Static task
static1
Behavioral task
behavioral1
Sample
aa937f75a58ab92ee2bf6456b00fabf97f85056784ce21e7bd1ad352a61f5f36.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa937f75a58ab92ee2bf6456b00fabf97f85056784ce21e7bd1ad352a61f5f36.exe
Resource
win10v2004-20220812-en
General
-
Target
aa937f75a58ab92ee2bf6456b00fabf97f85056784ce21e7bd1ad352a61f5f36
-
Size
31KB
-
MD5
71cbe8eb4c5a4f8bcba37f60ffb32a68
-
SHA1
c62bf3305dee2023dfa55a1f9d6c5493a8985b8a
-
SHA256
aa937f75a58ab92ee2bf6456b00fabf97f85056784ce21e7bd1ad352a61f5f36
-
SHA512
fd87ff1275490c967643f310f0ad2c9812838fa96e23945c0d2d885e73df901f541bb4ce6ae60105d36817e0857dddf73b923f9555e4d72eaa45b4deae51365c
-
SSDEEP
384:qIwS7Lws/BWzxP48vb58HnqA39vFZeNnFPXT2lBZerlxNWBOgKF/HKDis9DlBkxr:qIw+IPHbCvZeiDZ6TNWKvEDDDQ
Malware Config
Signatures
Files
-
aa937f75a58ab92ee2bf6456b00fabf97f85056784ce21e7bd1ad352a61f5f36.exe windows x86
9c55ede2332e3f1098085c99eb843a62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msi
MsiUseFeatureW
MsiProvideQualifiedComponentW
MsiGetFileVersionA
MsiDatabaseMergeW
MsiGetProductPropertyA
MsiRecordDataSize
MsiMessageBoxA
MsiGetSummaryInformationW
MsiConfigureProductExA
MsiVerifyPackageW
MsiCloseHandle
MsiSetFeatureStateA
MsiProvideComponentW
MsiEnableLogA
MsiAdvertiseScriptW
MsiGetMode
MsiEnumRelatedProductsA
MsiSummaryInfoGetPropertyCount
MsiQueryFeatureStateW
MsiGetProductInfoA
MsiQueryProductStateA
MsiViewClose
MsiDatabaseOpenViewA
MsiInstallProductA
MsiSetPropertyA
MsiSetInstallLevel
MsiEnumPatchesA
MsiNotifySidChangeW
MsiReinstallProductA
MsiEnableUIPreview
MsiEnumProductsW
MsiGetFeatureInfoA
MsiEnumClientsA
DllUnregisterServer
MsiApplyPatchW
MsiSequenceW
MsiGetProductCodeFromPackageCodeW
MsiSourceListAddSourceW
MsiGetProductPropertyW
MsiRecordClearData
MsiProcessMessage
MsiMessageBoxW
MsiSummaryInfoSetPropertyW
MsiGetDatabaseState
MsiVerifyPackageA
kernel32
SetTimeZoneInformation
GetExitCodeThread
BaseInitAppcompatCacheSupport
FreeLibraryAndExitThread
DeleteVolumeMountPointW
TlsSetValue
SetTimerQueueTimer
FindVolumeMountPointClose
EnumSystemCodePagesW
FindAtomA
AssignProcessToJobObject
UpdateResourceW
GetLastError
Process32NextW
FatalExit
AddConsoleAliasW
InterlockedPushEntrySList
VirtualAlloc
GetTapeStatus
ReadFileScatter
GetNumaAvailableMemoryNode
SetConsoleLocalEUDC
VirtualFreeEx
SetFileAttributesW
TlsFree
Heap32First
PeekConsoleInputW
GetFileTime
lstrlenW
SetNamedPipeHandleState
GetConsoleProcessList
TlsAlloc
GetCurrentDirectoryW
GetVDMCurrentDirectories
OpenSemaphoreA
WritePrivateProfileStringA
GetConsoleFontInfo
RemoveVectoredExceptionHandler
VerifyVersionInfoA
LoadLibraryA
MoveFileWithProgressW
SetThreadAffinityMask
GetLocaleInfoW
GetConsoleSelectionInfo
SetLocalPrimaryComputerNameW
GetConsoleCommandHistoryW
SetLocaleInfoW
wintrust
CryptCATAdminRemoveCatalog
WVTAsn1SpcFinancialCriteriaInfoEncode
WTHelperProvDataFromStateData
WVTAsn1SpcFinancialCriteriaInfoDecode
CryptCATAdminReleaseContext
WVTAsn1SpcLinkEncode
CryptCATCDFEnumCatAttributes
WVTAsn1SpcSpAgencyInfoDecode
TrustOpenStores
DriverCleanupPolicy
WVTAsn1SpcLinkDecode
SoftpubLoadSignature
AddPersonalTrustDBPages
SoftpubCleanup
CryptCATAdminEnumCatalogFromHash
CryptCATCDFEnumMembersByCDFTag
CryptCATAdminPauseServiceForBackup
OpenPersonalTrustDBDialogEx
WinVerifyTrustEx
WVTAsn1SpcPeImageDataEncode
CryptCATCDFEnumAttributesWithCDFTag
SoftpubDumpStructure
WVTAsn1CatNameValueEncode
SoftpubInitialize
TrustIsCertificateSelfSigned
WintrustCertificateTrust
WTHelperGetKnownUsages
CryptCATHandleFromStore
WVTAsn1CatMemberInfoDecode
WTHelperGetProvPrivateDataFromChain
WintrustLoadFunctionPointers
WTHelperGetFileHandle
CryptCATAdminAddCatalog
CryptCATEnumerateMember
WintrustGetDefaultForUsage
CryptCATCDFClose
linkinfo
ResolveLinkInfoA
GetLinkInfoData
IsValidLinkInfo
CompareLinkInfoReferents
DestroyLinkInfo
ResolveLinkInfo
CreateLinkInfoW
ResolveLinkInfoW
GetCanonicalPathInfo
GetCanonicalPathInfoA
CompareLinkInfoVolumes
DisconnectLinkInfo
GetCanonicalPathInfoW
CreateLinkInfo
CreateLinkInfoA
setupapi
SetupCommitFileQueue
CM_Run_Detection
SetupDiOpenClassRegKeyExW
SetupFreeSourceListW
CM_Open_DevNode_Key
CM_Locate_DevNodeA
CM_Next_Range
SetupDiGetDriverInfoDetailA
SetupGetSourceFileLocationA
SetupTermDefaultQueueCallback
CM_Intersect_Range_List
SetupGetFileCompressionInfoExW
CM_Free_Resource_Conflict_Handle
SetupGetFileCompressionInfoA
SetupCloseLog
SetupDiGetClassBitmapIndex
CM_Enumerate_Classes
SetupDeleteErrorW
SetupPromptForDiskA
CM_Delete_Class_Key_Ex
SetupDiGetActualSectionToInstallExW
SetupDiInstallClassExW
SetupDiGetDeviceInfoListClass
SetupQueryInfFileInformationA
CM_Query_Arbitrator_Free_Data
SetupInitializeFileLogA
SetupDiSetDeviceInstallParamsW
SetupInstallFileW
SetupDiGetINFClassW
SetupQueryInfVersionInformationW
CM_Get_DevNode_Status_Ex
SetupDiInstallClassW
SetupDiGetSelectedDriverA
pSetupStringTableDestroy
CM_Get_Class_Key_NameA
CM_Query_Remove_SubTree
SetupOpenAppendInfFileA
SetupInstallServicesFromInfSectionExW
SetupGetBinaryField
CM_Get_Global_State_Ex
SetupInstallFileExW
CM_Set_DevNode_Problem
SetupIterateCabinetW
msvcp60
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@ABV01@@Z
_LDscale
?narrow@?$ctype@G@std@@QBEDGD@Z
??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
?seekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z
?infinity@?$numeric_limits@C@std@@SACXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?round_error@?$numeric_limits@J@std@@SAJXZ
_Getcvt
??4?$numeric_limits@_N@std@@QAEAAV01@ABV01@@Z
?_Getcat@?$collate@G@std@@SAIXZ
?is_open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QBE_NXZ
?transform@?$collate@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@PBD0@Z
??1?$moneypunct@G$00@std@@UAE@XZ
?_Tidy@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@IAEXXZ
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Hstd@@YA?AV?$complex@O@0@ABV10@@Z
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z
??1?$moneypunct@G$0A@@std@@UAE@XZ
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?arg@std@@YAMABV?$complex@M@1@@Z
?polar@std@@YA?AV?$complex@O@1@ABO0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??_D?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
msvcrt
_mbcjistojms
_wtol
_ftime64
free
_CIsinh
__crtGetStringTypeW
_filelength
?unexpected@@YAXXZ
atan2
_adj_fptan
_mbsnicoll
_CxxThrowException
??_7bad_cast@@6B@
freopen
wcstol
_spawnvp
__argc
_mbsnbcnt
_mbsrev
fgetpos
swscanf
_wmktemp
_wtmpnam
__fpecode
ungetc
difftime
_jn
tolower
_ftime
_lsearch
setbuf
__CxxRegisterExceptionObject
query
?InsertChild@CDbCmdTreeNode@@IAEXPAV1@@Z
?Copy@CDbPropSet@@QAEHABUtagDBPROPSET@@@Z
??1CQueryUnknown@@QAE@XZ
??0CDbColId@@QAE@ABUtagDBID@@@Z
?Marshall@CDbCmdTreeNode@@QBEXAAVPSerStream@@@Z
?GetSortProp@CCatState@@QBEXIPAPBGPAW4SORTDIR@@@Z
?Clone@CNodeRestriction@@QBEPAV1@XZ
?UnMarshall@CDbParameter@@QAEHAAVPDeSerStream@@@Z
??0CEventItem@@QAE@GGKGKPBX@Z
?GetLocation@CCatalogAdmin@@QAEPBGXZ
?GetCGIVariableW@CWebServer@@QAEHPBGAAV?$XArray@G@@AAK@Z
?PutMaxValue@CValueNormalizer@@QAEXKAAKW4VARENUM@@@Z
?Marshall@CDbNumeric@@QBEXAAVPSerStream@@@Z
?OpenExclusive@CMmStream@@QAEXPAGH@Z
?ciDelete@@YGXPAX@Z
?Marshall@CBaseStorageVariant@@QBEXAAVPSerStream@@@Z
CollectFILTERPerformanceData
LocateCatalogsA
?Marshall@CVectorRestriction@@QBEXAAVPSerStream@@@Z
?Shutdown@CPropStoreManager@@QAEXXZ
?Marshall@CDbColId@@QBEXAAVPSerStream@@@Z
?wcsipattern@@YGPAGPAGPBG@Z
?SetCurrentProperty@CQueryParser@@AAEXPBGW4PropertyType@@@Z
??0CPathParser@@QAE@PBGK@Z
?Read@CRegAccess@@QAEPAGPBG0@Z
?SetProperty@CDbPropBaseRestriction@@QAEHABUtagDBID@@@Z
??0CStandardPropMapper@@QAE@XZ
?RemoveScope@CCatalogAdmin@@QAEXPBG@Z
??0CDbColId@@QAE@ABV0@@Z
?GetDWORDParam@CMachineAdmin@@QAEHPBGAAK@Z
?Copy@CDbProp@@QAEHABUtagDBPROP@@@Z
opengl32
glFogiv
glRasterPos4dv
glColor3iv
glPushClientAttrib
glColor3d
glCopyPixels
glIndexPointer
glRasterPos4d
glRasterPos2dv
glLighti
glLoadName
glIndexfv
glGetError
glSelectBuffer
glListBase
wglGetProcAddress
glTexCoord3fv
glIndexub
glTexCoord2dv
glFogf
glPushMatrix
glVertex3dv
glTexParameteriv
glLightf
glClearColor
wglShareLists
glGetPointerv
glRasterPos2sv
glMatrixMode
glClearIndex
glTexCoord1d
glGetTexGenfv
glInterleavedArrays
glMaterialf
glPolygonStipple
glNormalPointer
glVertex3fv
glEvalCoord1dv
glTexCoord1i
glEvalCoord2d
glRasterPos3sv
glGetTexEnvfv
glTexSubImage2D
glEvalCoord1d
glTexCoord3iv
mapistub
cmc_act_on
FtMulDwDw@8
UlRelease@4
CreateTable@36
UlPropSize@4
cmc_send_documents
BMAPIReadMail
DllCanUnloadNow
PropCopyMore@16
cmc_logoff
HrDecomposeMsgID@24
FDecodeID@12
DeinitMapiUtil@0
MAPIAdminProfiles
BMAPIFindNext
cmc_read
SetAttribIMsgOnIStg@16
OpenStreamOnFile@24
UNKOBJ_ScAllocateMore@16
MNLS_CompareStringW@24
FtAddFt@16
MAPIInitialize
MAPIAllocateMore@12
MNLS_lstrcmpW@8
ScCopyNotifications@16
OpenTnefStreamEx@32
FEqualNames@8
cmc_send
ScInitMapiUtil@4
user32
MoveWindow
SetScrollPos
EndDialog
IsIconic
gdi32
RectVisible
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 646B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ