Behavioral task
behavioral1
Sample
af73cf63eb1a7b92e8047ccb2386d2e5851b1f11176368c8f7d4011d90b0a32f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
af73cf63eb1a7b92e8047ccb2386d2e5851b1f11176368c8f7d4011d90b0a32f.exe
Resource
win10v2004-20221111-en
General
-
Target
af73cf63eb1a7b92e8047ccb2386d2e5851b1f11176368c8f7d4011d90b0a32f
-
Size
319KB
-
MD5
133bcb8fa6ceb77d0be44d970b115459
-
SHA1
6e9f523ad64c60b63025b41b8f6a0e0912e2388a
-
SHA256
af73cf63eb1a7b92e8047ccb2386d2e5851b1f11176368c8f7d4011d90b0a32f
-
SHA512
9d79ee0709104ce7a7c57d1f83b1859735ac36e67ec778e435e29a65363d73e818277a1a9e699df130b89de56cec0e004a20f9fcb94c3f0f2f09f9fd94d248b7
-
SSDEEP
6144:zfUI6kCqFY48jE0K9FLXwxbKlpQamF7mYtIrf5JLyTb03qewa:zfUIjCqFY48jE0K9FcxbKlCF7mYbTb0G
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
af73cf63eb1a7b92e8047ccb2386d2e5851b1f11176368c8f7d4011d90b0a32f.exe windows x86
b0c38dcca52d15961bf34e746134331a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
GetStringTypeW
GetStringTypeA
RtlUnwind
VirtualFree
HeapDestroy
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
TlsGetValue
TlsAlloc
TlsSetValue
LCMapStringW
LCMapStringA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetVersion
GetCommandLineA
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
CopyFileA
CompareStringA
CompareStringW
GetEnvironmentStrings
CreateEventA
HeapFree
HeapAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
SetLastError
GetFileAttributesA
GetLastError
GetFileType
GetSystemTime
FileTimeToSystemTime
CreateFileA
MoveFileA
DeleteFileA
CloseHandle
GetFileInformationByHandle
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesExA
InitializeCriticalSection
DeleteCriticalSection
GetTickCount
LeaveCriticalSection
EnterCriticalSection
FindClose
FindNextFileA
FindFirstFileA
ReadFile
CreateProcessA
GetStartupInfoA
DuplicateHandle
CreatePipe
GetCurrentProcess
WriteFile
SetEvent
GetFileSize
Sleep
GetOverlappedResult
SetFilePointer
SetEndOfFile
CancelIo
GetExitCodeProcess
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreA
GetModuleFileNameA
SetEnvironmentVariableA
UnlockFile
LockFile
CompareFileTime
GetLocalTime
SetCurrentDirectoryA
SetErrorMode
HeapCompact
HeapReAlloc
HeapCreate
GetCurrentProcessId
lstrcpynA
GetModuleHandleA
SystemTimeToFileTime
ExitThread
GetSystemTimeAsFileTime
CreateThread
SetPriorityClass
SetThreadPriority
ResetEvent
WaitForMultipleObjects
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
GetEnvironmentVariableA
GetDiskFreeSpaceExA
GetFileTime
crypt32
CertFindCertificateInStore
CertFreeCertificateContext
CertOpenSystemStoreA
shell32
Shell_NotifyIconA
ShellExecuteA
tcl84
Tcl_GetIntFromObj
Tcl_AppendResult
Tcl_GetString
Tcl_GetVar
Tcl_EvalFile
Tcl_UnsetVar
Tcl_SetVar
Tcl_CreateObjCommand
Tcl_CreateSlave
Tcl_Init
Tcl_CreateInterp
Tcl_FindExecutable
Tcl_DeleteInterp
Tcl_ResetResult
user32
WaitForInputIdle
MsgWaitForMultipleObjects
DispatchMessageA
PeekMessageA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
DefWindowProcA
PostMessageA
SetForegroundWindow
GetCursorPos
AppendMenuA
CreatePopupMenu
LoadImageA
PostThreadMessageA
SetTimer
KillTimer
wsprintfA
TrackPopupMenu
ws2_32
WSAEnumNetworkEvents
WSAGetOverlappedResult
WSASend
WSARecv
WSAConnect
WSAEventSelect
WSACreateEvent
WSAAccept
WSAResetEvent
WSACloseEvent
WSASetEvent
WSASocketA
Sections
UPX0 Size: 308KB - Virtual size: 308KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE