Static task
static1
Behavioral task
behavioral1
Sample
abde6bdb932dbea438a175a53e61d69a64a29fceb08ec0134faaa723183fa49a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
abde6bdb932dbea438a175a53e61d69a64a29fceb08ec0134faaa723183fa49a.exe
Resource
win10v2004-20220901-en
General
-
Target
abde6bdb932dbea438a175a53e61d69a64a29fceb08ec0134faaa723183fa49a
-
Size
866KB
-
MD5
66e282fdf2179975da104c3f6f3abc4a
-
SHA1
83e9d98ad82a5c00fba7783905c2cdf9f9a61535
-
SHA256
abde6bdb932dbea438a175a53e61d69a64a29fceb08ec0134faaa723183fa49a
-
SHA512
6f2be21d5a03f170538cefa4c426d89fe4c934f326980bba0f53aca9e9c5dfd6983cdb4ed694fe5a65811de8e2f98d9cae026ea7bcfa17afae702423f45a10ac
-
SSDEEP
24576:ZisxtfbBXl8LRB7yChzgQQFzGWpROslGZP:ZTHfbtWRBe8uTpIslG
Malware Config
Signatures
Files
-
abde6bdb932dbea438a175a53e61d69a64a29fceb08ec0134faaa723183fa49a.exe windows x86
97d52abe4faded5a507cb2ee708e77f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
DefWindowProcW
RegisterClassW
PostQuitMessage
msdart
?WriteLock@CReaderWriterLock3@@QAEXXZ
?SetDefaultSpinCount@CSpinLock@@SGXG@Z
??4CSingleList@@QAEAAV0@ABV0@@Z
?ValidSignature@CLKRHashTable@@QBE_NXZ
?sm_dblDfltSpinAdjFctr@CSmallSpinLock@@1NA
?_PredTrue@CLKRLinearHashTable@@CG?AW4LK_PREDICATE@@PBXPAX@Z
?ReadUnlock@CLKRHashTable@@QBEXXZ
?_SegIndex@CLKRLinearHashTable@@ABEKK@Z
?IsWriteUnlocked@CLKRLinearHashTable@@QBE_NXZ
MpHeapAlloc
?sm_dblDfltSpinAdjFctr@CSpinLock@@1NA
?_TryReadLock@CReaderWriterLock@@AAE_NXZ
?ReadLock@CLKRLinearHashTable@@QBEXXZ
?_H0@CLKRLinearHashTable@@CGKKK@Z
?WriteUnlock@CSpinLock@@QAEXXZ
?sm_dblDfltSpinAdjFctr@CCritSec@@1NA
mpRealloc
?SetSpinCount@CCritSec@@SGKPAPAVCCriticalSection@@K@Z
?_CmpExch@CReaderWriterLock2@@AAE_NJJ@Z
?SetDefaultSpinAdjustmentFactor@CFakeLock@@SGXN@Z
?ReadUnlock@CSmallSpinLock@@QAEXXZ
?ConvertExclusiveToShared@CLKRLinearHashTable@@QBEXXZ
?ReadUnlock@CCritSec@@QAEXXZ
??0CLKRHashTableStats@@QAE@XZ
??0CSpinLock@@QAE@XZ
?TryWriteLock@CSpinLock@@QAE_NXZ
?ApplyIf@CLKRHashTable@@QAEKP6G?AW4LK_PREDICATE@@PBXPAX@ZP6G?AW4LK_ACTION@@01@Z1W4LK_LOCKTYPE@@@Z
?IsReadLocked@CFakeLock@@QBE_NXZ
?CreateHolder@@YGJPAUIGPDispenser@@HIPAPAUIGPHolder@@@Z
?DeleteIf@CLKRHashTable@@QAEKP6G?AW4LK_PREDICATE@@PBXPAX@Z1@Z
?ConvertExclusiveToShared@CSpinLock@@QAEXXZ
?IsReadUnlocked@CFakeLock@@QBE_NXZ
?IsEmpty@CLockedSingleList@@QBE_NXZ
?IsReadUnlocked@CReaderWriterLock2@@QBE_NXZ
?ReadUnlock@CLKRLinearHashTable@@QBEXXZ
msvcrt
abort
_wcsicoll
??_7bad_typeid@@6B@
strncpy
_findfirsti64
_ismbslead
_waccess
calloc
_mbsnicoll
_makepath
ldexp
_lseeki64
wcstombs
_fdopen
_nextafter
_spawnvpe
wcsncmp
_adj_fdiv_m16i
_mbsncat
__pctype_func
_setmaxstdio
_lock
??_Fbad_cast@@QAEXXZ
_mbsinc
fputc
tolower
_mbsrchr
sin
exp
_hypot
_adj_fprem1
_pctype
__toascii
_XcptFilter
__p__winmajor
isalpha
memset
putwc
_CIatan2
__setusermatherr
kernel32
WaitNamedPipeA
FreeEnvironmentStringsA
FindActCtxSectionStringW
DefineDosDeviceA
EnumSystemLanguageGroupsW
ContinueDebugEvent
GetLogicalDrives
EnumResourceLanguagesA
HeapCreate
OpenEventA
GetEnvironmentVariableA
ConsoleMenuControl
OutputDebugStringA
TzSpecificLocalTimeToSystemTime
GetLongPathNameA
DuplicateHandle
MapViewOfFileEx
lstrcpynA
LoadLibraryExW
VirtualAlloc
InitializeCriticalSection
GlobalFindAtomA
WritePrivateProfileStringW
QueryPerformanceCounter
GetStringTypeExW
SetCommState
LoadLibraryA
GlobalUnlock
SetDefaultCommConfigA
Toolhelp32ReadProcessMemory
ClearCommBreak
query
??4CDbByGuid@@QAEAAV0@ABV0@@Z
??1CDbColumns@@QAE@XZ
?QueryCatalogAdmin@CCatalogEnum@@QAEPAVCCatalogAdmin@@XZ
?AppendChild@CDbCmdTreeNode@@IAEXPAV1@@Z
?SetNumberOfColumns@CCatState@@QAEXI@Z
??0CiStorage@@QAE@PBGAAUICiCAdviseStatus@@KKH@Z
??0CAllocStorageVariant@@QAE@AAVPDeSerStream@@AAVPMemoryAllocator@@@Z
?SetRestriction@CDbSelectNode@@QAEHPAVCDbCmdTreeNode@@@Z
?Empty@CPropStoreManager@@QAEXXZ
?Query@CQueryParser@@AAEPAVCDbRestriction@@PAVCDbNodeRestriction@@@Z
?GetNumber@CQueryScanner@@QAEHAA_KAAH@Z
BindIFilterFromStream
?UnMarshall@CDbParameter@@QAEHAAVPDeSerStream@@@Z
?Marshall@CRestriction@@QBEXAAVPSerStream@@@Z
?VT_VARIANT_GE@@YGHABUtagPROPVARIANT@@0@Z
?StartCI@CMachineAdmin@@QAEHXZ
?CloseRecord@CPropStoreManager@@QAEXPAVCCompositePropRecordForWrites@@@Z
?Add@CDbColumns@@QAEHABVCDbColId@@I@Z
?SetCurrentProperty@CQueryParser@@AAEXPBGW4PropertyType@@@Z
?EnableVPathNotify@CMetaDataMgr@@QAEXPAVCMetaDataVPathChangeCallBack@@@Z
?AddEntry@CCombinedPropertyList@@UAEXPAVCPropEntry@@H@Z
_AbortMerges@16
?GetVolumeName@CDriveInfo@@QAEPBGH@Z
?WriteProperty@CPropStoreManager@@QAEJAAVCCompositePropRecordForWrites@@KABVCStorageVariant@@@Z
?SkipBlob@CMemDeSerStream@@UAEXK@Z
CollectCIISAPIPerformanceData
?Marshall@CDbNumeric@@QBEXAAVPSerStream@@@Z
??0CScopeRestriction@@QAE@PBGHH@Z
??0CFilterDaemon@@QAE@AAVCiProxy@@AAVCCiFrameworkParams@@AAVCLangList@@PAEKPAUICiCFilterClient@@@Z
?Skip@CEnumString@@UAGJK@Z
?Find@CEmptyPropertyList@@QAEPBVCPropEntry@@ABVCDbColId@@@Z
?ReadProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@@Z
?VT_VARIANT_EQ@@YGHABUtagPROPVARIANT@@0@Z
CICreateCommand
??0CSort@@QAE@I@Z
?GetFILETIME@CAllocStorageVariant@@QBE?AU_FILETIME@@I@Z
??0CPropertyStoreWids@@QAE@AAVCPropStoreManager@@@Z
?MakeBackupCopy@CPhysStorage@@QAEXAAV1@AAVPSaveProgressTracker@@@Z
?InitializeForRead@CDynStream@@QAEXXZ
?DoUpdates@CFilterDaemon@@QAEJXZ
??1CPidLookupTable@@QAE@XZ
?SkipByte@CMemDeSerStream@@UAEXXZ
??0CWorkQueue@@QAE@IW4WorkQueueType@0@@Z
ntdsapi
DsReplicaSyncAllA
DsBindWithSpnA
DsClientMakeSpnForTargetServerW
DsRemoveDsDomainW
DsMapSchemaGuidsW
DsGetDomainControllerInfoW
DsUnBindA
DsIsMangledRdnValueA
DsCrackSpn2W
DsaopBindWithSpn
DsReplicaAddW
DsInheritSecurityIdentityA
DsReplicaUpdateRefsA
DsBindWithSpnW
DsListDomainsInSiteA
DsaopUnBind
DsWriteAccountSpnA
DsBindW
DsBindWithCredA
DsIsMangledRdnValueW
DsReplicaAddA
DsaopBind
DsListRolesW
DsUnquoteRdnValueW
DsListSitesA
DsGetRdnW
DsaopExecuteScript
DsServerRegisterSpnW
winscard
SCardEstablishContext
SCardListCardsA
SCardGetAttrib
SCardState
SCardSetCardTypeProviderNameW
SCardConnectA
SCardIntroduceCardTypeW
SCardReconnect
SCardLocateCardsW
SCardListReadersW
SCardGetProviderIdA
SCardGetStatusChangeA
SCardRemoveReaderFromGroupA
SCardControl
SCardSetAttrib
SCardAccessNewReaderEvent
SCardStatusA
SCardTransmit
SCardConnectW
SCardLocateCardsA
SCardListReaderGroupsW
SCardIntroduceReaderA
SCardListInterfacesW
SCardListReadersA
SCardIsValidContext
SCardForgetReaderGroupA
Sections
.text Size: 187KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 576KB - Virtual size: 576KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 99KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ