Static task
static1
Behavioral task
behavioral1
Sample
ae83af18d5daba964036918324a6d5b299e08593a1e8968b7e5f861020063325.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ae83af18d5daba964036918324a6d5b299e08593a1e8968b7e5f861020063325.exe
Resource
win10v2004-20220812-en
General
-
Target
ae83af18d5daba964036918324a6d5b299e08593a1e8968b7e5f861020063325
-
Size
50KB
-
MD5
706997bfd3ec882927b9b96acebd3ae9
-
SHA1
9cb4ed4d2f742cac74813ac05f4baebe3ce6da0d
-
SHA256
ae83af18d5daba964036918324a6d5b299e08593a1e8968b7e5f861020063325
-
SHA512
9f69d03cb9e49c1574c202d46b8f72df96768c41eb2e1c7d475ffb7a8085b196fec35c6a942b52005edc2678e208d3a8b6dd36c3a6aafdfa911d945375321597
-
SSDEEP
1536:3kd6K7mGi5R58xWHdcvr+jBLcDauSNgYwbYO:346375RS1vr+NSygYwbY
Malware Config
Signatures
Files
-
ae83af18d5daba964036918324a6d5b299e08593a1e8968b7e5f861020063325.exe windows x86
b67b9201949fdae10beeff60f2dfb692
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
cmutil
WzToSz
?CIniA_GetEntryFromReg@CIniA@@IBEPAEPAUHKEY__@@PBD1KK@Z
?SetHInst@CIniW@@QAEXPAUHINSTANCE__@@@Z
?GetRegPath@CIniA@@QBEPBDXZ
?Start@CmLogFile@@QAEJH@Z
?SetReadICSData@CIniA@@QAEXH@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBG@Z
?GPPS@CIniA@@QBEPADPBD00@Z
?GetPrimaryFile@CIniW@@QBEPBGXZ
?SetWriteICSData@CIniW@@QAEXH@Z
CmLoadStringW
??4CmLogFile@@QAEAAV0@ABV0@@Z
?GPPB@CIniW@@QBEHPBG0H@Z
??1CmLogFile@@QAE@XZ
??1CIniA@@QAE@XZ
?SetRegPath@CIniA@@QAEXPBD@Z
?Log@CmLogFile@@QAAXW4_CMLOG_ITEM@@ZZ
?Generate@CRandom@@QAEHXZ
?LoadSection@CIniA@@QBEPADPBD@Z
?FormatWrite@CmLogFile@@AAEXW4_CMLOG_ITEM@@PAG@Z
GetOSVersion
?IsEnabled@CmLogFile@@QAEHXZ
CmLoadIconA
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
?SetICSDataPath@CIniA@@QAEXPBD@Z
?SetEntry@CIniW@@QAEXPBG@Z
CmMoveMemory
?CIniW_GetEntryFromReg@CIniW@@IBEPAEPAUHKEY__@@PBG1KK@Z
?GetFile@CIniA@@QBEPBDXZ
??4CIniA@@QAEAAV0@ABV0@@Z
?SetPrimaryFile@CIniW@@QAEXPBG@Z
?LoadSection@CIniW@@QBEPAGPBG@Z
kernel32
SetCommTimeouts
GlobalSize
OpenFileMappingA
GetStartupInfoW
MultiByteToWideChar
HeapSize
BuildCommDCBA
GetProcessTimes
SetConsoleLocalEUDC
GetProfileSectionA
EnumResourceTypesA
GetUserDefaultLCID
SetConsoleHardwareState
GetFileSizeEx
IsDebuggerPresent
FatalAppExitW
WriteFileEx
VirtualAlloc
FreeUserPhysicalPages
CreateDirectoryA
CreateSocketHandle
ResetWriteWatch
EnumResourceTypesW
GetFileTime
SetHandleCount
GetNamedPipeHandleStateA
GetSystemPowerStatus
GetPrivateProfileIntW
HeapUnlock
DeleteTimerQueueTimer
LoadLibraryA
SetConsoleInputExeNameW
ifsutil
?Set@BIG_INT@@QAEXEPBE@Z
?EnableVolumeUpgrade@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
??1MOUNT_POINT_MAP@@UAE@XZ
?Remove@NUMBER_SET@@QAEEPBV1@@Z
?GetDrive@SUPERAREA@@QAEPAVIO_DP_DRIVE@@XZ
??0DIGRAPH_EDGE@@QAE@XZ
?QueryNumber@NUMBER_SET@@QBE?AVBIG_INT@@V2@@Z
?QueryChildren@DIGRAPH@@QBEEKPAVNUMBER_SET@@@Z
?Initialize@CANNED_SECURITY@@QAEEXZ
?Verify@IO_DP_DRIVE@@QAEEVBIG_INT@@0PAVNUMBER_SET@@@Z
?GetData@TLINK@@QAEAAVBIG_INT@@G@Z
?Write@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?IsThisNtfs@IFS_SYSTEM@@SGEVBIG_INT@@KPAX@Z
?SetSystemId@LOG_IO_DP_DRIVE@@QAEEE@Z
?QueryVolumeName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
??0TLINK@@QAE@XZ
?QuerySectorSize@DP_DRIVE@@UBEKXZ
?QueryParentsWithChildren@DIGRAPH@@QBEEPAVNUMBER_SET@@K@Z
?Write@SECRUN@@UAEEXZ
?DoesIntersectSet@NUMBER_SET@@QBEEVBIG_INT@@0@Z
?Remove@NUMBER_SET@@QAEEVBIG_INT@@0@Z
?ForceAutochk@VOL_LIODPDRV@@QAEEEKKGPBVWSTRING@@@Z
?CheckAndRemove@SPARSE_SET@@QAEEVBIG_INT@@PAE@Z
?FlushCache@IO_DP_DRIVE@@QAEEXZ
?QueryFreeDiskSpace@IFS_SYSTEM@@SGEPBVWSTRING@@PAVBIG_INT@@@Z
??1SPARSE_SET@@UAE@XZ
?AddEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?QueryDisjointRangeAndAssignBuffer@TLINK@@QAEPAXPAVBIG_INT@@PAG1PAXK2@Z
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ