Static task
static1
Behavioral task
behavioral1
Sample
d6219727787556dda0d6b3e2ce16dda8fc5b0fd64329ac0ebb6498902e96b1c2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d6219727787556dda0d6b3e2ce16dda8fc5b0fd64329ac0ebb6498902e96b1c2.exe
Resource
win10v2004-20221111-en
General
-
Target
d6219727787556dda0d6b3e2ce16dda8fc5b0fd64329ac0ebb6498902e96b1c2
-
Size
305KB
-
MD5
10c249f0f44b0906cf808809ddfa519f
-
SHA1
7a9b928286ece8a1cfedc0b08311089393380e40
-
SHA256
d6219727787556dda0d6b3e2ce16dda8fc5b0fd64329ac0ebb6498902e96b1c2
-
SHA512
7a77e40f69f237f019ae492c7861af58446234474471b85a06a2e58599aa9f6656d57afe0eadc4742a90a854e9de8f3d1ebc8db9fd0b9bbdad961064b2b47fbf
-
SSDEEP
3072:xCbsl8NTcogpNg3wzVnTK7I0gkm+gXHbSVrmR9uIIVBItmFXcBYDsfpOzGBj0TF0:Jl8NTc5fVnCvmP3bU1BrVDsxO6DcmIS
Malware Config
Signatures
Files
-
d6219727787556dda0d6b3e2ce16dda8fc5b0fd64329ac0ebb6498902e96b1c2.exe windows x86
1b960c21a58e0e8874d2ce46161293c0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCrackUrlW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ReadProcessMemory
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
OpenProcess
GetCurrentProcessId
WaitForSingleObject
Sleep
CreateThread
CreateEventW
GetCommandLineW
GetProcAddress
LoadLibraryW
GetVersionExW
LockResource
FindResourceExW
GetCurrentThreadId
SetEvent
ExpandEnvironmentStringsW
LocalFree
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcess
CreateFileW
CreateDirectoryW
LocalAlloc
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
lstrcpyW
WideCharToMultiByte
GetTempPathW
lstrcatW
GetComputerNameW
OpenEventW
CreateMutexW
WaitForMultipleObjects
GetTickCount
WriteFile
GetStringTypeW
GetStringTypeA
LoadLibraryA
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
ReadFile
GetStartupInfoA
GetFileType
SizeofResource
MultiByteToWideChar
FreeLibrary
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
WriteConsoleW
SetEndOfFile
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileA
GetConsoleMode
GetConsoleCP
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
HeapCreate
VirtualAlloc
VirtualFree
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
GetSystemTimeAsFileTime
TerminateProcess
user32
PeekMessageW
MsgWaitForMultipleObjects
wsprintfW
UnregisterClassA
PostThreadMessageW
GetMessageW
DispatchMessageW
TranslateMessage
SendMessageW
GetWindowThreadProcessId
IsWindow
CharNextW
CharUpperW
advapi32
GetUserNameW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegLoadKeyW
RegUnLoadKeyW
RegNotifyChangeKeyValue
RegQueryValueExW
GetSecurityDescriptorLength
RegSetValueExA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
shell32
SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
ole32
StringFromGUID2
CoTaskMemFree
CoCreateGuid
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoInitialize
CoTaskMemRealloc
oleaut32
VarUI4FromStr
SysStringLen
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
SafeArrayGetUBound
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
LoadTypeLi
LoadRegTypeLi
SysFreeString
shlwapi
SHCopyKeyW
SHDeleteKeyW
Sections
.text Size: 152KB - Virtual size: 150KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE