Static task
static1
Behavioral task
behavioral1
Sample
e7fc472a4795c4fa5ff230cd833abaca5d9766956b8aac00a8902d5207714011.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e7fc472a4795c4fa5ff230cd833abaca5d9766956b8aac00a8902d5207714011.exe
Resource
win10v2004-20221111-en
General
-
Target
e7fc472a4795c4fa5ff230cd833abaca5d9766956b8aac00a8902d5207714011
-
Size
58KB
-
MD5
2d6f01b2923f5ec775a9b22dcda4b77a
-
SHA1
987a826f3397aaa8b2dce1367a50045f053f2a79
-
SHA256
e7fc472a4795c4fa5ff230cd833abaca5d9766956b8aac00a8902d5207714011
-
SHA512
bae8ef65a26325b18b5b16f2b369ff7382d24848c7f71f78c6144c640a05548569a7e356b463237b7a13cd2878baecfd6b37d290effa24f60f9305f9ca5a913d
-
SSDEEP
768:abJe3h2dqrsi7Qi0RNsddWSQDeu9u0aM9AbX6JYn:alBqrgiqOddWSQDsNyY
Malware Config
Signatures
Files
-
e7fc472a4795c4fa5ff230cd833abaca5d9766956b8aac00a8902d5207714011.exe windows x86
d2abdf447c6b1b1de806efb5bfd67753
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
ReadFile
ExitThread
FindFirstFileA
GetLastError
CopyFileA
SetFileAttributesA
GetModuleFileNameA
FindNextFileA
CreateMutexA
CloseHandle
GetSystemTime
DeleteFileA
CreateThread
Sleep
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetDriveTypeA
WriteFile
GetWindowsDirectoryA
GetModuleHandleW
GetCurrentProcess
SetFilePointer
WinExec
CreateFileA
user32
UpdateWindow
SendMessageW
DefWindowProcW
CreateWindowExW
GetSysColorBrush
ShowWindow
MessageBoxW
FindWindowA
SendMessageA
GetMessageW
PostQuitMessage
GetKeyState
SetForegroundWindow
LoadCursorW
ReleaseDC
GetDC
TranslateMessage
RegisterClassExW
LoadIconW
CreateWindowExA
DispatchMessageW
gdi32
GetDeviceCaps
GetStockObject
advapi32
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
shell32
ShellExecuteA
ws2_32
send
gethostbyname
closesocket
socket
recv
WSACleanup
WSAStartup
connect
htons
msvcp90
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
msvcr90
_acmdln
_initterm
_initterm_e
memset
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__CxxFrameHandler3
_lock
_itoa
_atoi64_l
memmove
free
malloc
_invalid_parameter_noinfo
toupper
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
Sections
.text Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 700B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ