
user32
FindWindowA
GetWindowTextA
EnumWindows
GetClassNameA
GetWindowThreadProcessId
IsWindow
advapi32
ControlTraceA
EnableTraceEx
StartTraceA
OpenTraceA
ProcessTrace
StopTraceA
shell32
CommandLineToArgvW
ShellExecuteExA
ole32
CoCreateGuid
wininet
InternetReadFile
InternetConnectA
HttpQueryInfoA
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetQueryOptionA
InternetCloseHandle
ws2_32
inet_ntoa
WSAStartup
gethostname
iphlpapi
GetAdaptersInfo
GetAdaptersAddresses
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
shlwapi
PathRemoveFileSpecA
Sections
.text Size: 361KB - Virtual size: 361KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ