Static task
static1
Behavioral task
behavioral1
Sample
95486138f51151ac71ba98b0971ac25f7c986009dc646efa8910cd934e6c720c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
95486138f51151ac71ba98b0971ac25f7c986009dc646efa8910cd934e6c720c.exe
Resource
win10v2004-20220812-en
General
-
Target
95486138f51151ac71ba98b0971ac25f7c986009dc646efa8910cd934e6c720c
-
Size
304KB
-
MD5
1f37b90e12443ae32aa5d322eaa20ed9
-
SHA1
0b1825737992ffbdfb0c1856c3cdfb074a1cbd07
-
SHA256
95486138f51151ac71ba98b0971ac25f7c986009dc646efa8910cd934e6c720c
-
SHA512
a59e265041c4e4086b2d4db3017a1da2c1c5c283890d7928453c1faf2558efbcd1dfe5de73df17e3bd8158dc75c475ab53b5eaf2739fef690bec7920f3a2c704
-
SSDEEP
6144:8V7fZtBfbFDIYfN7W2OKX0+3Wec2amXbtkRsuT+3AW:8JfBfbmkN71HJJb45B
Malware Config
Signatures
Files
-
95486138f51151ac71ba98b0971ac25f7c986009dc646efa8910cd934e6c720c.exe windows x86
ff59ee45b2116990841dffeffc1f9063
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindVolumeClose
GetPrivateProfileIntW
InterlockedExchange
ResumeThread
GlobalSize
CreateEventA
CloseHandle
LocalFree
GetACP
lstrlenA
ResetEvent
VirtualAlloc
GetCommandLineA
GlobalFree
GetEnvironmentVariableW
GetModuleHandleW
GetStdHandle
WriteFile
GetExitCodeProcess
CreateMutexA
advapi32
IsTextUnicode
CloseEventLog
RegCreateKeyExW
CreateServiceA
RegDeleteKeyA
ControlService
RegCloseKey
IsValidSid
RegEnumKeyW
IsValidAcl
RegDeleteValueA
ClearEventLogA
RegQueryValueW
admparse
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
AdmClose
appwiz.cpl
ConfigStartMenu
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 352KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 295KB - Virtual size: 294KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ