Static task
static1
Behavioral task
behavioral1
Sample
ab59d5de690ed842baefc710b8a803282a47d3cbe16e1a0eb00c40c086daaf4e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ab59d5de690ed842baefc710b8a803282a47d3cbe16e1a0eb00c40c086daaf4e.exe
Resource
win10v2004-20221111-en
General
-
Target
ab59d5de690ed842baefc710b8a803282a47d3cbe16e1a0eb00c40c086daaf4e
-
Size
44KB
-
MD5
107a48e27f3e9fb9c5b663933a086d04
-
SHA1
815c7bae31812c87f1c04cd9519c7fb5b60a88fa
-
SHA256
ab59d5de690ed842baefc710b8a803282a47d3cbe16e1a0eb00c40c086daaf4e
-
SHA512
5c6dc3062f296bfb9a07e5636348dd2486c13b08a6402b8b671bd6772122212a62a7fb98adb9e4ed171b964cab7efdc6e9224c8a0ea8c318eca374f044a27a14
-
SSDEEP
768:YdgQIqPwVOOfFmJrKXCOlkcQG8xdgbyVCi944sxYCHX6:0XIqPwFFmJrjOSlSdiG4Mv36
Malware Config
Signatures
Files
-
ab59d5de690ed842baefc710b8a803282a47d3cbe16e1a0eb00c40c086daaf4e.exe windows x86
f1ad64e79045f35195016bdf739a118b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
setupapi
CM_Set_Class_Registry_PropertyW
SetupGetLineCountA
pSetupStringTableLookUpString
CM_Get_Next_Log_Conf
CM_Add_Res_Des_Ex
pSetupInstallCatalog
CM_Get_Device_Interface_List_ExW
SetupDiSetDeviceRegistryPropertyA
pSetupGetQueueFlags
CM_Register_Device_Interface_ExW
CM_Free_Res_Des_Ex
ExtensionPropSheetPageProc
SetupGetFieldCount
CM_Modify_Res_Des_Ex
pSetupEnablePrivilege
SetupDiEnumDeviceInterfaces
SetupGetInfInformationA
SetupDiGetSelectedDevice
SetupSetDirectoryIdA
CM_Get_Next_Log_Conf_Ex
SetupDiGetClassDevsA
pSetupSetQueueFlags
MyFree
kernel32
SetFileValidData
LoadLibraryA
SearchPathA
GetFileType
CopyLZFile
GetDateFormatA
EnumSystemLocalesW
HeapWalk
DeleteTimerQueue
CreateSocketHandle
GetCurrentProcessId
GetModuleHandleA
BaseUpdateAppcompatCache
ContinueDebugEvent
ReplaceFileA
GetSystemDirectoryA
LZInit
VirtualAlloc
TlsGetValue
FreeEnvironmentStringsA
lstrcpynA
AddVectoredExceptionHandler
EnumDateFormatsA
TryEnterCriticalSection
GlobalFindAtomW
GetCommMask
GetConsoleKeyboardLayoutNameW
lstrcmpi
GetConsoleScreenBufferInfo
SetConsoleInputExeNameW
CreateMemoryResourceNotification
GetAtomNameA
GetVolumeInformationW
msvcp60
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@
?sqrt@?$_Ctr@N@std@@SANN@Z
?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
??4_Winit@std@@QAEAAV01@ABV01@@Z
??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ
??0locale@std@@AAE@PAV_Locimp@01@@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
??1bad_cast@std@@UAE@XZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0PBGI@Z
?grouping@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??1overflow_error@std@@UAE@XZ
?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
??0?$_Complex_base@O@std@@QAE@ABO0@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?open@?$basic_ifstream@GU?$char_traits@G@std@@@std@@QAEXPBDH@Z
??1__non_rtti_object@std@@UAE@XZ
?neg_format@?$_Mpunct@D@std@@QBE?AUpattern@money_base@2@XZ
?truename@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PADH@Z
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?quiet_NaN@?$numeric_limits@G@std@@SAGXZ
?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@XZ
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??0?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
ifsutil
?Initialize@SUPERAREA@@IAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@KPAVMESSAGE@@@Z
?Initialize@VOL_LIODPDRV@@IAEEPBVWSTRING@@0PAVSUPERAREA@@PAVMESSAGE@@E@Z
??0DP_DRIVE@@QAE@XZ
?GetNext@TLINK@@QAEPAXPAX@Z
??0SUPERAREA@@IAE@XZ
?QueryFreeDiskSpace@IFS_SYSTEM@@SGEPBVWSTRING@@PAVBIG_INT@@@Z
?GetAt@MOUNT_POINT_MAP@@QAEEKPAVWSTRING@@0@Z
?QueryMediaByte@DP_DRIVE@@QBEEXZ
?SendSonyMSInquiryCmd@DP_DRIVE@@QAEEPAUSONY_MS_INQUIRY_DATA@@@Z
??0TLINK@@QAE@XZ
?FlushCache@IO_DP_DRIVE@@QAEEXZ
??0DIGRAPH@@QAE@XZ
?DeleteEntry@AUTOREG@@SGEPBVWSTRING@@E@Z
?EnableVolumeCompression@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
?Initialize@TLINK@@QAEEG@Z
?InvalidateVolume@IO_DP_DRIVE@@QAEEXZ
??1INTSTACK@@UAE@XZ
?QueryChildren@DIGRAPH@@QBEEKPAVNUMBER_SET@@@Z
?Format@VOL_LIODPDRV@@QAE?AW4FORMAT_ERROR_CODE@@PBVWSTRING@@PAVMESSAGE@@KKK@Z
?Initialize@SECRUN@@QAEEPAVMEM@@PAVIO_DP_DRIVE@@VBIG_INT@@K@Z
?QueryRecommendedMediaType@DP_DRIVE@@QBE?AW4_MEDIA_TYPE@@XZ
?SendSonyMSTestUnitReadyCmd@DP_DRIVE@@QAEEPAU_SENSE_DATA@@@Z
?CheckAndRemove@NUMBER_SET@@QAEEVBIG_INT@@PAE@Z
??1CANNED_SECURITY@@UAE@XZ
?CheckAndAdd@SPARSE_SET@@QAEEVBIG_INT@@PAE@Z
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@0PAVMESSAGE@@EE@Z
user32
PrivateExtractIconsA
GetTitleBarInfo
SetSystemCursor
InvalidateRgn
GetPropA
SetWindowWord
UnlockWindowStation
GetUpdateRect
MsgWaitForMultipleObjects
IntersectRect
SetWindowsHookExW
RegisterWindowMessageW
wvsprintfW
WindowFromPoint
GetShellWindow
SetClipboardViewer
SetClassWord
FrameRect
EnumDesktopsW
GetWindowTextLengthA
BroadcastSystemMessageA
DdeGetData
mswsock
EnumProtocolsW
WSARecvEx
GetNameByTypeW
rresvport
GetAddressByNameW
MigrateWinsockConfiguration
inet_network
rcmd
EnumProtocolsA
WSPStartup
AcceptEx
dn_expand
NPLoadNameSpaces
GetServiceW
TransmitFile
SetServiceW
getnetbyname
GetTypeByNameW
sethostname
s_perror
GetServiceA
NSPStartup
StartWsdpService
GetAcceptExSockaddrs
GetAddressByNameA
rexec
GetTypeByNameA
SetServiceA
GetNameByTypeA
StopWsdpService
msi
MsiReinstallFeatureFromDescriptorA
MsiSummaryInfoSetPropertyA
MsiProvideAssemblyA
MsiGetFileSignatureInformationA
MsiEnumProductsW
MsiRecordSetInteger
MsiVerifyPackageA
MsiRecordGetInteger
MsiSetPropertyA
MsiFormatRecordW
MsiEvaluateConditionA
MsiAdvertiseScriptA
MsiGetComponentPathW
MsiDatabaseImportW
MsiInstallMissingFileW
MsiGetSourcePathW
MsiSourceListClearAllW
MsiQueryProductStateA
MsiEnumFeaturesW
MsiEnableLogW
Sections
.text Size: 1024B - Virtual size: 762B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ