Static task
static1
Behavioral task
behavioral1
Sample
2bde05a5f2780ecb7ef79aeb8ea215c2d7833c33a50197b94cc392cc9ef68f5c.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2bde05a5f2780ecb7ef79aeb8ea215c2d7833c33a50197b94cc392cc9ef68f5c.exe
Resource
win10v2004-20220812-en
General
-
Target
2bde05a5f2780ecb7ef79aeb8ea215c2d7833c33a50197b94cc392cc9ef68f5c
-
Size
27KB
-
MD5
1402e46c920bd9d3f52cf8d8476aa270
-
SHA1
eb8fc312403c7b21a283c37633e18668e9673360
-
SHA256
2bde05a5f2780ecb7ef79aeb8ea215c2d7833c33a50197b94cc392cc9ef68f5c
-
SHA512
7f44cf9c4871b54de23a607cf9e4468d7a78cfc4c83aa9d7f171d6bdf715ee5ae2c74192cbef7db6c651011ae005a877e622c0055e053052ee100e9131a28e2d
-
SSDEEP
384:fJVW1TCsGFX6/555+555ypYkyEEpYZGW9mkLztqZYsY1jhdE2:uCZ6/555+555spYpYZGW9mopF/9hD
Malware Config
Signatures
Files
-
2bde05a5f2780ecb7ef79aeb8ea215c2d7833c33a50197b94cc392cc9ef68f5c.exe windows x86
9b5f3937b286c1532553167f57cd7647
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
GetModuleHandleA
CreateFileMappingA
GetCurrentProcessId
CreateEventA
SetEvent
CopyFileA
GetCurrentProcess
FreeLibrary
CloseHandle
CreateProcessA
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetLastError
GetVersion
GetCommandLineA
GetShortPathNameA
Sleep
SetFileTime
GetFileTime
CreateFileA
WriteFile
ReadFile
UnmapViewOfFile
SetPriorityClass
OpenFileMappingA
WaitForSingleObject
OpenEventA
GetEnvironmentVariableA
FindClose
FindNextFileA
FindFirstFileA
GetVolumeInformationA
DeleteFileA
SetThreadPriority
GetCurrentThread
MapViewOfFile
advapi32
RegOpenKeyA
RegQueryValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegEnumKeyExA
RegOpenKeyExA
SetServiceStatus
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
QueryServiceConfigA
ControlService
StartServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
ChangeServiceConfigA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
memcpy
_stricmp
strcmp
_strnicmp
time
srand
malloc
free
strchr
_strlwr
_except_handler3
sprintf
strlen
rand
strcpy
strcat
memset
shell32
SHGetSpecialFolderPathA
shlwapi
PathFileExistsA
SHDeleteKeyA
PathFindFileNameA
Sections
WIN0 Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE