Static task
static1
Behavioral task
behavioral1
Sample
b5c2762edac975670f5259b7f8b47715335815a1c30995d4c2ae44c33544d9a4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b5c2762edac975670f5259b7f8b47715335815a1c30995d4c2ae44c33544d9a4.exe
Resource
win10v2004-20220901-en
General
-
Target
b5c2762edac975670f5259b7f8b47715335815a1c30995d4c2ae44c33544d9a4
-
Size
215KB
-
MD5
541cab48c6c10ae6c971eed6593f1615
-
SHA1
402ecb57cb0a17dd21f93187b9afc79107cf0af5
-
SHA256
b5c2762edac975670f5259b7f8b47715335815a1c30995d4c2ae44c33544d9a4
-
SHA512
a7ce3fa9298dba30459c6d998e378ff9d80fc3f07499661bee00eb83e1abbf9daf456d382d36830114597e59940dd36b66cd0bce64f55ba24cb1ba39bb1cec69
-
SSDEEP
3072:medyvY9aE4FW86U0L/aEv6qNRLgL2Jw1Lxz4xDiC4PD2Jzx4qE0PtIE:6vY9Z4F76U0eEisR8iCLxz4xDiPPkj6
Malware Config
Signatures
Files
-
b5c2762edac975670f5259b7f8b47715335815a1c30995d4c2ae44c33544d9a4.exe windows x86
9f8ed3888729a53359a160a43fff5fd2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetTempPathA
DeleteFileA
CreateThread
GetProcAddress
CopyFileA
LoadLibraryA
GetComputerNameA
GlobalMemoryStatus
GetCurrentProcess
OpenProcess
TerminateProcess
GetVersionExA
Process32First
GetCurrentThreadId
Process32Next
ProcessIdToSessionId
CreateToolhelp32Snapshot
CompareStringW
CompareStringA
SetEndOfFile
CreateFileW
CreateFileA
GetLocaleInfoW
ReadFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
DeleteCriticalSection
GetModuleHandleA
WTSGetActiveConsoleSessionId
GetModuleFileNameA
GetTempFileNameA
EnterCriticalSection
GetLastError
SetThreadPriority
MultiByteToWideChar
ExitThread
GetSystemDirectoryA
CreateProcessA
LeaveCriticalSection
Sleep
WideCharToMultiByte
GlobalAlloc
InitializeCriticalSection
GetTickCount
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
lstrlenA
TryEnterCriticalSection
CreateEventA
ExitProcess
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetCurrentProcessId
SetEnvironmentVariableA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetFilePointer
GetTimeZoneInformation
HeapSize
GetOEMCP
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
GetCommandLineA
GetProcessHeap
GetStartupInfoA
GetCPInfo
RtlUnwind
RaiseException
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
WriteFile
shell32
ord680
user32
TranslateMessage
DispatchMessageA
GetMessageA
PostThreadMessageA
advapi32
SetServiceStatus
ImpersonateLoggedOnUser
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
OpenProcessToken
OpenSCManagerA
RegOpenKeyExA
StartServiceA
CreateServiceA
RegQueryValueExA
ChangeServiceConfig2A
DeleteService
CloseServiceHandle
OpenServiceA
RegCloseKey
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RevertToSelf
ole32
OleInitialize
CoInitializeEx
CreateStreamOnHGlobal
CoUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance
CoInitializeSecurity
OleUninitialize
oleaut32
VariantClear
SafeArrayCreateVector
SafeArrayAccessData
VariantCopy
SysFreeString
SafeArrayUnaccessData
SysAllocStringLen
VariantInit
SysAllocString
iphlpapi
GetIpAddrTable
ws2_32
inet_ntoa
Sections
.text Size: 160KB - Virtual size: 160KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE