Static task
static1
Behavioral task
behavioral1
Sample
e1c7f0d2de05859f2fdf93127bdabe6816c5b2544a9139ea77c25744ecdf6864.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e1c7f0d2de05859f2fdf93127bdabe6816c5b2544a9139ea77c25744ecdf6864.exe
Resource
win10v2004-20221111-en
General
-
Target
e1c7f0d2de05859f2fdf93127bdabe6816c5b2544a9139ea77c25744ecdf6864
-
Size
397KB
-
MD5
356ac6433094d887afa5304fb8de6bb1
-
SHA1
c1e7beb1aae83884ec1dc34a148a0336c05844fb
-
SHA256
e1c7f0d2de05859f2fdf93127bdabe6816c5b2544a9139ea77c25744ecdf6864
-
SHA512
a184d2525c4559ac70421b1ea4e5084be9f143cd877681bf4763e052c5010ab864375858b14b863490f3a910c314385e8b1f746c2a15f77530c326fa5a44f996
-
SSDEEP
12288:Ptfgo8RAkeFvg9eKcgJRddlFrlJ4pPOia4xikZWqyroDt1EcX:Pdgo8RAkeZmjFlJ4pPjawikYpoDt1EcX
Malware Config
Signatures
Files
-
e1c7f0d2de05859f2fdf93127bdabe6816c5b2544a9139ea77c25744ecdf6864.exe windows x86
e978405453d37d3b648567ffe2daea3d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mprapi
MprAdminTransportSetInfo
MprAdminInterfaceGetInfo
MprConfigServerInstall
MprInfoDuplicate
MprInfoBlockQuerySize
MprAdminBufferFree
MprAdminInterfaceUpdateRoutes
MprInfoCreate
MprConfigInterfaceGetInfo
MprConfigInterfaceEnum
MprConfigInterfaceSetInfo
MprConfigInterfaceTransportAdd
MprConfigTransportSetInfo
MprAdminInterfaceSetCredentials
MprConfigInterfaceTransportGetHandle
MprAdminUserGetInfo
MprAdminPortReset
MprAdminUserRead
MprAdminTransportGetInfo
MprAdminPortGetInfo
MprAdminUserServerDisconnect
MprAdminInterfaceTransportSetInfo
MprDomainRegisterRasServer
MprAdminConnectionEnum
RasPrivilegeAndCallBackNumber
MprConfigInterfaceTransportRemove
MprAdminInterfaceDeviceGetInfo
MprAdminInterfaceGetCredentialsEx
MprAdminInterfaceDeviceSetInfo
MprAdminInterfaceGetHandle
MprAdminDeviceEnum
MprAdminServerGetCredentials
MprAdminDeregisterConnectionNotification
MprAdminUserServerConnect
MprAdminInterfaceTransportRemove
MprAdminInterfaceDisconnect
MprAdminUserWriteProfFlags
MprConfigInterfaceCreate
MprConfigInterfaceTransportGetInfo
MprAdminMIBEntryCreate
mapi32
MapStorageSCode@4
BMAPIResolveName
EncodeID@12
DeregisterIdleRoutine@4
FtDivFtBogus@20
InstallFilterHook@4
FBadRglpNameID@8
HrComposeMsgID@24
RTFSync@12
FBadRowSet@4
cmc_logon
MAPIDeinitIdle@0
HrEntryIDFromSz@12
UFromSz@4
MAPILogonEx
UlRelease@4
MAPIFindNext
FtgRegisterIdleRoutine@20
PRProviderInit
HrIStorageFromStream@16
MAPIOpenFormMgr@8
MAPIAllocateBuffer
WrapCompressedRTFStream
EnableIdleRoutine@8
BMAPIFindNext
MNLS_WideCharToMultiByte@32
FBadRow@4
HrSetOneProp@8
HrDecomposeMsgID@24
RTFSync
CchOfEncoding@4
OpenIMsgOnIStg@44
ScCountNotifications@12
OpenIMsgSession@12
MNLS_MultiByteToWideChar@24
UNKOBJ_ScAllocateMore@16
FtMulDw@12
crtdll
realloc
_pclose
abort
is_wctype
_ultow
_dup
_mbscat
_mbsspnp
_wtol
_errno
iswalpha
fflush
free
strtod
_mbsnicmp
getenv
_fileno
iswascii
_daylight_dll
_ismbblead
localeconv
_itoa
_strnextc
_mbctoupper
cos
_eof
_expand
_execve
wcscpy
_initterm
wcstombs
_endthread
_pctype_dll
_mbsnbicmp
_fullpath
_CIatan
_wtoi
_loaddll
_umask
_execvpe
_wcsnicmp
msvcp60
?pbackfail@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGG@Z
??4?$numeric_limits@O@std@@QAEAAV01@ABV01@@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??0?$moneypunct@G$0A@@std@@QAE@ABV_Locinfo@1@I@Z
_FDenorm
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?id@?$numpunct@G@std@@2V0locale@2@A
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@KAPADPADDH@Z
??0_Locinfo@std@@QAE@HPBD@Z
??Dstd@@YA?AV?$complex@M@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@GABV10@@Z
??_F?$collate@G@std@@QAEXXZ
?do_in@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
??_7?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??0?$complex@M@std@@QAE@ABM0@Z
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
??_7domain_error@std@@6B@
?do_tolower@?$ctype@D@std@@MBEDD@Z
?pow@std@@YA?AV?$complex@M@1@ABV21@0@Z
?sqrt@std@@YA?AV?$complex@N@1@ABV21@@Z
?do_compare@?$collate@G@std@@MBEHPBG000@Z
??1?$ctype@G@std@@UAE@XZ
?unsetf@ios_base@std@@QAEXH@Z
?assign@?$char_traits@D@std@@SAPADPADIABD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@ios_base@std@@QAEXH_N@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?infinity@?$numeric_limits@J@std@@SAJXZ
??_7range_error@std@@6B@
?imag@?$_Complex_base@M@std@@QBEMXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IABV12@II@Z
??8std@@YA_NABOABV?$complex@O@0@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXF@Z
kernel32
EnterCriticalSection
VirtualAlloc
GetShortPathNameW
GetDiskFreeSpaceExA
_lcreat
ExitProcess
LoadLibraryA
EnumResourceTypesW
FindResourceW
GetProfileStringA
RtlFillMemory
SetProcessPriorityBoost
VerSetConditionMask
GetConsoleCP
GetVolumeNameForVolumeMountPointA
SetDefaultCommConfigW
GetSystemTimeAdjustment
DebugBreakProcess
RegisterWaitForSingleObject
EraseTape
UnregisterWait
GetCommConfig
LZOpenFileA
WriteConsoleA
DeleteCriticalSection
GetStartupInfoA
LeaveCriticalSection
CreateNamedPipeA
OpenSemaphoreW
MoveFileExA
DebugBreak
GetLocaleInfoA
CreateHardLinkW
ifsutil
?AddEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?QueryNtfsSupportInfo@DP_DRIVE@@SGJPAXPAE@Z
?GetCannedSecurity@IFS_SYSTEM@@SGPAVCANNED_SECURITY@@XZ
?RemoveEdge@DIGRAPH@@QAEEKK@Z
??0READ_CACHE@@QAE@XZ
?GetCannedSecurityDescriptor@CANNED_SECURITY@@QAEPAXW4_CANNED_SECURITY_TYPE@@PAK@Z
?CloseDriveHandle@DP_DRIVE@@QAEXXZ
?GetBuffer@TLINK@@QAEPAXPAX@Z
?QueryPageSize@IFS_SYSTEM@@SGKXZ
??1SPARSE_SET@@UAE@XZ
?GetSortedFirst@TLINK@@QAEPAXXZ
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EEG@Z
?QueryFreeDiskSpace@IFS_SYSTEM@@SGEPBVWSTRING@@PAVBIG_INT@@@Z
?Write@SECRUN@@UAEEXZ
?Read@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?AddDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?QueryDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@0PAVMESSAGE@@E@Z
??0INTSTACK@@QAE@XZ
??0LOG_IO_DP_DRIVE@@QAE@XZ
?QueryNumber@NUMBER_SET@@QBE?AVBIG_INT@@V2@@Z
?Initialize@TLINK@@QAEEG@Z
?RemoveAll@NUMBER_SET@@QAEEXZ
?NtDriveNameToDosDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?FileSetAttributes@IFS_SYSTEM@@SGEPBVWSTRING@@KPAK@Z
??0DIGRAPH@@QAE@XZ
?Initialize@READ_WRITE_CACHE@@QAEEPAVIO_DP_DRIVE@@K@Z
?QuerySize@TLINK@@QBEGXZ
?Add@NUMBER_SET@@QAEEVBIG_INT@@@Z
?ReverseCopy@INTSTACK@@QAEEPAV1@@Z
?QueryDisjointRange@NUMBER_SET@@QBEXKPAVBIG_INT@@0@Z
??0MOUNT_POINT_MAP@@QAE@XZ
?Read@IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 93KB - Virtual size: 606KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ