Static task
static1
Behavioral task
behavioral1
Sample
ae76319edb4ab7426202f99f0cd60820f7303c93ce40799ed587b3baf27d2271.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ae76319edb4ab7426202f99f0cd60820f7303c93ce40799ed587b3baf27d2271.exe
Resource
win10v2004-20220812-en
General
-
Target
ae76319edb4ab7426202f99f0cd60820f7303c93ce40799ed587b3baf27d2271
-
Size
820KB
-
MD5
020bd6e416be8da5e2e248205c6123fc
-
SHA1
386c3cdc4f52e45c6d6e1120030d505327547263
-
SHA256
ae76319edb4ab7426202f99f0cd60820f7303c93ce40799ed587b3baf27d2271
-
SHA512
219366c46bac2900b9fab1572a99863d37b92af9b73b0920523f8861bf9729540764ddb3616bd44dc816466d6b72fb5fe0a9b2feba2976b2122fe039f52ef577
-
SSDEEP
24576:IRWQcxumsrW3Whstyp27txjXxkYgK3nQAT:IR+0rrWGKE8jjbd
Malware Config
Signatures
Files
-
ae76319edb4ab7426202f99f0cd60820f7303c93ce40799ed587b3baf27d2271.exe windows x86
2688c1025ff43686b85ef520b9578f9f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
CreateEventA
InterlockedExchange
GetStdHandle
GetACP
CreateMutexA
LocalFree
CloseHandle
GetModuleHandleW
GetEnvironmentVariableW
ResetEvent
GetPrivateProfileIntW
FindVolumeClose
ResumeThread
GlobalFree
GetCommandLineA
GetExitCodeProcess
lstrlenA
VirtualAlloc
GlobalSize
advapi32
CreateServiceA
ClearEventLogA
RegDeleteValueA
IsValidSid
IsValidAcl
RegQueryValueW
ControlService
RegCreateKeyExW
RegCloseKey
CloseEventLog
IsTextUnicode
RegDeleteKeyA
RegEnumKeyW
admparse
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
ResetAdmDirtyFlag
hdwwiz.cpl
InstallNewDevice
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 811KB - Virtual size: 810KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ