Static task
static1
Behavioral task
behavioral1
Sample
c1b5ee19fe36dc03f7c280709095dae6a0cd32e8322b580cd65457a8c6c83760.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c1b5ee19fe36dc03f7c280709095dae6a0cd32e8322b580cd65457a8c6c83760.exe
Resource
win10v2004-20220901-en
General
-
Target
c1b5ee19fe36dc03f7c280709095dae6a0cd32e8322b580cd65457a8c6c83760
-
Size
827KB
-
MD5
683cdd3e0294347ef05f3293828f80de
-
SHA1
cff974ddf82c8368867ee6906e79b1b43edb68ee
-
SHA256
c1b5ee19fe36dc03f7c280709095dae6a0cd32e8322b580cd65457a8c6c83760
-
SHA512
0de4c55de032d2ac629954c20040f25d44add2449da47dc5bb6e87de9999f36900a98e6c9475c98a07b39512370ed16c81f54a670bc035e77df0af746cac4999
-
SSDEEP
24576:NLl4znor/hqbLrmGZZ4fPBBxRZ2HV54RE043lWgsju:dunI/WbExGXKKWx
Malware Config
Signatures
Files
-
c1b5ee19fe36dc03f7c280709095dae6a0cd32e8322b580cd65457a8c6c83760.exe windows x86
671d1f260a42e7251b560fa23088ddf6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlMoveMemory
OpenFile
GetFileSizeEx
GetStringTypeExA
MultiByteToWideChar
CreateToolhelp32Snapshot
CreateActCtxA
VirtualAlloc
SetLocalTime
WaitNamedPipeW
RemoveLocalAlternateComputerNameA
PurgeComm
lstrcpy
UpdateResourceA
VerSetConditionMask
ReadConsoleOutputA
GetCommandLineW
OpenFileMappingW
LeaveCriticalSection
ExpandEnvironmentStringsA
InterlockedIncrement
LZDone
GetDateFormatW
UTRegister
GetConsoleFontInfo
LZCopy
SearchPathA
RemoveDirectoryW
UTUnRegister
GetComputerNameA
EnumSystemLocalesA
CreateWaitableTimerA
EnterCriticalSection
LoadLibraryA
GetNumberFormatW
GlobalMemoryStatusEx
GetCPInfo
DebugActiveProcessStop
GetVersion
GetModuleFileNameW
CreateHardLinkA
DeleteCriticalSection
lstrcatA
FatalExit
GetWriteWatch
GetDefaultCommConfigW
rasman
RasGetHConnFromEntry
RasPortGetBundle
RasPortCancelReceive
RasActivateRoute
RasPortSend
RasGetUserCredentials
RasRpcPortGetInfo
RasServerPortClose
RasActivateRouteEx
RasmanUninitialize
RasReferenceRasman
IsRasmanProcess
RasGetDeviceConfigInfo
RasSecurityDialogReceive
RasRpcPortEnum
RasCreateConnection
RasPortGetFramingEx
RasGetFramingCapabilities
RasGetCalledIdInfo
RasReferenceCustomCount
RasConnectionGetStatistics
RasGetDialParams
RasDeviceConnect
RasCompressionSetInfo
RasBundleGetStatistics
RasRpcGetInstalledProtocols
RasDeviceEnum
RasSetDialParams
RasRequestNotification
RasRegisterPnPHandler
RasDeviceGetInfo
RasSetKey
RasSetConnectionParams
RasGetDevConfigEx
RasRpcRemoteSetUserPreferences
RasSendNotification
RasIsTrustedCustomDll
RasSetCachedCredentials
RasBundleClearStatisticsEx
RasSetAddressDisable
RasRpcGetSystemDirectory
RasRpcConnectServer
RasInitialize
RasGetDevConfig
RasRpcDeviceEnum
RasRPCBind
RasSetCommSettings
RasDeviceSetInfo
RasPortGetStatisticsEx
RasPortSetProtocolCompression
RasRpcGetDevConfig
RasSetPortUserData
RasDoIke
RasPortStoreUserData
RasGetTimeSinceLastActivity
RasProtocolEnum
RasGetProtocolInfo
RasEnumLanNets
RasRegisterRedialCallback
RasGetConnectionUserData
RasGetHportFromConnection
RasDestroyConnection
RasGetCustomScriptDll
RasConnectionEnum
RasPortGetProtocolCompression
RasFreeBuffer
sqlunirl
_RegOpenKeyEx_@20
_RegDeleteKey_@8
_Shell_NotifyIcon_@8
_FindNextFile_@8
_CreateWindowStation_@16
_LoadBitmap@8
_GetCommandLine_@0
_BuildCommDCBAndTimeouts_@12
AllocConvertMultiSZNameToAEx
_EnumFontFamilies_@16
_LoadMenu@8
_CreateDirectory_@8
_SendNotifyMessage_@16
_SHFileOperation_@4
_RegEnumValue_@32
_PolyTextOut_@12
_SendMessageTimeout_@28
_ObjectCloseAuditAlarm_@12
_EnumDependentServices_@24
_NDdeShareAdd_@20
_GetClassInfo@12
_PostMessage@16
_MoveFileEx_@12
_LoadKeyboardLayout_@8
_GetLogColorSpace_@12
_SetEnvironmentVariable_@8
_SetWindowLong@12
_GetTextExtentPoint@16
_FindExecutable_@12
_CreateColorSpace_@4
_GetPrivateProfileInt_@16
_ExtTextOut@32
_CreateDialogParam_@20
_NDdeTrustedShareEnum_@24
_EnumFonts_@16
msvcp60
?find_last_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?_Getcat@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
?_Getcat@?$ctype@D@std@@SAIXZ
??0?$_Mpunct@G@std@@QAE@ABV_Locinfo@1@I_N@Z
btowc
??_7?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
?imag@?$_Complex_base@O@std@@QAEOABO@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$moneypunct@G$0A@@std@@QAE@ABV_Locinfo@1@I@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDF@Z
??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?do_in@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
??Xstd@@YAAAV?$complex@N@0@AAV10@ABV10@@Z
??0?$numpunct@D@std@@QAE@I@Z
??1?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??_F?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
??_7range_error@std@@6B@
?hash@?$collate@D@std@@QBEJPBD0@Z
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@
?do_close@?$messages@D@std@@MBEXH@Z
?sqrt@std@@YA?AV?$complex@O@1@ABV21@@Z
?signaling_NaN@?$numeric_limits@N@std@@SANXZ
??_7domain_error@std@@6B@
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHPBGH@Z
??_7?$moneypunct@D$00@std@@6B@
??0money_base@std@@QAE@I@Z
?denorm_min@?$numeric_limits@G@std@@SAGXZ
crtdll
ferror
_cwait
iswprint
_basemajor_dll
_unloaddll
_setmode
_heapmin
sscanf
_findnext
_fileinfo_dll
scanf
ispunct
memcmp
memchr
isxdigit
wcsncat
_logb
_wcsicoll
calloc
_mbscat
_wtoi
ftell
_execlp
_mbsnbcpy
log
_copysign
_commode_dll
fwrite
_pctype_dll
_mbsncpy
_ultow
fgets
_strncnt
_CIatan
_execvp
_access
_mbsnbcmp
malloc
_open_osfhandle
ntdsapi
DsMapSchemaGuidsW
DsAddSidHistoryA
DsGetSpnA
DsServerRegisterSpnA
DsListServersForDomainInSiteA
DsReplicaDelA
DsUnquoteRdnValueA
DsReplicaGetInfoW
DsListDomainsInSiteW
DsBindWithCredW
DsRemoveDsServerW
DsCrackSpn2A
DsReplicaSyncA
DsFreeDomainControllerInfoA
DsListInfoForServerW
DsaopExecuteScript
DsFreePasswordCredentials
DsWriteAccountSpnW
DsQuoteRdnValueW
DsRemoveDsDomainW
DsCrackSpn2W
DsGetDomainControllerInfoA
DsFreeNameResultA
DsReplicaSyncAllA
DsCrackSpn3W
DsReplicaUpdateRefsW
DsMakePasswordCredentialsA
adsldpc
?SetAtDisabler@CLexer@@QAEXH@Z
ADSICloseSearchHandle
ADSIGetNextRow
ADsExecuteSearch
LdapGetSyntaxOfAttributeOnServer
SchemaGetClassInfoByIndex
ADsEncodeBinaryData
LdapDeleteExtS
SchemaGetPropertyInfo
LdapCompareExt
LdapIsClassNameValidOnServer
LdapReadAttribute
LdapCloseObject
ConvertSidToString
LdapGetSyntaxIdOfAttribute
ADsWriteAttributeDefinition
UnMarshallLDAPToLDAPSynID
ADSISetObjectAttributes
ADsSetObjectAttributes
LdapParseResult
ADsGetLastError
LdapValueFree
ADsGetNextColumnName
BuildADsPathFromParent
BuildLDAPPathFromADsPath2
ADsSetLastError
MapLDAPTypeToADSType
ReallocADsMem
LdapTypeToAdsTypeDNWithBinary
LdapGetDn
SchemaGetObjectCount
LdapModifyS
ADSIGetFirstRow
ADsGetPreviousRow
LdapTypeBinaryToString
FreeADsMem
intcmp
msvcrt20
_flsbuf
_chdir
wcstod
__p__commode
_tolower
?put@ostream@@QAEAAV1@C@Z
_heapused
_mbctombb
strtol
_wctime
strncmp
_mbbtype
_tcslwr
getwc
?openprot@filebuf@@2HB
_strncoll
_onexit
iswspace
_fdopen
_mbsstr
?putback@istream@@QAEAAV1@D@Z
_wchdir
remove
_mbspbrk
_wfreopen
?gbump@streambuf@@IAEXH@Z
msls31
LsGetMinDurBreaks
LsCreateLine
LsdnResetPenNode
LssbGetDurTrailInSubline
LsdnSubmitSublines
LsdnGetDup
LsdnQueryObjDimRange
LssbGetVisibleDcpInSubline
LsdnModifyParaEnding
LsResetRMInCurrentSubline
LsdnSkipCurTab
LsQueryFLineEmpty
LsFetchAppendToCurrentSubline
LsExpandSubline
LsdnFinishDelete
LssbFIsSublineEmpty
LsSetBreakSubline
LssbGetDupSubline
LsGetRubyLsimethods
LsSetCompression
LsFindNextBreakSubline
LsEnumSubline
LsdnFinishRegularAddAdvancePen
LsQueryTextCellDetails
LsdnSetAbsBaseLine
LsCompressSubline
LsSqueezeSubline
LssbGetObjDimSubline
LssbFDonePresSubline
LsGetWarichuLsimethods
LsdnDistribute
LsdnGetFormatDepth
LsGetHihLsimethods
LsdnResolvePrevTab
LsdnSetRigidDup
LssbGetPlsrunsFromSubline
LsModifyLineHeight
LsQueryLineCpPpoint
LsLwMultDivR
LsPointUV2FromPointUV1
LssbGetDurTrailWithPensInSubline
LsdnFinishBySubline
LsFinishCurrentSubline
LsQueryLinePointPcp
Sections
.text Size: 430KB - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 302KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ