start
Static task
static1
Behavioral task
behavioral1
Sample
9339435932a2b48b049117ab73462a3bf1647b6981cd81eb4f7b96a7fa01c5d7.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9339435932a2b48b049117ab73462a3bf1647b6981cd81eb4f7b96a7fa01c5d7.dll
Resource
win10v2004-20220901-en
General
-
Target
9339435932a2b48b049117ab73462a3bf1647b6981cd81eb4f7b96a7fa01c5d7
-
Size
460KB
-
MD5
19694e36c80cc585af7b5f7730a25a22
-
SHA1
993eb257fd8dd46f1a75ee6528a7b255d1d210ba
-
SHA256
9339435932a2b48b049117ab73462a3bf1647b6981cd81eb4f7b96a7fa01c5d7
-
SHA512
515cc2d023d1621fb171884f110b83b0d74c2d4953f94368d92d4ae0539cfc41625e7df7f7cb58e217d487698e842996e9ca0338022d775a8b998cb2c3fa158e
-
SSDEEP
6144:xicerrMK1rR6DsZ7aPTSxBeGWx3KY6s9tlhS3JTBHvuF3czi14smtD9u2qDyLPOK:QgGJzBWF6sQJThvuFMTQ2ZTO18
Malware Config
Signatures
Files
-
9339435932a2b48b049117ab73462a3bf1647b6981cd81eb4f7b96a7fa01c5d7.dll windows x86
b917a2027806aea245964dd31af6b3da
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord3610
ord4376
ord4853
ord796
ord656
ord529
ord2289
ord2370
ord2302
ord6199
ord2642
ord926
ord6334
ord5655
ord6067
ord6000
ord2117
ord6069
ord3876
ord2814
ord833
ord861
ord500
ord2086
ord5860
ord6142
ord772
ord758
ord475
ord4710
ord4234
ord641
ord324
ord3597
ord4425
ord5280
ord1775
ord6052
ord2514
ord4998
ord5265
ord6453
ord1146
ord2859
ord3571
ord6282
ord2820
ord6383
ord5440
ord6215
ord4299
ord5787
ord3573
ord2379
ord6380
ord6197
ord562
ord816
ord5875
ord5789
ord3626
ord3619
ord4275
ord1949
ord6283
ord2107
ord2044
ord2448
ord2841
ord6394
ord5834
ord5450
ord3663
ord536
ord356
ord2770
ord2781
ord4058
ord3178
ord1980
ord668
ord5856
ord5773
ord567
ord1233
ord6442
ord818
ord3742
ord4627
ord3402
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord2256
ord1200
ord2726
ord924
ord565
ord817
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5715
ord5289
ord5307
ord4699
ord4079
ord5303
ord5300
ord3346
ord2396
ord4226
ord1948
ord5572
ord6877
ord5683
ord5710
ord2860
ord323
ord1640
ord5785
ord2405
ord2414
ord640
ord2763
ord6662
ord4277
ord6385
ord1641
ord289
ord613
ord2915
ord1187
ord4278
ord654
ord541
ord341
ord801
ord860
ord535
ord1168
ord4202
ord2764
ord4129
ord939
ord354
ord5186
ord3318
ord665
ord5442
ord1979
ord941
ord6929
ord858
ord2614
ord533
ord5194
ord3811
ord540
ord3337
ord2818
ord6407
ord1997
ord798
ord537
ord825
ord800
ord1575
ord1182
ord823
ord342
ord1253
ord3092
msvcrt
malloc
_callnewh
wcslen
time
memcmp
strstr
_mbscmp
sscanf
_mbsicmp
wcsstr
strftime
localtime
_CIacos
_CIpow
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
_adjust_fdiv
fflush
exit
memset
printf
fprintf
_iob
free
calloc
__CxxFrameHandler
_except_handler3
_vsnprintf
sprintf
strcat
memcpy
strcpy
strncmp
strlen
strtoul
rand
srand
_ftol
_CxxThrowException
ceil
pow
log10
abs
strcmp
strncpy
strchr
_strlwr
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
atoi
memmove
wcscmp
_strupr
_beginthreadex
getenv
_flushall
system
strrchr
??0exception@@QAE@ABV0@@Z
realloc
_purecall
kernel32
GetSystemInfo
VirtualQueryEx
ReadProcessMemory
Module32First
FormatMessageA
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
TlsGetValue
TlsSetValue
SetEvent
ReleaseMutex
TlsFree
TlsAlloc
CreateMutexA
CreateEventA
GetVersion
WaitForSingleObject
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateThread
lstrlenA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
GetSystemDirectoryA
GetLastError
HeapFree
GetVersionExA
GetCurrentProcessId
OpenProcess
UnmapViewOfFile
CloseHandle
MapViewOfFile
LocalFree
FreeLibrary
LoadLibraryA
GetProcAddress
Sleep
GetCommandLineA
GetModuleHandleA
lstrcmpA
Module32Next
DuplicateHandle
SetConsoleCtrlHandler
lstrlenW
LocalAlloc
GetTempPathA
Beep
GetPrivateProfileStringA
ExitThread
ExitProcess
HeapAlloc
GetProcessHeap
GetModuleFileNameA
GlobalReAlloc
GlobalUnlock
GlobalAlloc
GlobalLock
GetTickCount
GlobalFree
WinExec
DeleteFileA
SetFileAttributesA
MoveFileA
SetLastError
MultiByteToWideChar
GetExitCodeThread
VirtualFreeEx
TerminateProcess
CreateProcessA
GetStartupInfoA
TerminateThread
WriteConsoleInputA
GetStdHandle
ReadConsoleOutputCharacterA
ReadConsoleOutputA
GetConsoleScreenBufferInfo
CopyFileA
SetCurrentDirectoryA
AllocConsole
FreeConsole
WriteFile
LeaveCriticalSection
ReadFile
EnterCriticalSection
WaitForMultipleObjectsEx
InitializeCriticalSection
SetStdHandle
CreatePipe
GetWindowsDirectoryA
Thread32Next
OpenThread
Thread32First
GetCurrentThreadId
WideCharToMultiByte
GetDiskFreeSpaceExA
lstrcpyA
GetDriveTypeA
FindClose
FindNextFileA
FindFirstFileA
lstrcatA
GetFileSize
CreateFileA
SetFilePointer
CreateDirectoryA
RemoveDirectoryA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
GetEnvironmentVariableW
DeviceIoControl
lstrcmpiA
GetComputerNameA
GetLogicalDrives
GlobalMemoryStatus
OutputDebugStringA
DeleteCriticalSection
lstrcpynA
user32
GetDCEx
KillTimer
EndDialog
SetTimer
SetForegroundWindow
SetWindowPos
DialogBoxParamA
RegisterWindowMessageA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumChildWindows
GetForegroundWindow
GetKeyState
GetAsyncKeyState
GetWindowTextA
GetWindowThreadProcessId
ShowWindow
LoadBitmapA
SendMessageTimeoutA
SetRect
CopyRect
GetWindow
GetWindowLongA
GetDesktopWindow
ReleaseDC
GetDC
GetWindowRect
SwapMouseButton
ScreenToClient
WindowFromPoint
EnumWindows
GetWindowPlacement
IsCharAlphaNumericA
GetTopWindow
IsWindowVisible
GetCursorPos
CloseWindow
MessageBoxA
FillRect
InvalidateRect
SetWindowRgn
SetWindowLongA
DefWindowProcA
LoadIconA
RegisterClassA
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
EnumDisplayDevicesA
GetClientRect
SendMessageA
LoadCursorA
OpenInputDesktop
GetUserObjectInformationA
SetThreadDesktop
GetThreadDesktop
OpenDesktopA
CloseDesktop
GetClassNameA
PostMessageA
GetCursor
IsRectEmpty
PostThreadMessageA
PostQuitMessage
GetIconInfo
DestroyIcon
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
IsWindowUnicode
RegisterHotKey
UnregisterHotKey
CharToOemA
GetWindowDC
GetSystemMetrics
SetCursorPos
mouse_event
keybd_event
EnableWindow
SystemParametersInfoA
ExitWindowsEx
gdi32
CreatePatternBrush
PatBlt
ExtCreateRegion
CombineRgn
CreateSolidBrush
CreateFontIndirectA
BeginPath
EndPath
PathToRegion
GetDeviceCaps
GetBitmapBits
CreateDCA
GetPixel
GetStockObject
SelectPalette
RealizePalette
CreateCompatibleBitmap
CreateDIBSection
BitBlt
DeleteObject
GetObjectA
CreateCompatibleDC
SelectObject
GetDIBits
DeleteDC
CreateBitmap
advapi32
RegCreateKeyA
RegEnumKeyExA
RegDeleteValueA
EnumServicesStatusA
DeleteService
ChangeServiceConfigA
ControlService
StartServiceA
OpenSCManagerA
CloseServiceHandle
OpenServiceA
QueryServiceConfigA
ImpersonateLoggedOnUser
GetUserNameA
RevertToSelf
RegQueryValueExA
CreateProcessAsUserA
RegOpenKeyA
RegEnumValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegisterEventSourceA
ReportEventA
DeregisterEventSource
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
RegEnumKeyA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
SHGetFileInfoA
ExtractIconExA
ole32
CreateStreamOnHGlobal
CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
olepro32
ord251
oleaut32
VariantClear
SysFreeString
GetErrorInfo
urlmon
URLDownloadToFileA
msvcp60
??1_Lockit@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?nothrow@std@@3Unothrow_t@1@B
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0_Lockit@std@@QAE@XZ
wininet
InternetCheckConnectionA
HttpQueryInfoA
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
msvfw32
ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
shlwapi
SHDeleteValueA
SHDeleteKeyA
ntdll
ZwOpenSection
_strcmpi
_strnicmp
_wcsicmp
_stricmp
ZwQuerySystemInformation
ZwOpenFile
RtlInitUnicodeString
winmm
waveInAddBuffer
mciSendStringA
mixerGetID
mixerOpen
mixerGetLineInfoA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerClose
sndPlaySoundA
timeGetTime
waveOutGetNumDevs
waveOutSetVolume
waveOutOpen
waveOutGetErrorTextA
waveOutClose
waveOutReset
waveOutUnprepareHeader
waveOutWrite
waveOutPrepareHeader
waveInStart
waveInPrepareHeader
waveInOpen
waveInGetErrorTextA
waveInClose
waveInReset
waveInStop
waveInUnprepareHeader
waveOutGetDevCapsA
ws2_32
WSARecv
send
recv
gethostname
__WSAFDIsSet
WSAAsyncSelect
WSAConnect
sendto
WSAAsyncGetHostByName
recvfrom
setsockopt
WSACloseEvent
WSACreateEvent
WSASend
WSAStartup
WSACleanup
ntohs
WSAGetLastError
WSASetLastError
bind
socket
inet_ntoa
htonl
getservbyname
htons
inet_addr
gethostbyname
gethostbyaddr
getservbyport
closesocket
getsockname
getpeername
ntohl
WSASendTo
WSARecvFrom
WSASocketA
accept
select
ioctlsocket
connect
listen
WSAGetOverlappedResult
WSAResetEvent
WSAWaitForMultipleEvents
Exports
Exports
Sections
.text Size: 288KB - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ