Static task
static1
Behavioral task
behavioral1
Sample
f1b1de2bf833f7e657948e82cf4a5449091d2239471b7159eb364150384e7a45.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f1b1de2bf833f7e657948e82cf4a5449091d2239471b7159eb364150384e7a45.exe
Resource
win10v2004-20220812-en
General
-
Target
f1b1de2bf833f7e657948e82cf4a5449091d2239471b7159eb364150384e7a45
-
Size
100KB
-
MD5
86f04138d9b14c0c38ab2719a0a3fa02
-
SHA1
7084861450b179e3c9a4aea9f6b16ab611fe0939
-
SHA256
f1b1de2bf833f7e657948e82cf4a5449091d2239471b7159eb364150384e7a45
-
SHA512
2372fba0db0b4fbb33f13e247b61eafa4f84230c38be25be6221771f73b2eaacd7196ff0232d03b83cc0e7df5e7fe133644b90aa3715137b9aa4aba4d3f3b4e4
-
SSDEEP
1536:11awvackFDKfXrnrsuqPZtDXvr3aXFsQ2y8MXQpK9TGuCFqrw64:bawmFqiZJvrYs28Z0MHwrw6
Malware Config
Signatures
Files
-
f1b1de2bf833f7e657948e82cf4a5449091d2239471b7159eb364150384e7a45.exe windows x86
92d627f527fc73f2d637368bf7313209
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
@
CoMarshalInterThreadInterfaceInStream
UtGetDvtd16Info
OleCreate
CoTreatAsClass
CoUnmarshalHresult
WriteOleStg
SetConvertStg
StgOpenStorage
CoRevokeMallocSpy
CoRegisterClassObject
OleNoteObjectVisible
OleGetIconOfClass
OleBuildVersion
CoRegisterMallocSpy
CoFreeAllLibraries
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCopyProxy
ReadStringStream
CoTaskMemFree
CreateDataAdviseHolder
CoFreeUnusedLibraries
OpenOrCreateStream
CoBuildVersion
CreatePointerMoniker
CoIsOle1Class
CreateObjrefMoniker
CoFileTimeNow
StgGetIFillLockBytesOnFile
OleFlushClipboard
CoCreateInstanceEx
CoLockObjectExternal
CreateFileMoniker
CoQueryProxyBlanket
OleIsCurrentClipboard
CoRegisterSurrogate
CoRevokeClassObject
PropVariantCopy
CoQueryClientBlanket
CoFreeLibrary
OleDoAutoConvert
UtGetDvtd32Info
WriteClassStg
CoInd=@
`�
@
�7@
�7@
@
@
@
�5@
�5@
@
@
advapi32
@
�3@
�3@
@
3@
@
(2@
@
@
h@
@
A
[z@
8
@
I
A
LA
@
@
A
@
��@
@
@
A
�@
A
@
LA
�CA
@@
(@
,@
A
GetNamedSecurityInfoA
GetAce
RegReplaceKeyA
CreateServiceA
SetSecurityInfoExW
RegGetKeySecurity
RegOpenKeyA
AbortSystemShutdownW
�q�b�q9��q3b�q� �qi,�qp�q�;�q
PathFindNextComponentA
SHRegCreateUSKeyA
UrlCanonicalizeW
StrCmpW
SHDeleteKeyW
StrFormatByteSizeW
SHRegWriteUSValueA
StrRStrIW
PathIsUNCW
StrPBrkW
SHRegDeleteEmptyUSKeyW
SHGetValueW
SHAutoComplete
SHRegCloseUSKey
PathCanoniclizeA
SHRegQueryInfoUSKeyA
PathFi
PathIsDirectoryA
StrChrIW
PathUndecorateW
PathCommonPrefixW
PathCompactPathExA
PathFindFileNameA
PathAppendW
SHSkipJunction
PathGetCharTypeW
PathIsPrefixA
SHSetValueW
SHRegOpenUSKeyA
SHOpenRegStream2A
SHRegGetUSValueA
SHCreateShellPalette
AssocQueryStringA
SHRegQueryUSValueW
PathRemoveExtensionA
SHCreateStreamOnFileA
PathRemoveArgsA
PathMakePrettyA
SHEnumValueW
StrCmpNW
StrCatBuffW
PathIsSameRootW
StrCSpnA
StrCSpnW
PathUnmakeSystemFolderW
PathStripToRootW
SHRegGetBoolUSValueW
StrChrA
StrCatBuffA
PathRemoveExtensionW
SHDeleteEmptyKeyA
StrFor
���w���w���w��w� �wfb�wA��w���w��w���wK��w�
�wA��w���w��w���wK��w�
�w�
���wi��wv��wD��w'�wH�w��w�G�w�{�w���w���w:��w���wPb�w���w�.�
H�w��w�G�w�{�w���w���w:��w���wPb�w���w�.�
�w���w:��w���wPb�w���w�.�
�w���w�.�
y�w�w�IwACw8�w��w� wʠ
w��w� wʠ
]wB5wr�"w �"wu�w �w��wR)w�)w�(w�wF~w{_#w�_#wthw�w
u�w �w��wR)w�)w�(w�wF~w{_#w�_#wthw�w
�)w�(w�wF~w{_#w�_#wthw�w
#w�_#wthw�w
W�|��|�N�| rS
i,�q9��qj@�q
�wSw�wv{�wˇ�w�o�w5u�w���wxj�w�k�w���w���w���w�y�w�w�w�w�wuw�w���w���w���w"��w<��wT��wF��w
�w���wxj�w�k�w���w���w���w�y�w�w�w�w�wuw�w���w���w���w"��w<��wT��wF��w
�w�y�w�w�w�w�wuw�w���w���w���w"��w<��wT��wF��w
���w���w���w"��w<��wT��wF��w
�w"��w<��wT��wF��w
�wF��w
�|�א|�|��|^ߐ|�a�|�e�|���|B?�|
�e�|���|B?�|
���w��w���w@��wV¨w���wH��w
�wH��w
��w���w<��w�y�w7p�wMn�w�R�wt�w��wI}�w|�w�'�wф�w�
�w�R�wt�w��wI}�w|�w�'�wф�w�
�wф�w�
�v
user32
� �qi,�qP�q�;�q
�q��qo*�q+�q��q-�qZa�q�D�q�-�q^*�qj@�qܔ�qi�qw�|ableIME
��q-�qZa�q�D�q�-�q^*�qj@�qܔ�qi�qw�|ableIME
�q�-�q^*�qj@�qܔ�qi�qw�|ableIME
i�qw�|ableIME
�|�K�|/��|���|��|���|]��|m�|f��|]�|}�| ��|�*�|w�|���|�(�|
�|���|]��|m�|f��|]�|}�| ��|�*�|w�|���|�(�|
��|�*�|w�|���|�(�|
�|ޫ�|2��|u�|L��|���|/�|�|в�| �|���|��|t��|;��|�P�|e��|p0�|���|B$�|s��|ճ�|ϴ�|W�|1�|���|���|�$�|���|���|d��|﹀|�|��|2�|AM�|G��|1�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
/�|�|в�| �|���|��|t��|;��|�P�|e��|p0�|���|B$�|s��|ճ�|ϴ�|W�|1�|���|���|�$�|���|���|d��|﹀|�|��|2�|AM�|G��|1�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
���|��|t��|;��|�P�|e��|p0�|���|B$�|s��|ճ�|ϴ�|W�|1�|���|���|�$�|���|���|d��|﹀|�|��|2�|AM�|G��|1�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|�P�|e��|p0�|���|B$�|s��|ճ�|ϴ�|W�|1�|���|���|�$�|���|���|d��|﹀|�|��|2�|AM�|G��|1�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|ճ�|ϴ�|W�|1�|���|���|�$�|���|���|d��|﹀|�|��|2�|AM�|G��|1�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|���|���|�$�|���|���|d��|﹀|�|��|2�|AM�|G��|1�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
���|���|d��|﹀|�|��|2�|AM�|G��|1�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|��|2�|AM�|G��|1�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|��| %�|��|`�|���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
���|��|�+�|��|��|�y�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|=�|[�|dƂ|��|���|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|���|� �|�|D �|w �|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|A&�|ԧ�|�&�|"�|7�|,�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|GK�|d=�|�>�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|�A�|LC�|b@�|A�|��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
��|X��|�́|� �|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|���|r��|]�|��| ��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
��|��|���|똀|(��|2#�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
�|�R�|���|Ԡ�|[V�|�#�|��|��|y��|@�|�
[V�|�#�|��|��|y��|@�|�
�|y��|@�|�
�|��|k�|�|�Y�|���|:��|���|��|��|E�|��|���|��|λ�|
�|�Y�|���|:��|���|��|��|E�|��|���|��|λ�|
��|��|E�|��|���|��|λ�|
���|��|λ�|
CallWindowProcW
OemToCharBuffW
GetUpdateRect
GetClipboardFormatNameA
RegisterWindowMessageA
OpenInputDesktop
ValidateRgn
DefMDICh
SetMenuItemBitmaps
IsWindow
OffsetRect
GetSysColorBrush
GetWindowLongW
ShowScrollBar
NotifyWinEvent
LoadImageW
ExitWindowsEx
IsCharLowerA
GetMenuItemInfoW
CopyAcceleratorTableW
CheckRadioButton
SetScrollRange
GetClassNameW
ArrangeIconicWindows
CreateCaret
SetWinEventHook
EnumWindowStationsA
DestroyIcon
OpenIcon
ShowWindow
GetKeyboardLayoutList
MapVirtualKeyExW
CharToOemA
GetAltTabInfo
DdeCmpStringHandles
UnpackDDElParam
EnumDisplayDevicesA
LoadIconA
SetLastErrorEx
CreateWindowStationW
SendDlgItemMessageW
OpenWindowStationA
RealChildWindowFromPoint
CreateIconFromResource
EndMenu
GetWindowModuleFileNameA
DdeAddData
LoadBitmapW
RedrawWindow
LoadMenuIndirectW
kernel32
CreateDirectoryA
GetOverlappedResult
IsBadStringPtrA
SetCalendarInfoW
FreeResource
CreateProcessW
CreateSemaphoreW
FindFirstFileW
GetCurrentThreadId
WaitForMultipleObjectsEx
SetTimeZoneInformation
VirtualAlloc
SetLocaleInfoW
GetCommState
GetFileTime
GetDefaultCommConfigW
PostQueuedCompletionStatus
WriteConsoleOutputAttribute
lstrcpynW
ContinueDebugEvent
lstrcat
VirtualAllocEx
EnumResourceLanguagesW
SetCommState
SearchPathW
GlobalAddAtomA
QueryPerformanceFrequency
CancelIo
GetProfileSectionW
CreateFileW
GetProcessHeap
GetSystemPowerStatus
SetEndOfFile
TlsSetValue
lstrlen
OpenProcess
WinExec
SetMessageWaitingIndicator
GetPrivateProfileIntA
SetU
SetSystemPowerState
VirtualProtect
CreateEventA
OpenMutexA
GetLogicalDriveStringsW
FileTimeToLocalFileTime
PeekConsoleInputA
GetProcessShutdownParameters
lstrcatW
ReadConsoleOutputA
VerLanguageNameW
PeekNamedPipe
CancelWaitableTimer
CompareStringW
LocalHandle
GetLocaleInfoA
GetExitCodeThread
OpenFile
GetCommConfig
GetAtomNameW
UpdateResourceA
GetMailslotInfo
EndUpdateResourceA
GetDriveTypeA
CreateThread
SetThreadAffinityMask
GetProfileSectionA
Beep
GetConsoleCP
GetEnvironmentStrings
GetSystemDefaultLangID
GetStringTypeExW
GlobalUnfix
MapViewOfFile
DosDateTimeToFileTime
SetEnvironmentVariableA
CompareFileTime
CallNamedPipeA
MoveFileW
SetProcessPriorityBoost
SetErrorMode
ResetWriteWatch
OpenSemaphoreW
LockFile
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE