Static task
static1
Behavioral task
behavioral1
Sample
8258863e64bd7ba96e5d6baaf5aad81e5335421a8fcca10e339beda9a53a1bfd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8258863e64bd7ba96e5d6baaf5aad81e5335421a8fcca10e339beda9a53a1bfd.exe
Resource
win10v2004-20220812-en
General
-
Target
8258863e64bd7ba96e5d6baaf5aad81e5335421a8fcca10e339beda9a53a1bfd
-
Size
820KB
-
MD5
8e4200fbe83daaea294e0f12859a10fe
-
SHA1
9565443e2c95901f807aeccfa6d6dbbd90bbe801
-
SHA256
8258863e64bd7ba96e5d6baaf5aad81e5335421a8fcca10e339beda9a53a1bfd
-
SHA512
aaf5441b3d1fc881cff87955e313308d9dcf57771670eaf5dec6db5930698e646369cf744b91ec90a2b8441a8088f5bc6b466bb61d68225e83cd4e8f8f76d1ec
-
SSDEEP
24576:qGBmlwBbvxV66UDloktXy7GmrYSGyTMyFw:JB7xVLUDlJtXy7GmrRGQMF
Malware Config
Signatures
Files
-
8258863e64bd7ba96e5d6baaf5aad81e5335421a8fcca10e339beda9a53a1bfd.exe windows x86
a9169b3969844cd457e8d74f11fdc771
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetStdHandle
WriteFile
GlobalFree
ResumeThread
GetModuleHandleW
GetACP
GetCommandLineA
GetExitCodeProcess
InterlockedExchange
CreateEventA
CreateMutexA
GetPrivateProfileIntW
VirtualAlloc
GlobalSize
LocalFree
ResetEvent
GetEnvironmentVariableW
lstrlenA
FindVolumeClose
advapi32
RegCreateKeyExW
IsValidSid
ControlService
RegDeleteKeyA
IsTextUnicode
RegCloseKey
RegEnumKeyW
RegDeleteValueA
ClearEventLogA
IsValidAcl
CloseEventLog
CreateServiceA
RegQueryValueW
admparse
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
hdwwiz.cpl
InstallNewDevice
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 811KB - Virtual size: 810KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ