Static task
static1
Behavioral task
behavioral1
Sample
c5071b6ba8998a0f0233d0b28f8951aca4a0f6c4debb45a33322c1ff8c35a464.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c5071b6ba8998a0f0233d0b28f8951aca4a0f6c4debb45a33322c1ff8c35a464.exe
Resource
win10v2004-20220812-en
General
-
Target
c5071b6ba8998a0f0233d0b28f8951aca4a0f6c4debb45a33322c1ff8c35a464
-
Size
76KB
-
MD5
5ac1555f92ccd81a2e75b08cdc58ce6c
-
SHA1
8074217f644199deb6f945e281a268a55fdb5082
-
SHA256
c5071b6ba8998a0f0233d0b28f8951aca4a0f6c4debb45a33322c1ff8c35a464
-
SHA512
2e087903f76c695566db96ee65c45f4622b2632e7e4cbd41fe1a276f959df684b4401b1b65ac21d3e3fa68ca0ae80fccfab4b34dd4e4a8bc8ffd15f2816dc9f8
-
SSDEEP
1536:1WGUp/mDktZGNN6jpmmLwKPYjb+zUNQd4fNPILQH88MaLSUNuFWhvu:7A+DEZo2tzl4fcR5kuIh
Malware Config
Signatures
Files
-
c5071b6ba8998a0f0233d0b28f8951aca4a0f6c4debb45a33322c1ff8c35a464.exe windows x86
999c6c515c50cf5a3681430a33984388
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
strstr
NtMapViewOfSection
isprint
tolower
isspace
_snprintf
memset
memcpy
_chkstk
RtlUnwind
NtQueryVirtualMemory
kernel32
CreateProcessA
VirtualFree
CreateToolhelp32Snapshot
lstrcmpiW
Process32NextW
Process32FirstW
lstrcpyA
ExitProcess
MoveFileExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
lstrlenA
CreateFileA
GetLastError
DeviceIoControl
CloseHandle
GetThreadContext
SetThreadContext
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
TerminateProcess
GetSystemDirectoryA
GetProcAddress
VirtualAlloc
CreateFileMappingA
WriteProcessMemory
ResumeThread
user32
CharUpperBuffA
advapi32
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
shell32
ShellExecuteA
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE