Static task
static1
Behavioral task
behavioral1
Sample
cf853aa8a49edb68b87d06e3b734b104e6d6e25b467d1280a30440349a9591cf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf853aa8a49edb68b87d06e3b734b104e6d6e25b467d1280a30440349a9591cf.exe
Resource
win10v2004-20221111-en
General
-
Target
cf853aa8a49edb68b87d06e3b734b104e6d6e25b467d1280a30440349a9591cf
-
Size
2.8MB
-
MD5
bc50754ae6761b88f3889c8141b7a289
-
SHA1
fb4b27cb1ff495e8215ae684ed79a7d6a05dae2c
-
SHA256
cf853aa8a49edb68b87d06e3b734b104e6d6e25b467d1280a30440349a9591cf
-
SHA512
e8b5f7bf0e85d8501b4808018fa47b90b0f2e3e6cda7b1076feb0f24b759505e6bc33bc56a1be75d6e8633da7e0fb4d8cf1acc31515ccf0cb4869f78f4eae593
-
SSDEEP
768:lGtnK2hY7DHQxAo7VwidvD3bHUMscJWWjd56K:lKK2O7DHQvVpD3b0Mst
Malware Config
Signatures
Files
-
cf853aa8a49edb68b87d06e3b734b104e6d6e25b467d1280a30440349a9591cf.exe windows x86
5ded618612757132417be3630adf1a03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
inet_addr
recv
send
socket
gethostname
WSAAsyncSelect
closesocket
WSAStartup
WSACleanup
connect
kernel32
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FlushConsoleInputBuffer
FlushFileBuffers
GetCommandLineA
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetDiskFreeSpaceA
GetDriveTypeA
GetLastError
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetProcessHeap
GetStdHandle
GetTickCount
GetVolumeInformationA
GlobalMemoryStatus
HeapAlloc
LoadLibraryA
LocalAlloc
OpenProcess
Process32First
Process32Next
ReadConsoleA
CreateFileA
ReadConsoleOutputA
ReadConsoleOutputW
ReadConsoleW
ReadFile
RtlUnwind
ScrollConsoleScreenBufferA
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
TerminateProcess
TerminateThread
CreatePipe
CreateProcessA
WriteConsoleA
WriteConsoleOutputA
WriteConsoleOutputW
WriteConsoleW
WriteFile
lstrlenA
lstrlenW
CreateThread
CreateToolhelp32Snapshot
user32
GetWindowTextA
GetParent
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
EnumWindows
CreateWindowExA
DefWindowProcA
advapi32
LookupAccountSidA
LookupPrivilegeValueA
ChangeServiceConfigA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
EnumServicesStatusExA
LockServiceDatabase
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
QueryServiceConfig2A
QueryServiceStatus
QueryServiceStatusEx
StartServiceA
UnlockServiceDatabase
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
GetLengthSid
CopySid
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
GetCurrentHwProfileA
crtdll
__GetMainArgs
atoi
exit
free
malloc
memset
printf
raise
signal
sprintf
sscanf
strchr
strcmp
strcpy
strlen
strncmp
strrchr
strstr
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE