Static task
static1
Behavioral task
behavioral1
Sample
aaeb5d5ee6d56b9392d5a767e593749bd933abe8ab52152eb8cd712f3381d399.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aaeb5d5ee6d56b9392d5a767e593749bd933abe8ab52152eb8cd712f3381d399.exe
Resource
win10v2004-20220812-en
General
-
Target
aaeb5d5ee6d56b9392d5a767e593749bd933abe8ab52152eb8cd712f3381d399
-
Size
552KB
-
MD5
3b958114fb300555ce6aadd36e663ec8
-
SHA1
634a096f44b4624ee048ef882d0276dc3b2938ad
-
SHA256
aaeb5d5ee6d56b9392d5a767e593749bd933abe8ab52152eb8cd712f3381d399
-
SHA512
49c86d5ef4a20e68786211dbcd6a0693cb1ca45ebb32f7b78641b567011085dca2610ec0eda32de6383494334412238dd22bae20e49d0bf798b49e5563a9a1ea
-
SSDEEP
12288:rcsYk8h04t8AMnLd0dGFkj9hUdWMRElTfRpLWxNF3qWbdjMNwbn9y6sY:XdBkuRElT5pqxNF35Yw
Malware Config
Signatures
Files
-
aaeb5d5ee6d56b9392d5a767e593749bd933abe8ab52152eb8cd712f3381d399.exe windows x86
1ff921aa118c9f55d77370ea47d1fbc5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostbyname
inet_addr
WSACreateEvent
ntohl
accept
WSASend
WSARecv
WSAGetOverlappedResult
WSAResetEvent
connect
getsockname
listen
WSASocketA
gethostname
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAGetLastError
WSAEventSelect
getsockopt
WSAStartup
WSACloseEvent
shutdown
closesocket
ioctlsocket
recvfrom
select
sendto
setsockopt
bind
socket
ntohs
htonl
htons
iphlpapi
GetAdaptersInfo
kwlogsvr
?YL_Log@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H0PBDZZ
?LogUserActMsg@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?LogInit@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?LogRealMsg@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_NPAPAEPAI@Z
kernel32
Sleep
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
QueryPerformanceCounter
GetStartupInfoA
TerminateThread
ResumeThread
CreateDirectoryA
WriteFile
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CloseHandle
GetFileSize
CreateFileA
GetModuleFileNameA
GetSystemTimeAsFileTime
GetVersionExA
CreateEventA
SetEvent
WaitForSingleObject
ResetEvent
InitializeCriticalSection
DeleteCriticalSection
CreateSemaphoreA
GetLastError
GetVersion
TerminateProcess
CreateMutexA
CreateProcessA
GetSystemDirectoryA
ExitProcess
GetFileAttributesExA
SetProcessPriorityBoost
GetModuleHandleA
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
GetTickCount
GetPrivateProfileStringA
DeleteFileA
ReadFile
SetFilePointer
FreeLibrary
GetProcAddress
LoadLibraryA
GetOverlappedResult
user32
FindWindowA
SendMessageTimeoutA
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
DefWindowProcA
CreateWindowExA
advapi32
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
StartServiceCtrlDispatcherA
CreateServiceA
ChangeServiceConfigA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
ControlService
DeleteService
InitializeSecurityDescriptor
shell32
SHGetFolderPathA
msvcr71
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strtoul
atof
sscanf
_stricmp
fwrite
vsprintf
fflush
ftell
fseek
strncmp
strstr
atoi
sprintf
ceil
memmove
exit
time
_unlink
??_U@YAPAXI@Z
??_V@YAXPAX@Z
fopen
fread
fclose
??0exception@@QAE@ABV0@@Z
_snprintf
free
_beginthreadex
_CxxThrowException
_purecall
strncpy
__CxxFrameHandler
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
memset
malloc
msvcp71
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@V312@@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@ios_base@std@@QAEXH_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
Sections
.text Size: 236KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�" Size: 244KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE