Static task
static1
Behavioral task
behavioral1
Sample
fe8df6d3cb5bc0b70cf31f254c8aa08f872ce406a26f379edc8737ca84624b2f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fe8df6d3cb5bc0b70cf31f254c8aa08f872ce406a26f379edc8737ca84624b2f.exe
Resource
win10v2004-20221111-en
General
-
Target
fe8df6d3cb5bc0b70cf31f254c8aa08f872ce406a26f379edc8737ca84624b2f
-
Size
781KB
-
MD5
0890b05fbb1d507d06dd229632f858a7
-
SHA1
9260573f829439d04f6b9dcb4ca3ff313bf02d8a
-
SHA256
fe8df6d3cb5bc0b70cf31f254c8aa08f872ce406a26f379edc8737ca84624b2f
-
SHA512
928df7ff1a47671cd634c3af643d446879fbaee718d4a62e0f32315ced2b67543ee940587ad90090450e6fdf209631cd8c1a7563787b9b9d9e42d01723a75283
-
SSDEEP
12288:CM8z9RyowQfLqjnz3G7CmFk0nsH5MTs+7dwR4C528dSCdlEK:CMSDhfLsnz36kcsH5MT9+uCdW
Malware Config
Signatures
Files
-
fe8df6d3cb5bc0b70cf31f254c8aa08f872ce406a26f379edc8737ca84624b2f.exe windows x86
bda73c7bf37d86cebe28f21f893e0140
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetGetCookieExW
InternetSetCookieExW
kernel32
GetSystemInfo
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
ExpandEnvironmentStringsW
GetFileSize
SetFilePointer
GetFileAttributesW
FindNextFileW
CopyFileW
GetPrivateProfileStringW
GetSystemDirectoryA
DeleteFileA
HeapAlloc
HeapFree
GetProcessHeap
CreateMutexW
OpenMutexW
ReadFile
DeviceIoControl
GetFullPathNameW
GetFullPathNameA
CreateFileA
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
LockFile
GetTickCount
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
LeaveCriticalSection
GetFileAttributesA
FlushFileBuffers
GetTempPathW
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
DeleteCriticalSection
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
GetConsoleMode
GetConsoleCP
GetDateFormatA
GetTimeFormatA
GetCurrentThreadId
TlsFree
TlsSetValue
Process32FirstW
SetLastError
GetEnvironmentVariableA
CreateFileW
TerminateProcess
GetExitCodeProcess
GetVersionExW
RaiseException
Sleep
WideCharToMultiByte
WriteFile
CreateProcessW
LockResource
SizeofResource
GetModuleHandleW
LoadResource
FindResourceW
FindResourceExW
LocalSize
lstrlenW
LocalAlloc
FormatMessageW
GetProcAddress
FindClose
FindFirstFileW
LocalFree
DeleteFileW
GetEnvironmentVariableW
WaitForSingleObject
GetModuleFileNameW
InterlockedDecrement
CloseHandle
GetLastError
MultiByteToWideChar
lstrlenA
FreeLibrary
LoadLibraryW
GetCurrentProcess
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
SetEnvironmentVariableA
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
CompareStringW
InterlockedIncrement
InterlockedExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
RtlUnwind
HeapSize
HeapReAlloc
GetFileAttributesExW
GetCPInfo
CompareStringA
HeapDestroy
user32
wsprintfW
GetClassNameW
PostMessageW
IsWindow
EnumWindows
advapi32
OpenProcessToken
DuplicateTokenEx
AddAccessAllowedAce
InitializeAcl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegFlushKey
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
GetTokenInformation
CreateProcessAsUserW
SetTokenInformation
ConvertStringSidToSidW
GetLengthSid
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
oleaut32
SysAllocStringByteLen
SysAllocString
SysStringLen
SysFreeString
shlwapi
PathFileExistsW
crypt32
CryptProtectData
Sections
.text Size: 448KB - Virtual size: 447KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 192KB - Virtual size: 496KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE