Static task
static1
Behavioral task
behavioral1
Sample
3f9704a3c40e4ed15d53cdc1b8ffa6272585407a71ef9c1c2af395d5a654308e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3f9704a3c40e4ed15d53cdc1b8ffa6272585407a71ef9c1c2af395d5a654308e.exe
Resource
win10v2004-20220812-en
General
-
Target
3f9704a3c40e4ed15d53cdc1b8ffa6272585407a71ef9c1c2af395d5a654308e
-
Size
500KB
-
MD5
4db8e3d706766adfe25b4ecd3cc2b7b1
-
SHA1
0f68624f967df8b88ffda891dd6d034d2e07cb08
-
SHA256
3f9704a3c40e4ed15d53cdc1b8ffa6272585407a71ef9c1c2af395d5a654308e
-
SHA512
45a91acd01beff5187fd78416430cad72599b9b810f2165bf50378574c7ff85270cdfcd46faefbe71d4708e1529e8639ba1ff91091ea07bf7c6bee6209291271
-
SSDEEP
12288:j1c5TIDbTbBOOgBipJ4P4PJbjtal537r34S+90R9:jEMbZOOgopLRol5Lr3z+929
Malware Config
Signatures
Files
-
3f9704a3c40e4ed15d53cdc1b8ffa6272585407a71ef9c1c2af395d5a654308e.exe windows x86
a27d58f59ea8d7c057212bfbaef7a9e7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetComboBoxInfo
GetPriorityClipboardFormat
DdeUninitialize
GetScrollPos
EndTask
GetKBCodePage
FlashWindowEx
WinHelpA
InsertMenuW
GetClipboardSequenceNumber
EnumPropsExW
InternalGetWindowText
WaitMessage
GetTabbedTextExtentW
ImpersonateDdeClientWindow
SwitchToThisWindow
InsertMenuA
BroadcastSystemMessageA
LockWindowUpdate
CreateWindowStationA
ToAscii
LoadMenuW
PeekMessageA
DefMDIChildProcW
GetWindowLongA
CopyAcceleratorTableW
LoadCursorW
CascadeChildWindows
GetScrollRange
DdeAbandonTransaction
RegisterClipboardFormatA
MessageBoxExW
GetMessagePos
GetUserObjectInformationW
RegisterDeviceNotificationA
CheckDlgButton
ShowWindowAsync
GetCursorPos
ShowWindow
DdeQueryStringW
DrawCaption
TranslateMessage
DdeAccessData
FlashWindow
EnumDisplayDevicesW
SendInput
SendMessageCallbackA
GetClassLongW
GetNextDlgTabItem
AppendMenuW
PtInRect
ScrollWindowEx
SetDlgItemTextW
SetWindowTextW
IsCharLowerA
EditWndProc
DlgDirSelectComboBoxExA
OffsetRect
RemovePropA
SetMenu
SetClassLongW
UpdateWindow
DrawTextExW
SwitchDesktop
UnregisterHotKey
ReleaseCapture
GetKeyboardLayoutNameW
CallWindowProcW
GetMenuItemID
MessageBoxIndirectW
VkKeyScanA
CharUpperA
DdeImpersonateClient
DdeCreateDataHandle
CreateMDIWindowA
DlgDirListW
SetThreadDesktop
SetWindowTextA
SetMessageQueue
IntersectRect
IsDialogMessageW
GetMessageExtraInfo
ModifyMenuA
SendIMEMessageExW
DispatchMessageA
CreateMDIWindowW
DdePostAdvise
GetWindowRect
OpenIcon
GetScrollBarInfo
SetCursor
SendMessageTimeoutA
CharUpperBuffA
DdeCreateStringHandleA
DlgDirSelectExW
PostThreadMessageA
GetMenuInfo
DdeClientTransaction
BroadcastSystemMessageW
GetSystemMenu
TileWindows
DdeInitializeA
MsgWaitForMultipleObjects
RegisterClassExA
GetMenuDefaultItem
ChangeDisplaySettingsExA
IsMenu
FreeDDElParam
IsCharAlphaNumericW
InvertRect
SendMessageA
DdeDisconnectList
EnumPropsExA
CreateMenu
VkKeyScanExA
DdeFreeStringHandle
PaintDesktop
DdeConnect
GetLastActivePopup
GetAltTabInfo
kernel32
GetProcessVersion
GetConsoleCP
GetSystemDirectoryW
SetProcessWorkingSetSize
GetShortPathNameW
TlsGetValue
PurgeComm
CompareStringW
LocalReAlloc
GetPrivateProfileIntW
SetErrorMode
CancelWaitableTimer
GetSystemTime
IsSystemResumeAutomatic
ClearCommBreak
BuildCommDCBW
GlobalFindAtomA
CreateFileMappingW
ClearCommError
LoadLibraryExA
LockFileEx
ReadConsoleOutputW
GetStringTypeExW
GetStringTypeW
CallNamedPipeA
GetNumberFormatW
GetDateFormatA
SetFileApisToANSI
FlushConsoleInputBuffer
VirtualProtect
GetFileAttributesExA
ResumeThread
SetTapeParameters
GlobalGetAtomNameA
FindResourceA
CommConfigDialogW
CompareFileTime
WaitForSingleObjectEx
VirtualQuery
GetModuleFileNameA
GetCurrentThreadId
EnumResourceTypesW
SetSystemTimeAdjustment
GetConsoleScreenBufferInfo
lstrcpy
GetBinaryTypeW
GetCurrentProcessId
CreateThread
GetTapeStatus
LocalFree
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStructW
CreateSemaphoreW
SetConsoleCursorInfo
SetConsoleScreenBufferSize
VirtualAlloc
QueryPerformanceFrequency
CopyFileW
WideCharToMultiByte
WritePrivateProfileSectionA
GetSystemDefaultLangID
GetCommandLineW
CompareStringA
FillConsoleOutputCharacterW
WaitForDebugEvent
GetLogicalDrives
PostQueuedCompletionStatus
MultiByteToWideChar
UpdateResourceA
VirtualQueryEx
GlobalCompact
SetCalendarInfoW
DebugActiveProcess
RequestDeviceWakeup
EnumDateFormatsExA
ReadConsoleOutputCharacterA
SetCalendarInfoA
FatalExit
SetTimeZoneInformation
EnumCalendarInfoExW
OutputDebugStringW
ExpandEnvironmentStringsW
FileTimeToSystemTime
EnumCalendarInfoA
EnumSystemCodePagesA
WriteFileEx
CreateRemoteThread
EraseTape
GetEnvironmentVariableA
AddAtomA
WinExec
WriteProfileStringW
ExitProcess
EnumDateFormatsExW
CreateEventA
LocalUnlock
VerLanguageNameA
WaitCommEvent
GetTimeFormatA
OpenProcess
ConvertThreadToFiber
CreateToolhelp32Snapshot
lstrcpynW
GetVolumeInformationW
GlobalUnWire
ReadConsoleOutputA
GetVersionExW
MoveFileW
GetConsoleTitleW
GenerateConsoleCtrlEvent
MoveFileExW
FillConsoleOutputCharacterA
GetVolumeInformationA
GetDiskFreeSpaceExW
GetHandleInformation
EnumDateFormatsA
CreateProcessW
ReadConsoleOutputCharacterW
GetFileInformationByHandle
SetSystemPowerState
GetCurrentDirectoryA
EnumSystemCodePagesW
GetTapePosition
LoadModule
SetMailslotInfo
GetOverlappedResult
GetProfileSectionW
VirtualUnlock
FindClose
shlwapi
SHQueryInfoKeyA
PathFindExtensionA
StrPBrkW
SHRegEnumUSValueA
PathRemoveBlanksA
PathRenameExtensionA
PathCombineA
PathIsURLW
ColorRGBToHLS
SHRegWriteUSValueW
PathAppendW
UrlHashA
StrCmpNIA
PathCompactPathExA
StrDupW
StrIsIntlEqualA
SHGetValueW
PathStripPathW
IntlStrEqWorkerW
StrStrIW
SHRegDeleteUSValueW
PathSearchAndQualifyW
PathUnquoteSpacesA
StrFromTimeIntervalA
StrChrA
SHOpenRegStream2A
PathFindSuffixArrayW
UrlEscapeA
PathRemoveExtensionA
StrRetToBufA
StrStrW
PathIsLFNFileSpecA
UrlGetLocationW
PathMakePrettyW
PathIsRelativeA
UrlHashW
UrlApplySchemeW
StrDupA
PathFindNextComponentA
SHRegGetBoolUSValueW
PathIsDirectoryEmptyA
SHStrDupW
StrRChrIW
StrSpnW
UrlCombineA
SHEnumKeyExA
PathRemoveBackslashW
SHRegCreateUSKeyW
PathMakeSystemFolderW
PathGetCharTypeW
SHSkipJunction
PathUndecorateA
UrlIsNoHistoryA
SHOpenRegStreamA
StrCmpNIW
PathIsUNCA
PathSkipRootA
SHRegOpenUSKeyA
StrCmpNW
StrRStrIA
SHSetValueA
PathIsPrefixW
SHRegDeleteUSValueA
SHCreateStreamOnFileA
PathAddBackslashA
SHSetThreadRef
PathGetCharTypeA
SHRegCloseUSKey
PathIsLFNFileSpecW
UrlIsOpaqueW
UrlCompareA
SHRegQueryInfoUSKeyW
StrCatW
UrlEscapeW
StrChrIW
SHQueryValueExA
StrCSpnA
PathGetArgsW
AssocQueryStringByKeyW
SHOpenRegStreamW
PathGetDriveNumberA
PathRemoveArgsW
PathGetDriveNumberW
PathIsNetworkPathW
PathRelativePathToW
StrCSpnW
StrFormatByteSizeW
StrCatBuffA
StrCpyW
PathIsURLA
PathMakePrettyA
PathMatchSpecW
PathQuoteSpacesW
UrlIsOpaqueA
PathRemoveFileSpecA
StrPBrkA
PathIsUNCServerW
PathMakeSystemFolderA
ChrCmpIA
ColorHLSToRGB
wvnsprintfA
SHGetInverseCMAP
AssocQueryStringA
PathRenameExtensionW
StrRetToStrW
SHRegOpenUSKeyW
PathSetDlgItemPathA
StrToIntExA
StrCSpnIA
SHRegSetUSValueW
SHRegWriteUSValueA
StrSpnA
IntlStrEqWorkerA
PathStripPathA
PathRemoveFileSpecW
UrlIsNoHistoryW
StrRetToBufW
StrRChrA
PathIsSystemFolderA
PathCommonPrefixA
PathRemoveBackslashA
PathIsContentTypeW
PathIsDirectoryEmptyW
advapi32
CryptSetProviderExW
SetServiceStatus
EnumDependentServicesW
RegisterServiceCtrlHandlerA
QueryServiceLockStatusA
RegQueryMultipleValuesA
OpenSCManagerA
EnumServicesStatusA
SetPrivateObjectSecurity
GetAce
OpenEventLogW
GetTrusteeTypeA
GetSidSubAuthority
RegSetValueW
GetAccessPermissionsForObjectA
SetThreadToken
ConvertAccessToSecurityDescriptorA
GetOldestEventLogRecord
IsValidSecurityDescriptor
AddAccessDeniedAce
ConvertSecurityDescriptorToAccessNamedA
GetSecurityDescriptorSacl
StartServiceCtrlDispatcherW
CryptEncrypt
GetSidLengthRequired
PrivilegeCheck
LogonUserA
EnumDependentServicesA
FreeSid
RegEnumKeyExA
BackupEventLogW
ClearEventLogW
ControlService
CreateServiceW
RegNotifyChangeKeyValue
LookupPrivilegeValueW
ObjectCloseAuditAlarmA
BuildTrusteeWithSidW
IsTextUnicode
StartServiceA
RegOpenKeyExA
CryptGetKeyParam
CryptEnumProviderTypesA
EqualSid
LogonUserW
OpenServiceW
SetSecurityInfoExW
ObjectPrivilegeAuditAlarmA
CloseEventLog
CreateProcessAsUserW
RegRestoreKeyW
SetSecurityDescriptorGroup
CryptImportKey
SetNamedSecurityInfoExW
GetTrusteeNameW
RegQueryValueA
GetSecurityDescriptorLength
QueryServiceStatus
GetTrusteeTypeW
BuildImpersonateTrusteeA
CreateServiceA
RegEnumKeyA
LookupPrivilegeNameW
CryptSetKeyParam
StartServiceCtrlDispatcherA
OpenThreadToken
CryptSignHashA
CopySid
GetAuditedPermissionsFromAclA
CryptHashSessionKey
OpenProcessToken
RegQueryValueExW
GetSecurityDescriptorControl
CryptSetProviderW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameA
SetSecurityDescriptorDacl
RegRestoreKeyA
CryptGetHashParam
QueryServiceConfigW
LookupAccountNameW
LookupPrivilegeValueA
GetKernelObjectSecurity
RegisterEventSourceW
BuildImpersonateExplicitAccessWithNameW
RegSetValueExA
LookupAccountSidA
CryptSignHashW
OpenBackupEventLogW
GetSidIdentifierAuthority
BuildTrusteeWithSidA
RegisterServiceCtrlHandlerW
CreatePrivateObjectSecurity
CryptExportKey
RegSaveKeyW
ImpersonateLoggedOnUser
RegCloseKey
AdjustTokenPrivileges
RegReplaceKeyA
LookupPrivilegeNameA
ImpersonateNamedPipeClient
ReportEventA
SetFileSecurityA
InitializeAcl
CryptDuplicateHash
SetEntriesInAccessListA
ole32
CoRevokeClassObject
OleTranslateAccelerator
OleConvertOLESTREAMToIStorage
GetHGlobalFromILockBytes
OleCreateLinkEx
CreateGenericComposite
DoDragDrop
ReadOleStg
CoCopyProxy
RegisterDragDrop
MonikerCommonPrefixWith
CoGetMarshalSizeMax
OleCreateLinkToFile
StringFromCLSID
OleLoad
OleSetClipboard
OpenOrCreateStream
OleMetafilePictFromIconAndLabel
CoTaskMemRealloc
StringFromIID
WriteFmtUserTypeStg
CoFreeLibrary
CoResumeClassObjects
CoReleaseServerProcess
OleBuildVersion
CoRevertToSelf
ReadClassStm
ProgIDFromCLSID
CoRegisterPSClsid
CoImpersonateClient
OleConvertIStorageToOLESTREAMEx
OleFlushClipboard
StgSetTimes
OleConvertIStorageToOLESTREAM
CreateDataCache
OleSaveToStream
CoDosDateTimeToFileTime
RevokeDragDrop
CoFreeAllLibraries
CreateDataAdviseHolder
GetClassFile
CoLockObjectExternal
CoDisconnectObject
ReadClassStg
OleLoadFromStream
OleCreateFromData
OleCreateStaticFromData
PropVariantClear
CoRegisterChannelHook
CoTaskMemAlloc
CoGetPSClsid
OleGetClipboard
GetConvertStg
CoInitialize
OleSetContainedObject
OleCreateEx
CoSetProxyBlanket
OleDuplicateData
CoMarshalHresult
CreateItemMoniker
OleInitialize
CoFileTimeNow
GetRunningObjectTable
CoCreateInstanceEx
CreateOleAdviseHolder
OleSave
StgOpenAsyncDocfileOnIFillLockBytes
OleCreateLink
CoMarshalInterface
FreePropVariantArray
DllDebugObjectRPCHook
CoAddRefServerProcess
CoSuspendClassObjects
CoGetObject
OleRegEnumVerbs
CreateFileMoniker
CreateClassMoniker
OleCreateLinkFromDataEx
CoRegisterMallocSpy
OleDoAutoConvert
CreateILockBytesOnHGlobal
IsAccelerator
StgOpenStorage
CreateAntiMoniker
CoUninitialize
CoGetClassObject
CoInitializeEx
OleQueryLinkFromData
CoQueryAuthenticationServices
CoGetCurrentProcess
StringFromGUID2
WriteClassStm
MonikerRelativePathTo
OleCreate
StgCreateStorageEx
OleCreateEmbeddingHelper
CoGetStandardMarshal
OleUninitialize
GetDocumentBitStg
OleCreateFromFileEx
OleCreateLinkFromData
OleSetAutoConvert
GetHGlobalFromStream
StgGetIFillLockBytesOnILockBytes
GetHookInterface
BindMoniker
CoRevokeMallocSpy
WriteStringStream
IsEqualGUID
CreatePointerMoniker
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE