Behavioral task
behavioral1
Sample
b9794f522ccc6d99b61cadf946c9709efa23cee50d4c23597739e23c84b3482f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b9794f522ccc6d99b61cadf946c9709efa23cee50d4c23597739e23c84b3482f.exe
Resource
win10v2004-20221111-en
General
-
Target
b9794f522ccc6d99b61cadf946c9709efa23cee50d4c23597739e23c84b3482f
-
Size
36KB
-
MD5
172f5897594205289746e0074ae6d042
-
SHA1
3143a71171f7674f29f33afce65ec6c3519321a9
-
SHA256
b9794f522ccc6d99b61cadf946c9709efa23cee50d4c23597739e23c84b3482f
-
SHA512
052deef92e254600a412d8707082adcdd327490c4b3a0a9e5d999234a9e76493cac169e5dd72d2317982e7e946bcabb13a1135af7ddea9262f920bef08fbad41
-
SSDEEP
192:Ns04jAdyqZ+g+51wrmtJJZx2J4bdMdVuE6AnRCL52w2FW7FMPUIy1oyn3YJs17I:y04jAcIN+or4bhSVuQdW7FgUIy1l/I
Malware Config
Signatures
-
resource yara_rule sample aspack_v212_v242
Files
-
b9794f522ccc6d99b61cadf946c9709efa23cee50d4c23597739e23c84b3482f.exe windows x86
bfb4175e6c14fc34114adc727aa41f7d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSASocketA
setsockopt
htonl
sendto
inet_addr
gethostbyname
closesocket
recv
WSACleanup
WSAGetLastError
WSAStartup
socket
htons
connect
send
WSAAsyncSelect
kernel32
GetStartupInfoA
GetCurrentProcessId
GetModuleHandleA
GetProcessHeap
HeapAlloc
GetTickCount
GetComputerNameA
GetVersionExA
GlobalMemoryStatus
ExitProcess
CreateProcessA
CopyFileA
DeleteFileA
GetModuleFileNameA
GetWindowsDirectoryA
CloseHandle
GetCurrentProcess
WriteFile
CreateFileA
GetSystemDirectoryA
ResumeThread
CreateThread
Sleep
ExpandEnvironmentStringsA
GetTempPathA
FreeLibrary
GetProcAddress
LoadLibraryA
MoveFileA
user32
wsprintfA
DefWindowProcA
ExitWindowsEx
PostQuitMessage
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
advapi32
RegOpenKeyExA
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
RegRestoreKeyA
msvcp60
??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
msvcrt
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__dllonexit
printf
_itoa
sprintf
__CxxFrameHandler
strstr
strcspn
strncpy
atoi
_stricmp
_acmdln
exit
_XcptFilter
rand
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_exit
_onexit
Sections
.text Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CCM Size: 4KB - Virtual size: 111B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 40B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 19B - Virtual size: 19B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 19B - Virtual size: 19B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 206B - Virtual size: 206B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 56B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 51B - Virtual size: 51B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 67B - Virtual size: 67B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xiaohui Size: 177B - Virtual size: 177B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ