Static task
static1
Behavioral task
behavioral1
Sample
a06503843392f76e817a8480d72e17bc3902c511fd9a2574e73ba433853e88ac.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a06503843392f76e817a8480d72e17bc3902c511fd9a2574e73ba433853e88ac.exe
Resource
win10v2004-20220901-en
General
-
Target
a06503843392f76e817a8480d72e17bc3902c511fd9a2574e73ba433853e88ac
-
Size
733KB
-
MD5
87426f205c4d8df7d7e48ec961450561
-
SHA1
a222fd65848060035f4210afc36385a5e69404ef
-
SHA256
a06503843392f76e817a8480d72e17bc3902c511fd9a2574e73ba433853e88ac
-
SHA512
a8bbb6694f37d87edc8c458b8ddc92e6829734e92f1f7fc5ef04e00c65527fe5b20545dbde6941e9ac6d2ea89103633447e1fdf021a76fa159cf00da1fa3cc30
-
SSDEEP
12288:sn/Rl1uMjUJBAb2oZ//i3XYrvldjqpDoUCOsFzjuWZaueWwCfcHbujk9Jc9gM:sZl/jUo2m//ianupcFzqWZje5aOby3
Malware Config
Signatures
Files
-
a06503843392f76e817a8480d72e17bc3902c511fd9a2574e73ba433853e88ac.exe windows x86
41dd0c065074ba3bdbce3e7b5e648b67
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetNamedSecurityInfoW
GetSecurityDescriptorLength
RegisterEventSourceW
CryptDuplicateHash
CryptSetKeyParam
SetNamedSecurityInfoW
PrivilegedServiceAuditAlarmW
InitializeSecurityDescriptor
CreateServiceW
FindFirstFreeAce
GetTrusteeTypeA
RegCreateKeyExA
GetMultipleTrusteeOperationW
NotifyBootConfigStatus
AddAccessDeniedAce
ReadEventLogA
GetTrusteeNameA
ConvertSecurityDescriptorToAccessA
LookupAccountNameA
CreateProcessAsUserW
RegSetKeySecurity
GetSecurityDescriptorGroup
ControlService
DeregisterEventSource
ImpersonateLoggedOnUser
ReportEventA
StartServiceW
RegSetValueA
SetAclInformation
DuplicateTokenEx
SetThreadToken
SetSecurityDescriptorSacl
SetFileSecurityW
CryptSetProviderExW
ObjectCloseAuditAlarmW
CryptSetProvParam
SetEntriesInAuditListW
RegDeleteKeyW
LogonUserW
GetKernelObjectSecurity
UnlockServiceDatabase
AddAce
EqualPrefixSid
RegDeleteValueW
EnumServicesStatusA
GetServiceKeyNameW
InitiateSystemShutdownA
RegOpenKeyExW
RegQueryValueW
GetFileSecurityA
CloseEventLog
BackupEventLogW
CryptVerifySignatureA
CryptDecrypt
SetNamedSecurityInfoExW
ObjectPrivilegeAuditAlarmA
CryptHashSessionKey
GetOverlappedAccessResults
OpenEventLogA
StartServiceCtrlDispatcherW
CryptGenKey
RegEnumKeyW
GetAclInformation
ClearEventLogW
SetKernelObjectSecurity
AdjustTokenGroups
RevertToSelf
GetSidIdentifierAuthority
MakeAbsoluteSD
ConvertSecurityDescriptorToAccessNamedA
RegOpenKeyA
ConvertAccessToSecurityDescriptorA
RegSaveKeyW
RegGetKeySecurity
GetSidSubAuthorityCount
LookupSecurityDescriptorPartsA
BuildExplicitAccessWithNameW
AddAuditAccessAce
SetEntriesInAccessListW
InitiateSystemShutdownW
GetSecurityDescriptorSacl
FreeSid
LockServiceDatabase
ClearEventLogA
GetPrivateObjectSecurity
OpenServiceW
IsValidSecurityDescriptor
SetNamedSecurityInfoExA
GetExplicitEntriesFromAclA
CryptDestroyHash
AllocateAndInitializeSid
RegisterEventSourceA
GetSecurityInfoExW
CryptSetProviderA
RegReplaceKeyA
QueryServiceConfigA
IsTextUnicode
RegCreateKeyW
GetNamedSecurityInfoExA
QueryServiceLockStatusW
BuildExplicitAccessWithNameA
AddAccessAllowedAce
CryptAcquireContextA
MakeSelfRelativeSD
RegEnumKeyExW
BuildImpersonateExplicitAccessWithNameW
CryptEnumProvidersA
RegDeleteKeyA
RegQueryInfoKeyA
ChangeServiceConfigW
CryptGetKeyParam
CryptSetHashParam
CopySid
ConvertAccessToSecurityDescriptorW
LookupAccountNameW
GetMultipleTrusteeA
ConvertSecurityDescriptorToAccessW
BuildTrusteeWithSidW
GetMultipleTrusteeW
GetSidSubAuthority
shlwapi
UrlGetPartW
PathRenameExtensionA
ChrCmpIW
StrCatBuffA
PathCommonPrefixW
SHEnumKeyExA
SHRegWriteUSValueA
PathUnquoteSpacesW
PathUndecorateA
StrCmpW
PathCombineA
SHRegDeleteEmptyUSKeyA
AssocQueryStringW
PathRenameExtensionW
SHDeleteEmptyKeyW
PathIsUNCW
SHDeleteValueW
UrlIsOpaqueW
PathFindFileNameA
StrCmpNW
PathAddBackslashW
StrFormatKBSizeW
PathIsNetworkPathW
UrlCreateFromPathW
SHRegEnumUSKeyW
PathCanonicalizeW
PathIsRelativeW
StrRetToStrW
UrlUnescapeW
PathUnquoteSpacesA
UrlIsNoHistoryW
SHAutoComplete
PathFindSuffixArrayA
SHQueryValueExW
StrCSpnIA
PathAddExtensionW
UrlGetLocationW
PathIsContentTypeA
StrRChrIW
IntlStrEqWorkerW
UrlCanonicalizeW
StrCatBuffW
StrChrIA
PathIsLFNFileSpecA
StrSpnA
PathIsUNCA
PathIsUNCServerA
PathIsSameRootW
SHCreateStreamOnFileW
PathUnmakeSystemFolderW
StrRetToStrA
UrlIsOpaqueA
PathAddExtensionA
PathParseIconLocationA
ColorRGBToHLS
PathMakePrettyW
PathSearchAndQualifyW
StrToIntA
StrPBrkA
StrRetToBufA
SHRegDeleteUSValueW
SHCopyKeyW
SHDeleteEmptyKeyA
SHOpenRegStream2A
StrCmpIW
PathSearchAndQualifyA
StrCpyW
UrlEscapeW
PathGetDriveNumberW
wvnsprintfA
UrlHashA
PathIsDirectoryW
SHRegGetUSValueA
PathIsRootW
SHRegDuplicateHKey
PathUnmakeSystemFolderA
StrFromTimeIntervalW
SHRegSetUSValueW
PathRemoveExtensionW
UrlCompareA
PathIsURLW
PathRemoveExtensionA
PathUndecorateW
StrFormatByteSizeW
StrFormatKBSizeA
StrRChrW
StrFormatByteSizeA
PathFindNextComponentA
SHOpenRegStreamW
StrCpyNW
SHCreateShellPalette
StrCSpnIW
UrlIsW
PathFindNextComponentW
StrToIntW
PathGetDriveNumberA
SHSetThreadRef
PathIsFileSpecA
UrlApplySchemeW
StrRChrIA
PathQuoteSpacesA
PathIsFileSpecW
ChrCmpIA
PathIsSystemFolderW
PathMatchSpecA
StrStrW
StrNCatW
UrlCombineA
PathRemoveArgsW
StrIsIntlEqualW
SHRegGetBoolUSValueA
SHDeleteKeyA
SHRegDeleteUSValueA
SHGetValueW
PathFindFileNameW
user32
GetForegroundWindow
RegisterWindowMessageW
BroadcastSystemMessageW
InSendMessageEx
BeginPaint
CheckMenuItem
TranslateAcceleratorW
AppendMenuW
CallWindowProcA
GetKeyboardLayoutNameA
MapVirtualKeyExW
TranslateAccelerator
EnumDesktopsW
SetSysColors
OpenWindowStationA
EnableScrollBar
GetMenuItemID
DdeClientTransaction
OemToCharBuffA
DlgDirListComboBoxW
CharUpperBuffW
SetKeyboardState
DialogBoxParamW
IsWindowUnicode
LoadCursorA
GetSubMenu
BroadcastSystemMessage
CopyRect
ToUnicode
ValidateRgn
GetMonitorInfoW
GetKeyboardLayoutList
CharNextExA
CallMsgFilterA
DefDlgProcW
DdeEnableCallback
InternalGetWindowText
IsWindow
SetMessageExtraInfo
LoadBitmapW
HideCaret
SetUserObjectInformationA
EnumDisplayDevicesW
CheckRadioButton
GetTopWindow
GetClassNameW
CharLowerBuffA
GetMenuItemInfoA
DrawCaption
UnionRect
CreateIconFromResource
UnregisterHotKey
GetTabbedTextExtentW
CreateDialogIndirectParamW
CreateMDIWindowW
DdeInitializeW
IsDlgButtonChecked
DdeFreeDataHandle
PeekMessageA
CharPrevA
SwitchDesktop
DeleteMenu
GetWindowModuleFileNameW
DispatchMessageW
GetPriorityClipboardFormat
SetScrollPos
GetClassInfoA
GetDlgItemTextA
MapVirtualKeyExA
RegisterClipboardFormatA
IsCharAlphaNumericW
GetProcessWindowStation
DrawIcon
GetGuiResources
CreateWindowExA
GetMenuDefaultItem
DlgDirListComboBoxA
UnloadKeyboardLayout
IsCharUpperW
PtInRect
GetUserObjectInformationA
DlgDirSelectExA
SetWindowTextA
GetListBoxInfo
DdeAbandonTransaction
GetClassInfoW
CreateCursor
SetWindowsHookExW
GetClassLongW
DlgDirListA
ScreenToClient
LoadIconA
IsWindowVisible
InflateRect
DdePostAdvise
DestroyAcceleratorTable
CreateMenu
SetSystemCursor
GetNextDlgGroupItem
GetClipCursor
GetMenuState
DrawStateW
DdeQueryNextServer
IsWindowEnabled
SetThreadDesktop
RealGetWindowClass
PaintDesktop
LockWindowUpdate
CallMsgFilterW
TrackPopupMenu
GetMonitorInfoA
GetCaretPos
SetWindowPlacement
RemovePropA
CharToOemBuffA
SendInput
CreateWindowStationA
OpenIcon
RemoveMenu
DrawTextExA
OffsetRect
CharUpperBuffA
GetClassNameA
MenuItemFromPoint
EnumPropsA
DrawTextA
SwitchToThisWindow
GetClassInfoExA
kernel32
SetCalendarInfoA
LocalShrink
WriteTapemark
FillConsoleOutputCharacterA
Process32First
OpenEventA
CopyFileExW
CompareStringA
FreeLibrary
GetQueuedCompletionStatus
FindAtomW
GetSystemDirectoryW
IsBadCodePtr
GetTimeFormatW
GetExitCodeThread
SetFileApisToOEM
WriteProfileStringA
GetFileInformationByHandle
lstrcmpW
CommConfigDialogW
SetConsoleCP
ReadConsoleW
VirtualAlloc
GetEnvironmentVariableW
LCMapStringA
lstrcpynW
CallNamedPipeW
GetShortPathNameA
GetEnvironmentStrings
GetModuleFileNameA
LockFileEx
GetProfileIntA
SleepEx
OpenFileMappingW
OutputDebugStringA
CreateSemaphoreA
WriteFileEx
HeapDestroy
FreeResource
GetVersionExA
GetFileAttributesA
GetConsoleTitleA
GetCommandLineW
GetTickCount
EnumDateFormatsA
VirtualProtect
DeleteFiber
WaitForSingleObject
WriteConsoleOutputW
GlobalFlags
lstrcpy
ReadFileEx
FileTimeToSystemTime
Process32Next
FindFirstFileW
GetTapePosition
LocalFileTimeToFileTime
BeginUpdateResourceW
ScrollConsoleScreenBufferA
GlobalFindAtomW
CreateToolhelp32Snapshot
GetFileAttributesW
lstrcmpiW
ConvertThreadToFiber
SetThreadContext
ReadConsoleOutputA
ReadConsoleOutputAttribute
SetConsoleCtrlHandler
GlobalFindAtomA
GetCurrentProcess
GetPrivateProfileIntW
VirtualFreeEx
MapViewOfFile
VerLanguageNameW
VirtualFree
OutputDebugStringW
PulseEvent
GetCommProperties
GetTapeParameters
GetProfileSectionW
GetSystemInfo
GetPrivateProfileStructA
GetCurrencyFormatW
RequestDeviceWakeup
Heap32Next
FreeLibraryAndExitThread
InitializeCriticalSectionAndSpinCount
WritePrivateProfileStructA
CancelIo
LockFile
IsBadHugeWritePtr
TlsAlloc
CreateFileMappingA
IsDBCSLeadByte
EnumTimeFormatsW
GetFileAttributesExA
lstrcpyA
EnumCalendarInfoExA
LoadLibraryExA
GlobalReAlloc
FatalAppExitA
SetEnvironmentVariableA
GetThreadLocale
GetCommConfig
GetPriorityClass
SetFilePointer
QueryDosDeviceW
ConnectNamedPipe
lstrcpynA
GetCurrentDirectoryA
SetSystemTime
SetUnhandledExceptionFilter
WriteFileGather
GetModuleFileNameW
MoveFileExW
GlobalGetAtomNameW
GlobalHandle
SetConsoleTitleW
GetTapeStatus
SearchPathW
GetCurrentThreadId
GetWindowsDirectoryW
WritePrivateProfileStringA
SetConsoleCursorInfo
IsValidCodePage
GetLocaleInfoA
SetThreadLocale
GlobalLock
ole32
CoRegisterMessageFilter
WriteFmtUserTypeStg
CoDosDateTimeToFileTime
OleIsRunning
CoMarshalInterface
CoRevertToSelf
UpdateDCOMSettings
OleSetAutoConvert
SetDocumentBitStg
CoInitialize
CoCreateGuid
OleCreateEmbeddingHelper
CoRegisterSurrogate
ReleaseStgMedium
CoIsHandlerConnected
OleCreateMenuDescriptor
CoUnmarshalHresult
ProgIDFromCLSID
CoInitializeEx
WriteStringStream
OleFlushClipboard
WriteClassStg
CoMarshalHresult
CreateStreamOnHGlobal
CoSwitchCallContext
GetHGlobalFromILockBytes
StgOpenStorage
OleCreateStaticFromData
GetDocumentBitStg
OleConvertIStorageToOLESTREAMEx
CoTaskMemRealloc
OleCreateLinkFromData
OleBuildVersion
OleCreateLinkEx
CoRevokeClassObject
DoDragDrop
StgCreateDocfile
OleUninitialize
CreateDataCache
CoMarshalInterThreadInterfaceInStream
StgCreateStorageEx
CreateObjrefMoniker
IIDFromString
OleGetAutoConvert
CLSIDFromString
CoUninitialize
StgIsStorageFile
CoGetCurrentProcess
CoGetMarshalSizeMax
CoRegisterMallocSpy
CreatePointerMoniker
CoReleaseServerProcess
CoGetInterfaceAndReleaseStream
OleSetClipboard
CoQueryAuthenticationServices
OleCreateLinkToFileEx
MkParseDisplayName
StgIsStorageILockBytes
OleRegGetMiscStatus
OleNoteObjectVisible
CoGetPSClsid
StgOpenStorageEx
CoFreeAllLibraries
OleLockRunning
StringFromGUID2
OleRegGetUserType
OleSetContainedObject
CoRegisterChannelHook
StgCreateDocfileOnILockBytes
SetConvertStg
CoReleaseMarshalData
CoRegisterClassObject
OleIsCurrentClipboard
DllDebugObjectRPCHook
ReadClassStg
ReadClassStm
OleGetIconOfClass
CoGetCurrentLogicalThreadId
OleRegEnumFormatEtc
OleConvertIStorageToOLESTREAM
CoGetStandardMarshal
OleRun
WriteOleStg
GetHookInterface
OleLoadFromStream
OleCreateFromDataEx
CLSIDFromProgID
StringFromIID
CoFileTimeNow
StgGetIFillLockBytesOnILockBytes
MonikerCommonPrefixWith
OleCreateLinkFromDataEx
ReadStringStream
UtConvertDvtd32toDvtd16
EnableHookObject
StgGetIFillLockBytesOnFile
CoTaskMemFree
StgOpenAsyncDocfileOnIFillLockBytes
OleGetClipboard
OleSaveToStream
CoFileTimeToDosDateTime
OleCreateDefaultHandler
CoFreeLibrary
CoFreeUnusedLibraries
OleSave
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 177B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE