Static task
static1
Behavioral task
behavioral1
Sample
a606831111f69afcac8ac516fa74b846ff419c865c6e6532c81336f2e65058d2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a606831111f69afcac8ac516fa74b846ff419c865c6e6532c81336f2e65058d2.exe
Resource
win10v2004-20221111-en
General
-
Target
a606831111f69afcac8ac516fa74b846ff419c865c6e6532c81336f2e65058d2
-
Size
2.0MB
-
MD5
f3ee153baebddce2798148d6597f2894
-
SHA1
7f177527e78d0ebc086e3978374470efacdacaad
-
SHA256
a606831111f69afcac8ac516fa74b846ff419c865c6e6532c81336f2e65058d2
-
SHA512
16e7ecbb1a11fd65dee93b3f6ba5c598df00ac411cbaa9f279327f966081bfd6d281d956806d451981b623d23a831482022ccf1eea2b091e5292917d7dbfcadf
-
SSDEEP
49152:3WbhxmCMQWvXjoX15yvbTsep/1huxc2pN:3WKCYvXjoXfm
Malware Config
Signatures
Files
-
a606831111f69afcac8ac516fa74b846ff419c865c6e6532c81336f2e65058d2.exe windows x86
196c2ad8b6c68d2ed073e89c1d23ab53
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
UrlCombineA
PathCombineA
wininet
DeleteUrlCacheEntry
urlmon
URLDownloadToFileA
ws2_32
recvfrom
sendto
WSASetLastError
gethostname
getsockopt
ntohs
getsockname
setsockopt
getaddrinfo
freeaddrinfo
accept
listen
bind
ioctlsocket
gethostbyname
select
__WSAFDIsSet
recv
WSAStartup
closesocket
WSACleanup
socket
WSAGetLastError
inet_addr
htons
connect
send
inet_ntoa
getpeername
shutdown
iphlpapi
GetAdaptersInfo
kernel32
GetModuleHandleA
MultiByteToWideChar
GlobalMemoryStatus
FlushConsoleInputBuffer
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
SetLastError
Sleep
GetTickCount
GetLastError
GetVersion
CloseHandle
TerminateProcess
OpenProcess
GetFileAttributesA
ReadFile
GetFileSize
CreateFileA
GetTempFileNameA
GetCurrentProcessId
FindClose
FindNextFileA
lstrcmpA
FindFirstFileA
CreateDirectoryA
CreateThread
WaitForMultipleObjects
SetFileAttributesA
WaitForSingleObject
SetCurrentDirectoryA
RemoveDirectoryA
AllocConsole
FreeConsole
SetEvent
GetVersionExA
CreateEventA
CreateMutexA
ReleaseMutex
CreateProcessA
ReleaseSemaphore
CreateSemaphoreA
DeleteFileA
CopyFileA
GetStartupInfoA
GetLogicalDrives
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SleepEx
FormatMessageA
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
ExpandEnvironmentStringsA
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
GetTempPathA
GetCurrentProcess
advapi32
LookupAccountSidA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
QueryServiceStatus
GetTokenInformation
DeregisterEventSource
ReportEventA
RegisterEventSourceA
OpenProcessToken
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
shell32
SHFileOperationA
msvcp100
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_BADOFF@std@@3_JB
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDH@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??Bios_base@std@@QBEPAXXZ
psapi
EnumProcesses
EnumProcessModules
GetModuleBaseNameA
msvcr100
strrchr
_ftime64
_strdup
_close
_fileno
_open
abort
_getch
signal
fprintf
strcmp
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
memcpy
memchr
memmove
memset
_localtime64
_time64
printf
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
__CxxFrameHandler3
sprintf
atoi
asctime
getenv
rand
_beginthread
srand
strchr
??_V@YAXPAX@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
fgetc
fputc
ungetc
_lock_file
_unlock_file
fflush
setvbuf
memcpy_s
fwrite
fgetpos
_fseeki64
fsetpos
fclose
remove
_purecall
isdigit
sprintf_s
calloc
malloc
tolower
system
freopen
__iob_func
??0exception@std@@QAE@XZ
isxdigit
vsprintf_s
strtoul
realloc
free
strtol
_errno
sscanf
fread
strstr
strncpy
??0exception@std@@QAE@ABQBD@Z
fseek
_strtoi64
strncmp
fgets
fopen
qsort
fputs
_beginthreadex
strerror
__sys_nerr
isalnum
isspace
_fstat64
_lseeki64
_gmtime64
isalpha
_stat64
islower
isupper
isprint
isgraph
_unlock
__dllonexit
_lock
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
_read
_stricmp
_strnicmp
_stat64i32
_chmod
_fdopen
wcsstr
_vsnprintf
vfprintf
raise
ferror
_setmode
ftell
feof
_wfopen
wldap32
ord30
ord32
ord35
ord79
ord26
ord50
ord60
ord143
ord211
ord22
ord33
ord301
ord27
ord41
ord46
ord200
user32
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
gdi32
DeleteObject
GetBitmapBits
BitBlt
GetObjectA
DeleteDC
SelectObject
CreateCompatibleBitmap
GetDeviceCaps
CreateCompatibleDC
CreateDCA
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 390KB - Virtual size: 390KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ