Static task
static1
Behavioral task
behavioral1
Sample
93e131f1d403a46c777cc6766bab93a77a72a5129c1b07424602b9eff5602eed.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
93e131f1d403a46c777cc6766bab93a77a72a5129c1b07424602b9eff5602eed.exe
Resource
win10v2004-20220901-en
General
-
Target
93e131f1d403a46c777cc6766bab93a77a72a5129c1b07424602b9eff5602eed
-
Size
446KB
-
MD5
090aab7574d29d064c31698072c0dfeb
-
SHA1
7f1bef2fbe7053f0b669642697bf27fff317949d
-
SHA256
93e131f1d403a46c777cc6766bab93a77a72a5129c1b07424602b9eff5602eed
-
SHA512
b14e701062b6671b7eb0f97cdc83955eb80c3dfaae4a996afeac2716ec492813276fbf4150cbd0b8d59f8e6d2fdce01b3062a71fad6a6b9f2dc6d06396f9abe9
-
SSDEEP
12288:+D+nI46fTpoHkv1Nl6c6SAJUVw2A2T0qkr:+ynI44TpoUNMXQVdNT0qk
Malware Config
Signatures
Files
-
93e131f1d403a46c777cc6766bab93a77a72a5129c1b07424602b9eff5602eed.exe windows x86
77e420bbef7b60e6970be71cdcb0bf1b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
opengl32
wglGetPixelFormat
wglCreateLayerContext
glVertex4f
glVertex2iv
glTexCoord2sv
glRecti
glPixelTransferi
glNormal3fv
glGetTexLevelParameterfv
glGetFloatv
glFogfv
glEvalCoord2dv
glEvalCoord1d
glEnable
glCullFace
glColor4s
glColor3bv
glBlendFunc
glAccum
user32
AdjustWindowRectEx
GetFocus
GetDlgCtrlID
GetCursorPos
GetCursorInfo
keybd_event
WinHelpW
WaitMessage
WaitForInputIdle
ValidateRect
UpdateWindow
UnregisterClassW
UnregisterClassA
UnhookWindowsHookEx
TranslateMessage
ToAsciiEx
TabbedTextOutW
SystemParametersInfoA
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowLongW
SetPropW
SetProcessWindowStation
SetLayeredWindowAttributes
SetForegroundWindow
SetFocus
SetDebugErrorLevel
SetCursor
SetActiveWindow
SendMessageW
SendDlgItemMessageW
SendDlgItemMessageA
ScreenToClient
RemovePropW
ReleaseDC
RegisterWindowMessageW
RegisterShellHookWindow
PtInRect
PostThreadMessageW
PostQuitMessage
PeekMessageW
PeekMessageA
PackDDElParam
OpenInputDesktop
ModifyMenuW
MessageBoxW
MapWindowPoints
MapDialogRect
LockSetForegroundWindow
LoadStringW
LoadCursorW
LoadBitmapW
IsWindowVisible
IsWindow
IsRectEmpty
IsIconic
IsClipboardFormatAvailable
InternalGetWindowText
InSendMessage
ImpersonateDdeClientWindow
GrayStringW
GetWindowTextW
GetWindowTextLengthW
GetWindowPlacement
GetWindowLongW
GetWindowContextHelpId
GetUserObjectInformationW
GetThreadDesktop
GetSystemMetrics
GetSysColorBrush
GetSysColor
GetSubMenu
GetQueueStatus
GetPropW
GetProcessWindowStation
GetParent
GetNextDlgTabItem
GetNextDlgGroupItem
GetMessageW
GetMessageTime
GetMessagePos
GetMenuState
GetMenuItemID
GetMenuCheckMarkDimensions
GetMenu
GetLastActivePopup
GetInputState
BeginPaint
CallNextHookEx
CallWindowProcW
CharUpperW
CheckMenuItem
ClientToScreen
CloseDesktop
CloseWindowStation
CopyImage
CopyRect
CreateCursor
CreateDesktopW
CreateDialogIndirectParamW
CreateWindowExW
CreateWindowStationW
DdeAbandonTransaction
DdeClientTransaction
DdeUnaccessData
DefWindowProcW
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DispatchMessageW
DrawTextW
EnableMenuItem
EnableScrollBar
EndDialog
EndPaint
ExitWindowsEx
FillRect
FlashWindow
GetActiveWindow
GetAsyncKeyState
GetCapture
GetCaretBlinkTime
GetClassInfoW
GetClassLongW
GetClipboardSequenceNumber
GetClientRect
GetClassNameW
GetForegroundWindow
ws2_32
WSAAsyncGetServByName
WSAAsyncGetHostByAddr
WSAAccept
WSAEnumNetworkEvents
WSAGetQOSByName
WSARecv
WSAResetEvent
WSASend
WSASendTo
WSASetBlockingHook
WSASetLastError
WSCWriteNameSpaceOrder
accept
connect
gethostname
getsockname
ntohl
WSACancelBlockingCall
kernel32
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileType
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessTimes
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetEnvironmentVariableA
GetEnvironmentStringsW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetConsoleMode
GetConsoleCP
GetCommandLineW
lstrlenW
WriteProcessMemory
WriteFile
WriteConsoleW
WideCharToMultiByte
WaitNamedPipeW
WaitForSingleObject
WaitForMultipleObjects
VirtualQueryEx
VirtualQuery
VirtualProtectEx
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
UnregisterWaitEx
UnmapViewOfFile
UnhandledExceptionFilter
TransactNamedPipe
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
TerminateProcess
TerminateJobObject
SystemTimeToFileTime
SuspendThread
SizeofResource
SignalObjectAndWait
SetUnhandledExceptionFilter
SetStdHandle
SetNamedPipeHandleState
SetMessageWaitingIndicator
SetLastError
SetInformationJobObject
SetHandleInformation
SetHandleCount
SetFilePointer
SetEvent
SetEnvironmentVariableW
SetEnvironmentVariableA
SetEndOfFile
SetCurrentDirectoryW
SetCommState
SearchPathW
RtlUnwind
ResumeThread
ResetEvent
ReleaseSemaphore
ReleaseMutex
RegisterWaitForSingleObjectEx
RegisterWaitForSingleObject
ReadProcessMemory
ReadFile
RaiseException
QueryPerformanceCounter
QueryDosDeviceW
PostQueuedCompletionStatus
PeekNamedPipe
OpenProcess
OpenEventW
MultiByteToWideChar
MapViewOfFile
LockResource
LockFile
LocalAlloc
LoadResource
LoadLibraryW
LoadLibraryExW
LeaveCriticalSection
LCMapStringW
IsValidLocale
IsValidCodePage
IsProcessorFeaturePresent
IsDebuggerPresent
IsDBCSLeadByte
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
HeapSize
HeapReAlloc
HeapFree
HeapCreate
HeapAlloc
Heap32ListFirst
GetWindowsDirectoryW
GetVersionExW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetUserDefaultLCID
GetTimeZoneInformation
GetTickCount
GetThreadLocale
GetThreadContext
GetTempPathW
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
AssignProcessToJobObject
CloseHandle
CreateEventW
CreateFileA
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
CreateJobObjectW
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateRemoteThread
CreateSemaphoreW
CreateThread
DebugBreak
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FindResourceW
FlushFileBuffers
FormatMessageA
FreeLibrary
GetACP
GetCPInfo
GetCommMask
GetStringTypeW
msvcrt
_filelengthi64
_fileno
_findclose
_findfirst
_findfirst64
_findnext64
_flsbuf
_flushall
_fpclass
_fputchar
_fsopen
_filelength
_ftime64
_ftol
_fullpath
_futime
_futime64
_gcvt
_get_osfhandle
_get_sbh_threshold
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdrive
_getdrives
_getmbcp
_getpid
_getsystime
_getw
_getws
_global_unwind2
_gmtime64
_heapadd
_heapchk
_heapmin
_heapwalk
_hypot
_i64tow
_initterm
_inp
_inpd
_isatty
_ismbbalnum
_ismbbalpha
_ismbbgraph
_ismbbkalnum
_ismbbkana
_ismbbkprint
_ismbblead
_ismbbprint
_ismbbpunct
_ismbbtrail
_ismbcalnum
_ismbcalpha
_ismbcdigit
_ismbcgraph
_ismbckata
_ismbcl0
_ismbcl1
_ismbcl2
_ismbclower
_ismbcspace
_ismbcsymbol
_ismbslead
_ismbstrail
_isnan
_itoa
_jn
_lfind
_loaddll
_localtime64
_lock
_locking
_logb
_longjmpex
_lrotl
_lsearch
_lseeki64
_ltow
_mbbtombc
_mbbtype
_mbcasemap
_mbccpy
_mbcjistojms
_mbclen
_mbctohira
_mbctokata
_mbctolower
_mbctombb
_mbscat
_mbscmp
_mbscpy
_mbscspn
_mbsdec
_mbsicmp
_mbsicoll
_mbslwr
_mbsnbcat
_mbsnbcmp
_mbsnbcnt
_mbsnbcoll
_mbsnbicoll
_mbsncat
_mbsnccnt
_mbsnicmp
_mbsnicoll
_mbsninc
_mbsnset
_mbspbrk
_mbsspnp
_mbsstr
_mbstok
_mbsupr
_memicmp
_mkdir
_mktemp
_mktime64
_nextafter
_open
_osplatform
_outp
_fileinfo
_outpw
_pclose
_pctype
_pgmptr
_popen
_purecall
_putch
_rotl
_safe_fdiv
_safe_fdivr
_safe_fprem
_safe_fprem1
_scalb
_seh_longjmp_unwind
_set_error_mode
_seterrormode
_setjmp
_setjmp3
_setmode
_setsystime
_sleep
_snprintf
_sopen
_spawnl
_spawnle
_spawnlpe
_spawnvp
_stat
_stat64
_strcmpi
_strdate
_strerror
_strlwr
_strnicmp
_strnset
_strset
_strtime
_strupr
_sys_errlist
_sys_nerr
_tell
_telli64
_tempnam
_time64
_timezone
_tolower
_toupper
_tzname
_tzset
_ui64toa
_ui64tow
_ultoa
_ultow
_unlink
_unlock
_utime
_vsnwprintf
_wasctime
_wchdir
_wchmod
_wcmdln
_wcsicmp
_wcsnicoll
_wcsnset
_wcsset
_wctime64
_wexecle
_wexeclp
_wexecv
_wexecvp
_wexecvpe
_wfdopen
_wfindfirst
_wfindfirsti64
_wfindnext
_wfindnexti64
_wfopen
_wgetcwd
_wgetdcwd
_winmajor
_winminor
_winver
_wmakepath
_wmkdir
_wmktemp
_wperror
_wpopen
_wputenv
_wrename
_wrmdir
_wsetlocale
_wsopen
_wspawnlp
_wspawnv
_wspawnve
_wspawnvpe
_wsplitpath
_wstat
_wstat64
_wsystem
_wtempnam
_wtoi64
_wutime
_y1
abort
acos
asin
atan2
atexit
atof
atoi
atol
calloc
ceil
clearerr
clock
cosh
ctime
exit
fclose
feof
ferror
fflush
fgetpos
fgets
fopen
fputc
fputs
frexp
fscanf
fseek
ftell
fwprintf
fwrite
fwscanf
getc
getchar
getenv
gets
getwchar
gmtime
iscntrl
isdigit
isgraph
isleadbyte
isprint
isspace
iswalnum
iswalpha
iswascii
iswctype
iswgraph
iswlower
iswupper
iswxdigit
labs
ldexp
ldiv
localeconv
localtime
longjmp
mblen
mbstowcs
mbtowc
memchr
memcmp
memcpy
perror
printf
putc
putchar
puts
putwc
qsort
rand
realloc
rewind
setbuf
setlocale
signal
sin
sprintf
sqrt
srand
sscanf
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncpy
strpbrk
strstr
strtod
strtol
strtoul
strxfrm
swprintf
tan
tanh
tmpfile
tolower
towlower
towupper
ungetc
vfprintf
vprintf
vswprintf
vwprintf
wcscat
wcscmp
wcscoll
wcscpy
wcscspn
wcsftime
wcsncmp
wcsncpy
wcsrchr
wcstod
wcstok
wcstol
wcstombs
wcsxfrm
wscanf
_filbuf
_fgetwchar
_fcloseall
_expand
_execvp
_execve
_execlp
_execl
_except_handler3
_except_handler2
_errno
_eof
_environ
_endthreadex
_endthread
_ecvt
_dup2
_dup
_daylight
_ctype
_ctime64
_creat
_cputs
_copysign
_controlfp
_close
_clearfp
_chmod
_chkesp
_chgsign
_chdrive
_chdir
_cexit
_callnewh
_cabs
_c_exit
_beginthreadex
_beep
_atoi64
_amsg_exit
_adjust_fdiv
_adj_fptan
_adj_fprem1
_adj_fpatan
_adj_fdivr_m64
_adj_fdivr_m32i
_adj_fdiv_m64
_adj_fdiv_m32i
_acmdln
_access
_abnormal_termination
__wgetmainargs
__wargv
__unguarded_readlc_active
__threadhandle
__setlc_active
__pxcptinfoptrs
__pioinfo
__p__winver
__p__winminor
__p__winmajor
__p__wenviron
__p__wcmdln
__p__timezone
__p__pwctype
__p__pgmptr
__p__pctype
__p__osver
__p__iob
__p__fileinfo
__p__dstbias
__p__amblksiz
__p__acmdln
__p___winitenv
__p___mb_cur_max
__p___initenv
__p___argc
__mb_cur_max
__lc_handle
__lc_collate_cp
__lc_codepage
__iscsymf
__isascii
__initenv
__argv
__argc
__RTtypeid
__RTDynamicCast
__RTCastToVoid
__CxxFrameHandler
_XcptFilter
_EH_prolog
_CxxThrowException
_CItanh
_CItan
_CIsin
_CIpow
_CIlog10
_CIlog
_CIfmod
_CIexp
_CIcos
_CIatan
_outpd
_fstat64
shlwapi
SHGetThreadRef
ColorRGBToHLS
HashData
PathFileExistsW
SHAutoComplete
SHCopyKeyW
ord16
SHRegDuplicateHKey
SHRegisterValidateTemplate
SHSetThreadRef
StrCatW
StrCpyNW
StrFormatByteSize64A
version
VerQueryValueW
VerQueryValueA
VerInstallFileW
VerInstallFileA
VerFindFileW
VerFindFileA
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA
GetFileVersionInfoA
odbc32
ord2
ord24
ord9
ord15
ord68
OpenODBCPerfData
winspool.drv
ConnectToPrinterDlg
CloseSpoolFileHandle
ClosePrinter
AdvancedSetupDialog
DevQueryPrint
DeviceMode
DocumentPropertySheets
XcvDataW
WaitForPrinterChange
SplDriverUnloadComplete
EndDocPrinter
ExtDeviceMode
FindClosePrinterChangeNotification
FreePrinterNotifyInfo
QuerySpoolMode
ScheduleJob
ConvertAnsiDevModeToUnicodeDevmode
winmm
joySetCapture
DefDriverProc
midiOutShortMsg
midiStreamPause
midiStreamProperty
mixerSetControlDetails
mmioCreateChunk
mmioSendMessage
mmioSetBuffer
timeGetTime
waveOutGetID
auxGetVolume
wid32Message
waveOutSetPlaybackRate
waveOutSetPitch
advapi32
AllocateAndInitializeSid
CloseServiceHandle
ConvertSecurityDescriptorToStringSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
CreateProcessAsUserW
CreateRestrictedToken
CreateWellKnownSid
DeregisterEventSource
DuplicateToken
EqualSid
GetFileSecurityW
GetLengthSid
GetTokenInformation
GetTraceEnableFlags
GetTraceLoggerHandle
InitializeSecurityDescriptor
LookupPrivilegeValueW
UnregisterTraceGuids
TraceEvent
SystemFunction013
SetTokenInformation
SetThreadToken
SetSecurityDescriptorDacl
SetFileSecurityW
SetEntriesInAclW
RevertToSelf
RegisterTraceGuidsW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDisablePredefinedCache
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
MakeAbsoluteSD
AccessCheckByType
Sections
.text Size: 364KB - Virtual size: 368KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 20KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ