Static task
static1
Behavioral task
behavioral1
Sample
aa01a2a29f25de1779e999a019664d15e6ec760ba5e7eef29584125cf5315dc9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
aa01a2a29f25de1779e999a019664d15e6ec760ba5e7eef29584125cf5315dc9.exe
Resource
win10v2004-20221111-en
General
-
Target
aa01a2a29f25de1779e999a019664d15e6ec760ba5e7eef29584125cf5315dc9
-
Size
351KB
-
MD5
4aa561db4824daca24aef7a9eb57ee88
-
SHA1
5fef4c5aed6d4b28479f55f0d1a3f9870b1f9c61
-
SHA256
aa01a2a29f25de1779e999a019664d15e6ec760ba5e7eef29584125cf5315dc9
-
SHA512
9d48d77984e86db1223719266f57dde600900c57e1954e882a78eafebf755ff50c3888447365a6491e9e8c5bb1db2598307eaf41ac47115e0a35525053e85752
-
SSDEEP
6144:XjIsEKnUD+UpaXJ2RzsK2kZkhNc+TyghdQBVi4QbDqQP:z7ExDXAwLZmugYi4Qb+QP
Malware Config
Signatures
Files
-
aa01a2a29f25de1779e999a019664d15e6ec760ba5e7eef29584125cf5315dc9.exe windows x86
6574053f4d982ff70d3332cdb9dc3583
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
RpcServerListen
RpcServerRegisterIf
RpcServerRegisterAuthInfoA
RpcServerUseProtseqEpA
RpcServerUnregisterIf
RpcMgmtStopServerListening
NdrServerCall2
kernel32
DeleteFileW
GetLocalTime
PostQueuedCompletionStatus
IsDebuggerPresent
GetPriorityClass
UnlockFile
LocalFree
CompareStringW
GetFileSize
GetTempFileNameW
CreateProcessW
FreeLibrary
ReleaseMutex
QueueUserWorkItem
EnumSystemLocalesA
HeapFree
ReleaseSemaphore
LCMapStringW
CreateFileMappingA
SetFilePointer
WideCharToMultiByte
CreateFileW
CreateTimerQueue
GetACP
GetSystemTime
CreateMutexW
GetShortPathNameA
GetComputerNameW
FreeEnvironmentStringsW
QueryPerformanceFrequency
GetCommandLineA
SetThreadPriority
GetProcessHeap
GlobalMemoryStatusEx
GetUserDefaultLCID
GetVolumePathNamesForVolumeNameW
TlsFree
HeapReAlloc
SetStdHandle
MoveFileW
GetSystemTimeAsFileTime
SetHandleCount
HeapDestroy
GetDriveTypeW
TlsSetValue
CreateDirectoryW
GetOEMCP
GetVolumeInformationW
CreateFileMappingW
GetFileSizeEx
GetQueuedCompletionStatus
SetUnhandledExceptionFilter
UnmapViewOfFile
WriteConsoleA
CopyFileW
CreateTimerQueueTimer
TlsAlloc
RaiseException
GetModuleHandleA
GetSystemInfo
IsValidCodePage
SetFilePointerEx
VirtualFree
LoadLibraryExA
UnregisterWait
CreateSemaphoreW
DeleteTimerQueueEx
CreateThread
OpenProcess
SetErrorMode
ResetEvent
EnterCriticalSection
UnhandledExceptionFilter
CloseHandle
DeleteCriticalSection
LCMapStringA
FlushFileBuffers
TlsGetValue
IsValidLocale
CreateEventW
UnregisterWaitEx
VirtualAlloc
OpenEventA
WaitForSingleObject
SystemTimeToFileTime
HeapSize
SetPriorityClass
GetConsoleMode
GetConsoleOutputCP
WriteFile
SetEndOfFile
FreeEnvironmentStringsA
GetThreadPriority
ExpandEnvironmentStringsW
LockFileEx
DeleteTimerQueueTimer
CreateMutexA
OpenMutexA
GetFileType
CreateIoCompletionPort
CreateEventA
WriteConsoleW
LeaveCriticalSection
RegisterWaitForSingleObject
HeapAlloc
GetStdHandle
SetLastError
GlobalFree
GetComputerNameA
GetCurrentThreadId
GlobalAlloc
RtlUnwind
CompareStringA
GetConsoleCP
ReadFile
WaitForMultipleObjects
MapViewOfFile
CreateFileA
LoadLibraryW
VirtualAllocEx
user32
CharNextExA
CharUpperBuffW
CharPrevExA
wsprintfA
advapi32
GetTokenInformation
InitializeAcl
DuplicateTokenEx
FreeSid
GetTraceEnableFlags
SetServiceStatus
GetTraceEnableLevel
ReportEventW
GetLengthSid
LookupAccountSidA
RegCloseKey
RegisterTraceGuidsA
AddAccessAllowedAce
SetSecurityDescriptorDacl
CloseServiceHandle
RegOpenKeyExW
OpenSCManagerW
DuplicateToken
InitializeSecurityDescriptor
UnregisterTraceGuids
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenServiceW
DeregisterEventSource
AllocateAndInitializeSid
RegCreateKeyExW
StartServiceCtrlDispatcherW
GetTraceLoggerHandle
RegSetValueExW
RegisterEventSourceW
AddAccessDeniedAce
RegQueryValueExW
SetThreadToken
RegisterServiceCtrlHandlerExW
TraceMessage
ConvertStringSecurityDescriptorToSecurityDescriptorA
atmlib
ATMFinish
ATMGetNtmFields
ATMBBoxBaseXYShowTextA
ATMBeginFontChange
ATMFontSelected
ATMGetGlyphListA
ATMRemoveSubstFontW
ATMEnumFontsW
kbdic
KbdLayerDescriptor
Sections
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 324KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ