Static task
static1
Behavioral task
behavioral1
Sample
d1b81add0353f28f939463961d090e9a6b1341fdae6ebd46797fc13d2f5f3d89.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d1b81add0353f28f939463961d090e9a6b1341fdae6ebd46797fc13d2f5f3d89.exe
Resource
win10v2004-20221111-en
General
-
Target
d1b81add0353f28f939463961d090e9a6b1341fdae6ebd46797fc13d2f5f3d89
-
Size
829KB
-
MD5
afc1a0fa91e2dfca27ba0b9dc5849fc0
-
SHA1
15dff1720c2e1e66bf260a880a860b94e11e2a68
-
SHA256
d1b81add0353f28f939463961d090e9a6b1341fdae6ebd46797fc13d2f5f3d89
-
SHA512
3480d9bec5e3291771a3f25d6baa3b18c0d20b3d720e0cfe076758a5a4d7517bbce3229762962965f4eda3bc2c63f8e08aaddcef074cf5ef0ab73e0b21098c05
-
SSDEEP
24576:CfdWw5G36lqq5QbTPEaRTb4IOKPtm8S2tv:p3mqTTPEeNOOt9v
Malware Config
Signatures
Files
-
d1b81add0353f28f939463961d090e9a6b1341fdae6ebd46797fc13d2f5f3d89.exe windows x86
e7d2e6928f5d8eddbd23529ee04bd1d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
GetGlyphOutlineA
DdEntry38
CreateCompatibleBitmap
GdiEntry5
SetFontEnumeration
EudcLoadLinkW
GdiIsMetaFileDC
GdiReleaseLocalDC
GdiQueryFonts
PolylineTo
GdiGetLocalDC
ResetDCW
CheckColorsInGamut
PolyPolygon
DdEntry51
GetCharABCWidthsA
GetCharABCWidthsFloatA
CreateFontIndirectExW
GetDCBrushColor
DdEntry30
GdiGetPageCount
GdiGetBatchLimit
EngQueryEMFInfo
STROBJ_bGetAdvanceWidths
ClearBrushAttributes
SetMagicColors
GdiReleaseDC
GetLogColorSpaceA
AnimatePalette
GetPolyFillMode
DeleteColorSpace
EngAcquireSemaphore
FONTOBJ_pvTrueTypeFontFile
GetDCOrgEx
PolyPatBlt
AddFontResourceTracking
GetArcDirection
FONTOBJ_pifi
rpcrt4
RpcTestCancel
RpcServerUseProtseqIfExW
NdrNonEncapsulatedUnionBufferSize
I_RpcMapWin32Status
NdrSimpleTypeMarshall
NdrAllocate
I_RpcEnableWmiTrace
long_from_ndr_temp
NdrStubInitializeMarshall
NdrComplexArrayMemorySize
short_array_from_ndr
RpcServerUseProtseqIfA
NdrFullPointerQueryRefId
CStdStubBuffer_DebugServerQueryInterface
SimpleTypeMemorySize
NdrNonEncapsulatedUnionMemorySize
RpcMgmtSetAuthorizationFn
MesIncrementalHandleReset
UuidToStringA
NdrNonConformantStringUnmarshall
RpcBindingInqAuthInfoExA
I_RpcClearMutex
NdrComplexArrayMarshall
RpcServerInqBindings
NdrComplexStructMemorySize
NdrpGetProcFormatString
NdrFixedArrayMarshall
NdrClientInitialize
RpcErrorGetNextRecord
NdrProxyFreeBuffer
NdrEncapsulatedUnionMarshall
RpcBindingToStringBindingW
NdrPointerMemorySize
RpcMgmtSetServerStackSize
NdrClientCall
NdrClearOutParameters
NdrFixedArrayUnmarshall
ntdll
RtlRemoveVectoredExceptionHandler
RtlValidSecurityDescriptor
RtlFindMessage
ZwCreateEvent
ZwPrivilegeObjectAuditAlarm
RtlCopyLuidAndAttributesArray
NtSetInformationDebugObject
DbgSetDebugFilterState
RtlMapSecurityErrorToNtStatus
NtQueryPerformanceCounter
RtlLeaveCriticalSection
__iscsym
ZwOpenSemaphore
strpbrk
RtlEnterCriticalSection
CsrCaptureTimeout
NtFilterToken
_CIlog
NtOpenEvent
NtPrivilegeCheck
RtlpUnWaitCriticalSection
NtCompareTokens
NtTranslateFilePath
wcscpy
RtlNtPathNameToDosPathName
ZwSetInformationObject
RtlInterlockedPushListSList
LdrGetDllHandle
RtlInitUnicodeString
RtlFindClearBits
NtModifyBootEntry
ZwCreatePagingFile
NtAlertResumeThread
NtCompressKey
NtQueryInstallUILanguage
isgraph
RtlDosApplyFileIsolationRedirection_Ustr
sqrt
NtOpenThreadToken
RtlFreeUnicodeString
ZwSetUuidSeed
ZwSetLowWaitHighEventPair
RtlxOemStringToUnicodeSize
ZwCreateDebugObject
kernel32
IsBadWritePtr
LoadLibraryA
SetHandleInformation
GetDiskFreeSpaceW
SetThreadPriority
OpenSemaphoreW
EnumResourceNamesW
ExpungeConsoleCommandHistoryW
CreateFileW
BaseDumpAppcompatCache
HeapCreate
FindNextFileW
FormatMessageW
Module32FirstW
GetProfileStringW
SetComputerNameW
WriteTapemark
GetCurrencyFormatW
FindNextVolumeW
SetVolumeMountPointA
CancelWaitableTimer
DebugActiveProcess
GetPrivateProfileSectionA
GetConsoleAliasExesA
FindAtomA
lstrlenA
GetSystemTime
GetCommModemStatus
FindNextChangeNotification
DeleteTimerQueueTimer
CloseConsoleHandle
FindResourceExW
CreateMailslotA
GlobalHandle
RegisterWowBaseHandlers
LZClose
GetConsoleTitleA
MapUserPhysicalPages
AddRefActCtx
BuildCommDCBW
VirtualAlloc
advapi32
TreeResetNamedSecurityInfoW
EnumDependentServicesW
TraceEventInstance
SetEntriesInAuditListA
LsaStorePrivateData
SaferiRecordEventLogEntry
LsaSetInformationTrustedDomain
SystemFunction001
EncryptFileW
QueryServiceLockStatusA
QueryTraceA
GetFileSecurityW
CloseCodeAuthzLevel
WmiFileHandleToInstanceNameA
WmiCloseBlock
RegDeleteValueW
I_ScIsSecurityProcess
GetTrusteeFormW
SaferiPopulateDefaultsInRegistry
FreeEncryptionCertificateHashList
AccessCheckByTypeAndAuditAlarmW
SetEntriesInAuditListW
GetAuditedPermissionsFromAclA
RegisterEventSourceW
SystemFunction028
CredReadDomainCredentialsA
LsaFreeMemory
ConvertSidToStringSidW
RegSetValueW
GetAuditedPermissionsFromAclW
CredEnumerateW
MD4Update
ConvertSecurityDescriptorToStringSecurityDescriptorA
RegisterServiceCtrlHandlerA
ConvertStringSidToSidW
GetSecurityDescriptorSacl
QueryUsersOnEncryptedFile
CloseEventLog
msvcp60
??4id@locale@std@@QAEAAV012@ABV012@@Z
??1length_error@std@@UAE@XZ
??_F?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?_Init@strstreambuf@std@@IAEXHPAD0H@Z
?_Nanv@?$_Ctr@N@std@@SANN@Z
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHPBGH@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?do_in@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z
?_Infv@?$_Ctr@O@std@@SAOO@Z
?norm@std@@YANABV?$complex@N@1@@Z
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??4?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?curr_symbol@?$_Mpunct@G@std@@QBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?real@?$_Complex_base@N@std@@QBENXZ
??_7codecvt_base@std@@6B@
??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
?do_narrow@?$ctype@G@std@@MBEDGD@Z
?cos@std@@YA?AV?$complex@O@1@ABV21@@Z
??1?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
?what@runtime_error@std@@UBEPBDXZ
??Bid@locale@std@@QAEIXZ
??4?$_Complex_base@O@std@@QAEAAV01@ABV01@@Z
??_7time_base@std@@6B@
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??Nstd@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?max@?$numeric_limits@H@std@@SAHXZ
?_Init_cnt@Init@ios_base@std@@0HA
?do_toupper@?$ctype@D@std@@MBEDD@Z
?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z
?_Id_cnt@id@locale@std@@0HA
??Ostd@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Isinf@?$_Ctr@M@std@@SA_NM@Z
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
msvcrt20
__p___initenv
wscanf
_tcsset
??_7iostream@@6B@
_cabs
_tcsspnp
?pbackfail@streambuf@@UAEHH@Z
?getdouble@istream@@AAEHPADH@Z
?in_avail@streambuf@@QBEHXZ
??_Dostream@@QAEXXZ
isspace
_memicmp
??0istream@@IAE@XZ
_ismbstrail
ldiv
_ismbclegal
_fputwchar
?seekpos@streambuf@@UAEJJH@Z
_heapused
??0fstream@@QAE@H@Z
?adjustfield@ios@@2JB
?setbuf@filebuf@@UAEPAVstreambuf@@PADH@Z
_adj_fdiv_m16i
??0fstream@@QAE@ABV0@@Z
towlower
_futime
isdigit
_wtmpnam
__p__mbctype
sscanf
_wfopen
vfprintf
_pclose
__doserrno
_getsystime
getchar
_purecall
_tcsstr
?get@istream@@QAEAAV1@PACHD@Z
??4Iostream_init@@QAEAAV0@ABV0@@Z
_ismbclower
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 722KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ