Static task
static1
Behavioral task
behavioral1
Sample
8eb794e8e07cc8a10e128e843b30c5091894b51b0a491636cbbc103c35650db1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8eb794e8e07cc8a10e128e843b30c5091894b51b0a491636cbbc103c35650db1.exe
Resource
win10v2004-20221111-en
General
-
Target
8eb794e8e07cc8a10e128e843b30c5091894b51b0a491636cbbc103c35650db1
-
Size
111KB
-
MD5
2458e932c496e8992a02ee83cc829f24
-
SHA1
345e0c9539d3ce3ba761d26a917589beafedd8db
-
SHA256
8eb794e8e07cc8a10e128e843b30c5091894b51b0a491636cbbc103c35650db1
-
SHA512
de8226da57fa2412fc0e995daa3a77e9311f8c7a4646db71cc2ad731cce3f6c295b4685a3dff213708f2ec9b364daedbfc8a3c3befb310aa5a48727a3b368520
-
SSDEEP
1536:o7rjMuzcEOtpFGl8vepnIUlvNPers96ZFC+GiqqzBR0re/24LaR/7IrWqu:oAAcEOtpFFV8N6s9AI+vALRDIrWqu
Malware Config
Signatures
Files
-
8eb794e8e07cc8a10e128e843b30c5091894b51b0a491636cbbc103c35650db1.exe windows x86
19166837001c991919027b8bc512681e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
ws2_32
gethostbyname
inet_ntoa
gethostbyaddr
WSAStartup
inet_addr
sendto
wininet
DeleteUrlCacheEntry
advapi32
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
LookupPrivilegeValueA
msvcrt
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
malloc
realloc
memcpy
strchr
??2@YAPAXI@Z
??3@YAXPAX@Z
_adjust_fdiv
srand
rand
_snprintf
fopen
fprintf
fclose
memset
strstr
strcmp
sprintf
strcpy
strcat
strncpy
strlen
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_CxxThrowException
wcslen
strncat
_vsnprintf
calloc
system
_except_handler3
fgets
strtok
__CxxFrameHandler
atoi
sscanf
kernel32
WriteProcessMemory
CreateRemoteThread
lstrcmpiA
VirtualAllocEx
ExitThread
GlobalAlloc
GetModuleFileNameA
OpenProcess
GetModuleHandleA
GetCurrentProcess
FreeLibrary
TerminateProcess
IsBadReadPtr
GetTickCount
WideCharToMultiByte
LocalFree
InterlockedDecrement
Sleep
GlobalLock
GlobalUnlock
lstrcpyA
lstrlenA
GetCurrentThread
GetLastError
CreateFileA
GetFileSize
CloseHandle
LoadLibraryA
GetProcAddress
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcessId
ExpandEnvironmentStringsA
GetVersionExA
GetStartupInfoA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
user32
keybd_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
VkKeyScanA
SetFocus
SetForegroundWindow
CharUpperBuffA
SetRect
SendMessageA
GetWindowThreadProcessId
FindWindowA
CharLowerBuffA
ClipCursor
MessageBoxA
IsWindow
msvcp60
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
ntdll
NtQuerySystemInformation
ZwSystemDebugControl
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ