Static task
static1
Behavioral task
behavioral1
Sample
ecb19d3fa74eb34cbd0ec984d1ea1978cfe81c0fd58ffe5210644edfff98661b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ecb19d3fa74eb34cbd0ec984d1ea1978cfe81c0fd58ffe5210644edfff98661b.exe
Resource
win10v2004-20220812-en
General
-
Target
ecb19d3fa74eb34cbd0ec984d1ea1978cfe81c0fd58ffe5210644edfff98661b
-
Size
318KB
-
MD5
4584da06cbd3786b4d8ee173f80ef620
-
SHA1
a26b6790cd00d233b0ab1bfc8d86bd946c6da125
-
SHA256
ecb19d3fa74eb34cbd0ec984d1ea1978cfe81c0fd58ffe5210644edfff98661b
-
SHA512
8b39525ff31fdd7918de1092ad451016cf1628fc9c8ccc6d49bf93df9be292e5c81b4da4262644c76310403b0929c0bba6547e226a304b48613f1fb645a109a3
-
SSDEEP
6144:p/Gzdta1Llgx9Av1HQ9K8IAoefzi1NibRYeZlP/bRanzQ96ksQP0:NGzdtk89C7Koh1NOuIP/bkzQ9NsT
Malware Config
Signatures
Files
-
ecb19d3fa74eb34cbd0ec984d1ea1978cfe81c0fd58ffe5210644edfff98661b.exe windows x86
a7f00f9a11e381d26507353602f5c38c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocaleInfoA
GetCommandLineA
FreeLibrary
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
lstrlenA
lstrcpyA
lstrcmpiA
lstrcmpA
WriteProcessMemory
WaitForSingleObject
WaitForMultipleObjects
VirtualQueryEx
VirtualQuery
VirtualProtectEx
VirtualProtect
UnmapViewOfFile
TerminateThread
TerminateProcess
Sleep
SetThreadPriority
SetLastError
SetEvent
ResumeThread
ReleaseSemaphore
ReleaseMutex
ReadProcessMemory
ReadFile
OpenProcess
OpenMutexW
OpenMutexA
OpenFileMappingW
OpenFileMappingA
OpenEventW
OpenEventA
MapViewOfFile
LoadLibraryExA
LoadLibraryW
LoadLibraryA
GetStartupInfoA
GetTickCount
GetThreadContext
GetSystemDirectoryW
GetSystemDirectoryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameA
GetFileAttributesW
GetFileAttributesA
GetExitCodeThread
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetCurrentDirectoryA
InterlockedIncrement
InterlockedExchange
FormatMessageA
ExitThread
DuplicateHandle
DeviceIoControl
CreateThread
CreateSemaphoreA
CreateProcessW
CreateProcessA
CreatePipe
CreateMutexW
CreateMutexA
CreateFileMappingW
CreateFileMappingA
CreateFileW
CreateFileA
CreateEventW
CreateEventA
CloseHandle
LCMapStringW
IsProcessorFeaturePresent
HeapReAlloc
HeapAlloc
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapFree
GetThreadLocale
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
GetVersion
LocalAlloc
LocalFree
VirtualAlloc
VirtualFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpW
lstrcatW
lstrcpyW
lstrlenW
GetWindowsDirectoryW
GetModuleFileNameW
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapCreate
GetCommandLineW
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
DecodePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
EncodePointer
InterlockedDecrement
GetStringTypeW
user32
DispatchMessageA
CloseDesktop
GetUserObjectInformationA
MsgWaitForMultipleObjects
OpenInputDesktop
PeekMessageA
TranslateMessage
MessageBoxA
GetKeyboardType
GetThreadDesktop
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
FreeSid
GetLengthSid
GetTokenInformation
InitializeSecurityDescriptor
LookupPrivilegeValueA
OpenProcessToken
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyExW
RegSetValueExA
RegSetValueExW
SetSecurityDescriptorDacl
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
GetKernelObjectSecurity
shell32
CommandLineToArgvW
oleaut32
SysAllocStringLen
SysReAllocStringLen
SysFreeString
Sections
CODE Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 326KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.2text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE