Static task
static1
Behavioral task
behavioral1
Sample
10dc50458c2bd2963b8dda3fa118784b841b9a43af74cd5219f00cc7685ac20f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
10dc50458c2bd2963b8dda3fa118784b841b9a43af74cd5219f00cc7685ac20f.exe
Resource
win10v2004-20221111-en
General
-
Target
10dc50458c2bd2963b8dda3fa118784b841b9a43af74cd5219f00cc7685ac20f
-
Size
60KB
-
MD5
38b3de152eb17c1e5ef1e8be8cc77c30
-
SHA1
40fdd0c9d6f0ec9924e9e780a1d9758048b28212
-
SHA256
10dc50458c2bd2963b8dda3fa118784b841b9a43af74cd5219f00cc7685ac20f
-
SHA512
c24cdd38bde4ab6479f7dcac5a385a4a28d6ca74d67e6482b06c0a57614bce29e57d59e577a8fcec3a9a0853ffd95de0e6ee0de36d76337c7a747bcedd3894b9
-
SSDEEP
768:RNWCgzTm5xEyqP9CSZP78f4OpZcLhYgAi2iXKTpleo2B7P42MJHjF0pR:RNEIxeVdgfVZgRAi9ke5B7Pat
Malware Config
Signatures
Files
-
10dc50458c2bd2963b8dda3fa118784b841b9a43af74cd5219f00cc7685ac20f.exe windows x86
870cf9d70b856a36b26500476a375912
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wtsapi32
WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSCloseServer
WTSDisconnectSession
WTSEnumerateProcessesA
WTSEnumerateProcessesW
WTSEnumerateServersA
WTSCloseServer
WTSCloseServer
WTSCloseServer
WTSCloseServer
kernel32
HeapCreate
GetWindowsDirectoryW
TlsFree
SizeofResource
_lopen
FindClose
GetACP
LZRead
TlsFree
TlsFree
GetMailslotInfo
GetConsoleTitleA
GlobalFree
DeleteAtom
DuplicateConsoleHandle
DuplicateHandle
EncodePointer
GlobalFree
DeleteFiber
EnterCriticalSection
RtlUnwind
IsBadReadPtr
SetStdHandle
GlobalFix
EncodeSystemPointer
FreeEnvironmentStringsA
UnhandledExceptionFilter
ExitProcess
Beep
ConvertFiberToThread
EncodePointer
HeapWalk
LCMapStringW
LCMapStringA
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 51KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DATA Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE