Static task
static1
Behavioral task
behavioral1
Sample
49d9476661c1e2abacc84ade5850a3c609e43ee88f92d8e1fffc13cb5fc4e3cb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
49d9476661c1e2abacc84ade5850a3c609e43ee88f92d8e1fffc13cb5fc4e3cb.exe
Resource
win10v2004-20220812-en
General
-
Target
49d9476661c1e2abacc84ade5850a3c609e43ee88f92d8e1fffc13cb5fc4e3cb
-
Size
27KB
-
MD5
ef5b77de40cab7c2087f173fac3142a1
-
SHA1
066e11ea1a41c50c31dfccb241ba7d75dca40954
-
SHA256
49d9476661c1e2abacc84ade5850a3c609e43ee88f92d8e1fffc13cb5fc4e3cb
-
SHA512
931d008d5a5848535699ca85f3b4e66c493d6b035f4077724ec4c8fe401160e4ec80f1bbd0d29fe8af6236d06d5f3e0e675af8dce2abfc00f51971daba78e653
-
SSDEEP
768:NT5Rc/aEXBPWlLxc7lVl5eVEs007kvVEIZj:N2aIBPqcR5eVP7IVEQ
Malware Config
Signatures
Files
-
49d9476661c1e2abacc84ade5850a3c609e43ee88f92d8e1fffc13cb5fc4e3cb.exe windows x86
1901fa132c99a01befe01f9af3f73cf0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
GetCommandLineW
GetThreadContext
GetTempFileNameW
SetThreadContext
FreeResource
FindResourceW
LoadResource
CreateProcessW
WaitForSingleObject
GetModuleHandleW
GetTickCount
VirtualQueryEx
WriteFile
OpenProcess
SizeofResource
ReadProcessMemory
GetFileAttributesW
CreateProcessA
TerminateProcess
GetModuleFileNameW
CreateFileW
lstrlenW
GetTempPathW
GetProcAddress
VirtualAlloc
VirtualProtectEx
VirtualAllocEx
LockResource
Module32FirstW
lstrcatW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
WriteProcessMemory
ResumeThread
lstrcpyW
shell32
SHFileOperationW
SHChangeNotify
shlwapi
StrChrW
StrRChrW
StrCmpNIW
msvcrt
free
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
malloc
memmove
Sections
pe Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ