Static task
static1
Behavioral task
behavioral1
Sample
5df1432e46b888724666226855826caa171e936a63166041c50822ad83d96cfd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5df1432e46b888724666226855826caa171e936a63166041c50822ad83d96cfd.exe
Resource
win10v2004-20221111-en
General
-
Target
5df1432e46b888724666226855826caa171e936a63166041c50822ad83d96cfd
-
Size
263KB
-
MD5
79da956c102a5adb3892d7abafaa6325
-
SHA1
435f6bfa932db6a692230421c091cf5c701759a2
-
SHA256
5df1432e46b888724666226855826caa171e936a63166041c50822ad83d96cfd
-
SHA512
65a00c0e72e4c63bd138f4c715b2f67db73315e17eff872e65bbb21784c9d42ffd4427e00fa0680b912ca87e79f714314216c00812204a6cec5632614cf37c59
-
SSDEEP
6144:/pkKVvQvM6vAfmbRuNNMAI7QwCB3x4GKvt8zGTyfjD/:/pkK2FhNyN8s9x4XqL
Malware Config
Signatures
Files
-
5df1432e46b888724666226855826caa171e936a63166041c50822ad83d96cfd.exe windows x86
fa63d8a8a53340afa18f8f6d5c4685ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
SignalObjectAndWait
VirtualFree
CreateMutexA
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
WriteFile
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
OutputDebugStringW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapReAlloc
VirtualAlloc
HeapFree
HeapCreate
HeapDestroy
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
HeapAlloc
GetEnvironmentStringsW
ExitProcess
LCMapStringW
oleaut32
RegisterTypeLi
DispGetIDsOfNames
VariantCopyInd
LoadTypeLibEx
VarOr
VarWeekdayName
VarDecSu
VarBoolFromDec
LoadTypeLi
SafeArrayDestroyData
SafeArrayGetElement
SafeArrayDestroyDescriptor
VarDecFromDate
SafeArrayPtrOfIndex
VarDecNeg
VarParseNumFromStr
VarDecFromDisp
VarDecAbs
VarPow
VarBstrFromDisp
VariantChangeType
VarBstrFromBool
VarFormatCurrency
CreateErrorInfo
CreateStdDispatch
RevokeActiveObject
VarDecDiv
SafeArrayCopyData
VarFormatFromTokens
DispInvoke
CreateTypeLi
VarFormatNumber
CreateTypeLib2
VarBstrFromDate
VarBstrCat
GetAltMonthNames
SafeArrayGetLBound
GetErrorInfo
VarFormatDateTime
GetRecordInfoFromTypeInfo
VarMod
SafeArrayAllocData
SafeArrayAllocDescriptorEx
advapi32
RegEnumKeyA
Sections
.text Size: 230KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ