Static task
static1
Behavioral task
behavioral1
Sample
cfa869eaadb49aab32b9bb3f67a78aa9ad0e421e3758f70e40cc55c0f77c7082.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cfa869eaadb49aab32b9bb3f67a78aa9ad0e421e3758f70e40cc55c0f77c7082.exe
Resource
win10v2004-20220901-en
General
-
Target
cfa869eaadb49aab32b9bb3f67a78aa9ad0e421e3758f70e40cc55c0f77c7082
-
Size
871KB
-
MD5
8815e9638c08414242bbcc979e7b2e2b
-
SHA1
42cfb8d6b81dc6d903e6fff7b567641f28f0a8ce
-
SHA256
cfa869eaadb49aab32b9bb3f67a78aa9ad0e421e3758f70e40cc55c0f77c7082
-
SHA512
e3831871eadaa55e88321fc0cec3998b9bcc6fa7af403c569100da991d34afadda394b1d9ad075ce5022e374688210385245e424ce0641a1abc54cb22f54c5d6
-
SSDEEP
24576:5YLXrLpBb7IDwcJtkjQN16rinjJwRJ5G0Bq:5YzpBuoGYiFQB
Malware Config
Signatures
Files
-
cfa869eaadb49aab32b9bb3f67a78aa9ad0e421e3758f70e40cc55c0f77c7082.exe windows x86
f8983623309849af6130cfaf38d6573e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapCreate
IsBadCodePtr
GetStartupInfoA
CreateFileMappingA
GetStdHandle
GetACP
GetEnvironmentVariableA
GetCommandLineW
SetEvent
TlsGetValue
HeapDestroy
CancelIo
GetModuleFileNameA
CreateFileA
GetModuleHandleA
SetLastError
lstrlenA
ReleaseMutex
ResetEvent
TlsAlloc
advapi32
IsTextUnicode
ClearEventLogW
RegCreateKeyExW
RegEnumKeyA
IsValidSid
InitializeSid
IsValidAcl
CreateServiceW
IsValidSecurityDescriptor
ControlService
RegDeleteValueA
RegQueryValueW
CreateProcessAsUserA
stclient
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
timedate.cpl
CPlApplet
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 862KB - Virtual size: 882KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE