Static task
static1
Behavioral task
behavioral1
Sample
9467baaad49a980f1fc692237c90fef4778d646c263fafc256bf2296804b7444.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9467baaad49a980f1fc692237c90fef4778d646c263fafc256bf2296804b7444.exe
Resource
win10v2004-20220812-en
General
-
Target
9467baaad49a980f1fc692237c90fef4778d646c263fafc256bf2296804b7444
-
Size
87KB
-
MD5
81a6cbb187f4244e5314dfeb7c2cd54d
-
SHA1
6f1bc1869ef377954da66e136dc88f3be3b1f278
-
SHA256
9467baaad49a980f1fc692237c90fef4778d646c263fafc256bf2296804b7444
-
SHA512
81ce4e120b79497ecf011fffbdd917c571c014bbd3fd807cd881b8ffab607a8811415efd3bcfb98c53a0e4be219690f838a9dce7114145ace9616042bd7d3764
-
SSDEEP
1536:l6zK9P3EA6cyXfBuyWcr9JgS2Ogs76ZQkhrnlUPxt/MfLqQC:0Y3EDbW0yS2q6ZQurQHKC
Malware Config
Signatures
Files
-
9467baaad49a980f1fc692237c90fef4778d646c263fafc256bf2296804b7444.exe windows x86
1b7ca1033d6052d828a7a2243b66ed85
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleA
DeleteFileA
CloseHandle
EnumResourceTypesA
GetCommandLineA
GlobalFlags
CloseHandle
CreateEventW
HeapDestroy
GetFileAttributesW
GetStartupInfoA
GetModuleHandleA
GetEnvironmentVariableA
HeapCreate
GetDriveTypeW
lstrlenA
SetLastError
GetCommandLineA
GetConsoleTitleA
GetTimeFormatW
advapi32
IsValidSid
RegCreateKeyExW
IsValidSecurityDescriptor
RegQueryValueW
RegDeleteValueA
IsValidSid
IsValidSid
CreateProcessAsUserW
RegEnumKeyA
IsValidSid
InitializeSid
IsValidSid
IsValidAcl
cnvfat
ConvertFAT
ConvertFAT
ConvertFAT
ConvertFAT
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 10B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dpqvpob Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE