Static task
static1
Behavioral task
behavioral1
Sample
8cfe443b97ea246c5db7c0da2cd775fd63d62a2809f2055591ad9f2bfa759657.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8cfe443b97ea246c5db7c0da2cd775fd63d62a2809f2055591ad9f2bfa759657.exe
Resource
win10v2004-20221111-en
General
-
Target
8cfe443b97ea246c5db7c0da2cd775fd63d62a2809f2055591ad9f2bfa759657
-
Size
398KB
-
MD5
3b9aeefd88ef2be0d38b5c5bdcda82e3
-
SHA1
79e7615fa998d4d50ea672937cd89306f3be8d6b
-
SHA256
8cfe443b97ea246c5db7c0da2cd775fd63d62a2809f2055591ad9f2bfa759657
-
SHA512
b5e0e5665ecdd346ce31095454c7fae94ba05244cc33ac5bc882359295d67ece19d3280b77c306ddec47dfca2865ddbf16fd97ede145638b544b37c757ea8b00
-
SSDEEP
12288:ltfgo8RAkeFvg9eKcgJRddlFrlJ4pPOia4xikZWqyroDt1Ec:ldgo8RAkeZmjFlJ4pPjawikYpoDt1Ec
Malware Config
Signatures
Files
-
8cfe443b97ea246c5db7c0da2cd775fd63d62a2809f2055591ad9f2bfa759657.exe windows x86
e978405453d37d3b648567ffe2daea3d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mprapi
MprAdminTransportSetInfo
MprAdminInterfaceGetInfo
MprConfigServerInstall
MprInfoDuplicate
MprInfoBlockQuerySize
MprAdminBufferFree
MprAdminInterfaceUpdateRoutes
MprInfoCreate
MprConfigInterfaceGetInfo
MprConfigInterfaceEnum
MprConfigInterfaceSetInfo
MprConfigInterfaceTransportAdd
MprConfigTransportSetInfo
MprAdminInterfaceSetCredentials
MprConfigInterfaceTransportGetHandle
MprAdminUserGetInfo
MprAdminPortReset
MprAdminUserRead
MprAdminTransportGetInfo
MprAdminPortGetInfo
MprAdminUserServerDisconnect
MprAdminInterfaceTransportSetInfo
MprDomainRegisterRasServer
MprAdminConnectionEnum
RasPrivilegeAndCallBackNumber
MprConfigInterfaceTransportRemove
MprAdminInterfaceDeviceGetInfo
MprAdminInterfaceGetCredentialsEx
MprAdminInterfaceDeviceSetInfo
MprAdminInterfaceGetHandle
MprAdminDeviceEnum
MprAdminServerGetCredentials
MprAdminDeregisterConnectionNotification
MprAdminUserServerConnect
MprAdminInterfaceTransportRemove
MprAdminInterfaceDisconnect
MprAdminUserWriteProfFlags
MprConfigInterfaceCreate
MprConfigInterfaceTransportGetInfo
MprAdminMIBEntryCreate
mapi32
MapStorageSCode@4
BMAPIResolveName
EncodeID@12
DeregisterIdleRoutine@4
FtDivFtBogus@20
InstallFilterHook@4
FBadRglpNameID@8
HrComposeMsgID@24
RTFSync@12
FBadRowSet@4
cmc_logon
MAPIDeinitIdle@0
HrEntryIDFromSz@12
UFromSz@4
MAPILogonEx
UlRelease@4
MAPIFindNext
FtgRegisterIdleRoutine@20
PRProviderInit
HrIStorageFromStream@16
MAPIOpenFormMgr@8
MAPIAllocateBuffer
WrapCompressedRTFStream
EnableIdleRoutine@8
BMAPIFindNext
MNLS_WideCharToMultiByte@32
FBadRow@4
HrSetOneProp@8
HrDecomposeMsgID@24
RTFSync
CchOfEncoding@4
OpenIMsgOnIStg@44
ScCountNotifications@12
OpenIMsgSession@12
MNLS_MultiByteToWideChar@24
UNKOBJ_ScAllocateMore@16
FtMulDw@12
crtdll
realloc
_pclose
abort
is_wctype
_ultow
_dup
_mbscat
_mbsspnp
_wtol
_errno
iswalpha
fflush
free
strtod
_mbsnicmp
getenv
_fileno
iswascii
_daylight_dll
_ismbblead
localeconv
_itoa
_strnextc
_mbctoupper
cos
_eof
_expand
_execve
wcscpy
_initterm
wcstombs
_endthread
_pctype_dll
_mbsnbicmp
_fullpath
_CIatan
_wtoi
_loaddll
_umask
_execvpe
_wcsnicmp
msvcp60
?pbackfail@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGG@Z
??4?$numeric_limits@O@std@@QAEAAV01@ABV01@@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??0?$moneypunct@G$0A@@std@@QAE@ABV_Locinfo@1@I@Z
_FDenorm
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?id@?$numpunct@G@std@@2V0locale@2@A
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@KAPADPADDH@Z
??0_Locinfo@std@@QAE@HPBD@Z
??Dstd@@YA?AV?$complex@M@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@GABV10@@Z
??_F?$collate@G@std@@QAEXXZ
?do_in@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
??_7?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??0?$complex@M@std@@QAE@ABM0@Z
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
??_7domain_error@std@@6B@
?do_tolower@?$ctype@D@std@@MBEDD@Z
?pow@std@@YA?AV?$complex@M@1@ABV21@0@Z
?sqrt@std@@YA?AV?$complex@N@1@ABV21@@Z
?do_compare@?$collate@G@std@@MBEHPBG000@Z
??1?$ctype@G@std@@UAE@XZ
?unsetf@ios_base@std@@QAEXH@Z
?assign@?$char_traits@D@std@@SAPADPADIABD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@ios_base@std@@QAEXH_N@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?infinity@?$numeric_limits@J@std@@SAJXZ
??_7range_error@std@@6B@
?imag@?$_Complex_base@M@std@@QBEMXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IABV12@II@Z
??8std@@YA_NABOABV?$complex@O@0@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXF@Z
kernel32
EnterCriticalSection
VirtualAlloc
GetShortPathNameW
GetDiskFreeSpaceExA
_lcreat
ExitProcess
LoadLibraryA
EnumResourceTypesW
FindResourceW
GetProfileStringA
RtlFillMemory
SetProcessPriorityBoost
VerSetConditionMask
GetConsoleCP
GetVolumeNameForVolumeMountPointA
SetDefaultCommConfigW
GetSystemTimeAdjustment
DebugBreakProcess
RegisterWaitForSingleObject
EraseTape
UnregisterWait
GetCommConfig
LZOpenFileA
WriteConsoleA
DeleteCriticalSection
GetStartupInfoA
LeaveCriticalSection
CreateNamedPipeA
OpenSemaphoreW
MoveFileExA
DebugBreak
GetLocaleInfoA
CreateHardLinkW
ifsutil
?AddEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?QueryNtfsSupportInfo@DP_DRIVE@@SGJPAXPAE@Z
?GetCannedSecurity@IFS_SYSTEM@@SGPAVCANNED_SECURITY@@XZ
?RemoveEdge@DIGRAPH@@QAEEKK@Z
??0READ_CACHE@@QAE@XZ
?GetCannedSecurityDescriptor@CANNED_SECURITY@@QAEPAXW4_CANNED_SECURITY_TYPE@@PAK@Z
?CloseDriveHandle@DP_DRIVE@@QAEXXZ
?GetBuffer@TLINK@@QAEPAXPAX@Z
?QueryPageSize@IFS_SYSTEM@@SGKXZ
??1SPARSE_SET@@UAE@XZ
?GetSortedFirst@TLINK@@QAEPAXXZ
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EEG@Z
?QueryFreeDiskSpace@IFS_SYSTEM@@SGEPBVWSTRING@@PAVBIG_INT@@@Z
?Write@SECRUN@@UAEEXZ
?Read@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?AddDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?QueryDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@0PAVMESSAGE@@E@Z
??0INTSTACK@@QAE@XZ
??0LOG_IO_DP_DRIVE@@QAE@XZ
?QueryNumber@NUMBER_SET@@QBE?AVBIG_INT@@V2@@Z
?Initialize@TLINK@@QAEEG@Z
?RemoveAll@NUMBER_SET@@QAEEXZ
?NtDriveNameToDosDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?FileSetAttributes@IFS_SYSTEM@@SGEPBVWSTRING@@KPAK@Z
??0DIGRAPH@@QAE@XZ
?Initialize@READ_WRITE_CACHE@@QAEEPAVIO_DP_DRIVE@@K@Z
?QuerySize@TLINK@@QBEGXZ
?Add@NUMBER_SET@@QAEEVBIG_INT@@@Z
?ReverseCopy@INTSTACK@@QAEEPAV1@@Z
?QueryDisjointRange@NUMBER_SET@@QBEXKPAVBIG_INT@@0@Z
??0MOUNT_POINT_MAP@@QAE@XZ
?Read@IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 93KB - Virtual size: 606KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ