Static task
static1
Behavioral task
behavioral1
Sample
9f75fb8671b15d734bbf3d4b922e8227a0a33f30e637b2d901cec276d2eb461d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9f75fb8671b15d734bbf3d4b922e8227a0a33f30e637b2d901cec276d2eb461d.exe
Resource
win10v2004-20220812-en
General
-
Target
9f75fb8671b15d734bbf3d4b922e8227a0a33f30e637b2d901cec276d2eb461d
-
Size
828KB
-
MD5
65a4714b39be99e168a4abd2877c54ea
-
SHA1
2baa7b091c6987c4ac372e9859fbdf7c0a94ffa8
-
SHA256
9f75fb8671b15d734bbf3d4b922e8227a0a33f30e637b2d901cec276d2eb461d
-
SHA512
c2f6f5f3d5909db34d9a4855704677513782007a24ba0febdd3078720ec8cbd78d4b07649fcd78998ee5b4e7e5ac07621e5901eb7b481e60bd2abb7e924d2cc8
-
SSDEEP
24576:heD7X676wJ057/NdMVC6gejfVYMpMiuK+FIkR6:heD7Ko7/Z6vfVLoLFIkY
Malware Config
Signatures
Files
-
9f75fb8671b15d734bbf3d4b922e8227a0a33f30e637b2d901cec276d2eb461d.exe windows x86
8baa5f116836edb1a50c1e50f6111461
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
query
?NewStemmer@CCiOle@@SGPAUIStemmer@@ABU_GUID@@@Z
?SetSZParam@CMachineAdmin@@QAEXPBG0K@Z
?GetStringFromLCID@@YGXKPAG@Z
?GetBlob@CMemDeSerStream@@UAEXPAEK@Z
?Skip@CEnumWorkid@@UAGJK@Z
?ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KAAUtagPROPVARIANT@@PAEPAI@Z
?AddDir@CCatState@@QAEXAAV?$XPtrST@G@@@Z
?MakePath@CFullPath@@QAEXPBG@Z
?Next@CPropertyList@@UAEPBVCPropEntry@@XZ
?ReadProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@PAEPAI@Z
?GetColumn@CCatState@@QBEPBGI@Z
?ReadProperty@CPropertyStore@@QAEHAAVCPropRecordNoLock@@KPAUtagPROPVARIANT@@PAI@Z
?StopCI@CMachineAdmin@@QAEHXZ
?My_wcstoui64@@YA_KPBGPAPAGH@Z
?GetPropType@CEmptyPropertyList@@SGGI@Z
?Marshall@CNodeRestriction@@QBEXAAVPSerStream@@@Z
?AddCachedProperty@CCatalogAdmin@@QAEXABVCFullPropSpec@@KKKH@Z
??1COccRestriction@@QAE@XZ
?CiGetPassword@@YGHPBG0PAG@Z
??0CRcovStrmTrans@@IAE@AAVPRcovStorageObj@@W4RcovOpType@@@Z
??1CDbPropBaseRestriction@@QAE@XZ
??8CDbColId@@QBEHABV0@@Z
??0CDbColumns@@QAE@I@Z
??0CMemSerStream@@QAE@PAEK@Z
?SetI4@CStorageVariant@@QAEXJI@Z
?SetScopeProperties@@YGXPAUICommand@@IPBQBGPBK11@Z
?OpenRecord@CPropStoreManager@@QAEPAVCCompositePropRecord@@KPAE@Z
?ResetType@CAllocStorageVariant@@IAEXAAVPMemoryAllocator@@@Z
CIBuildQueryNode
?CheckHasIndexTable@CiStorage@@SGHPBG@Z
?WritePropertyInNewRecord@CPropStoreManager@@QAEKKABVCStorageVariant@@@Z
?AllocHeapAndGetWString@@YGPAGAAVPDeSerStream@@@Z
?GetByte@CMemDeSerStream@@UAEEXZ
?InsertChild@CDbCmdTreeNode@@IAEXPAV1@@Z
?QueryInterface@CEnumWorkid@@UAGJABU_GUID@@PAPAX@Z
?Recognize@CDFA@@QAEEPBG@Z
?Marshall@CPropertyRestriction@@QBEXAAVPSerStream@@@Z
?Release@CEnumWorkid@@UAGKXZ
??0CRequestClient@@QAE@PBGPAUIDBProperties@@@Z
SetupCache
SetCatalogState
?ciIsValidPointer@@YGHPBX@Z
??0CImpersonationTokenCache@@QAE@PBG@Z
?Refresh@CCiRegParams@@QAEXPAUICiAdminParams@@H@Z
msi
MsiRecordGetInteger
MsiFormatRecordW
MsiSetFeatureStateW
MsiGetTargetPathW
MsiMessageBoxW
MsiGetComponentStateW
MsiRecordClearData
MsiInstallMissingFileW
MsiConfigureProductExW
MsiRecordSetInteger
MsiGetFeatureStateA
MsiFormatRecordA
MsiSetComponentStateA
MsiRecordGetStringW
MsiViewGetErrorW
MsiGetShortcutTargetA
MsiRecordIsNull
MsiSummaryInfoGetPropertyCount
MsiGetPatchInfoA
MsiConfigureFeatureFromDescriptorW
MsiProcessAdvertiseScriptW
MsiEnumProductsW
MsiGetProductCodeW
Migrate10CachedPackagesW
MsiIsProductElevatedW
MsiRecordSetStreamW
MsiDatabaseIsTablePersistentW
kernel32
GetConsoleCursorInfo
SetSystemPowerState
GetUserGeoID
SetThreadExecutionState
RemoveDirectoryA
GlobalReAlloc
Process32FirstW
IsBadHugeReadPtr
VerLanguageNameW
QueryPerformanceFrequency
SetCommBreak
SetUnhandledExceptionFilter
VirtualAlloc
WriteFileEx
CommConfigDialogA
GetVersion
EnumResourceLanguagesA
GetFirmwareEnvironmentVariableA
LoadLibraryA
GetTimeFormatA
GetLogicalDrives
LocalUnlock
IsWow64Process
GetProcAddress
FlushConsoleInputBuffer
ReadConsoleA
ReadConsoleOutputW
IsBadHugeWritePtr
HeapCreate
CreateFileMappingA
QueueUserWorkItem
ExpungeConsoleCommandHistoryA
SetFileShortNameA
GetCompressedFileSizeA
FreeResource
IsSystemResumeAutomatic
CreateDirectoryW
wldap32
ber_bvfree
ldap_get_option
ber_peek_tag
ldap_search_sW
ldap_simple_bind_sA
ldap_get_next_page_s
ldap_search_stA
ldap_result2error
ldap_free_controlsA
ldap_start_tls_sW
ldap_unbind
ldap_modrdn2W
ldap_compare_ext_sA
ldap_cleanup
ldap_modrdn2A
ldap_sasl_bindW
ldap_get_values_len
ldap_get_dn
ldap_get_optionA
ldap_get_next_page
ldap_set_dbg_routine
ldap_ufn2dnW
ldap_control_freeA
ldap_extended_operationW
ldap_value_freeA
LdapUnicodeToUTF8
ldap_modify
ldap_deleteW
msvcrt40
_ltoa
_adj_fdivr_m32
??_Gstreambuf@@UAEPAXI@Z
??_Efilebuf@@UAEPAXI@Z
_yn
_get_osfhandle
_wopen
_CIatan
??0ostream_withassign@@QAE@PAVstreambuf@@@Z
?unexpected@@YAXXZ
_wcsnicmp
floor
??_Estdiobuf@@UAEPAXI@Z
??4ios@@IAEAAV0@ABV0@@Z
rewind
?underflow@strstreambuf@@UAEHXZ
_mbsicmp
?good@ios@@QBEHXZ
??0logic_error@@QAE@ABQBD@Z
?iword@ios@@QBEAAJH@Z
isleadbyte
??4strstreambuf@@QAEAAV0@ABV0@@Z
??5istream@@QAEAAV0@P6AAAVios@@AAV1@@Z@Z
_winmajor
_mbbtype
_searchenv
_mbsnbcnt
_wpopen
_mbcjmstojis
??4istream_withassign@@QAEAAVistream@@PAVstreambuf@@@Z
_spawnve
_getmbcp
_getmaxstdio
?delbuf@ios@@QBEHXZ
?in_avail@streambuf@@QBEHXZ
_wfindfirsti64
??0fstream@@QAE@ABV0@@Z
_EH_prolog
?fail@ios@@QBEHXZ
??5istream@@QAEAAV0@AAC@Z
vsprintf
??_Eiostream@@UAEPAXI@Z
_mbsnbset
localtime
_wstat
?seekoff@strstreambuf@@UAEJJW4seek_dir@ios@@H@Z
?open@filebuf@@QAEPAV1@PBDHH@Z
?openprot@filebuf@@2HB
atan2
towupper
?clrlock@streambuf@@QAEXXZ
_ismbbkana
??0filebuf@@QAE@XZ
fgetwc
_mbctohira
??4stdiostream@@QAEAAV0@AAV0@@Z
_timezone
??1istrstream@@UAE@XZ
fputws
_hypot
?get@istream@@QAEHXZ
mktime
_aexit_rtn
??4ostream@@IAEAAV0@PAVstreambuf@@@Z
signal
??0ostream@@IAE@XZ
_strdup
_getdrive
_wsearchenv
_mbscat
?sync_with_stdio@ios@@SAXXZ
??0stdiostream@@QAE@ABV0@@Z
?overflow@filebuf@@UAEHH@Z
_ultow
_cscanf
_strnicmp
__setusermatherr
??0__non_rtti_object@@QAE@ABV0@@Z
??_Gostrstream@@UAEPAXI@Z
_wutime
_wspawnvpe
_adj_fdiv_r
??0istrstream@@QAE@PADH@Z
_commit
_fileno
_wremove
??4ostrstream@@QAEAAV0@ABV0@@Z
_ismbchira
iswpunct
_ftol
__doserrno
?clrlock@ios@@QAAXXZ
??4ifstream@@QAEAAV0@ABV0@@Z
fflush
__p__pgmptr
??_Dfstream@@QAEXXZ
vwprintf
_wfindnext
_y0
_mbstrlen
_iob
??4ostream_withassign@@QAEAAV0@ABV0@@Z
??_7istrstream@@6B@
??0filebuf@@QAE@HPADH@Z
_wfindnexti64
??_Gios@@UAEPAXI@Z
_ismbcspace
_wsystem
??0__non_rtti_object@@QAE@PBD@Z
iswupper
??6ostream@@QAEAAV0@M@Z
?getline@istream@@QAEAAV1@PADHD@Z
_wrmdir
__argv
iswxdigit
??1ofstream@@UAE@XZ
expsrv
rtcLeftBstr
_adj_fdivr_m64
__vbaMidStmtVarB
__vbaFreeVarList
__vbaLateMemStAd
rtcGetTimeVar
__vbaVarLikeVar
rtcNPV
__vbaVarTextCmpNe
__vbaAryCopy
rtR4FromErrVar
__vbaVarCmpGt
EbDestroyContext
rtcGetObject
__vbaVargObjAddref
__vbaExitEachAry
rtcInputCountVar
__vbaUI1I2
__vbaFpI4
__vbaFileCloseAll
rtcDateDiff
__vbaGosub
__vbaStrAryToUnicode
__vbaGet3
__vbaI2Var
rtcFileDateTime
SetMemEvent
__vbaR4Sgn
__vbaVarInt
__vbaStrVarVal
TipCreateInstanceProject2
rtcLenVar
__vbaVarAnd
__vbaFreeObjList
_adj_fdivr_m32
msvcrt20
wcspbrk
_mbctoupper
??_8strstream@@7Bistream@@@
??4istream@@IAEAAV0@ABV0@@Z
memset
_global_unwind2
?ends@@YAAAVostream@@AAV1@@Z
_tcsspn
??_Diostream@@QAEXXZ
?doallocate@strstreambuf@@MAEHXZ
_statusfp
qsort
log10
_spawnle
??_Gistrstream@@UAEPAXI@Z
getchar
isxdigit
?sbumpc@streambuf@@QAEHXZ
?getint@istream@@AAEHPAD@Z
_snwprintf
_findfirst
__CxxFrameHandler
remove
??_7ostream@@6B@
_heapset
_CItanh
__p__pctype
??6ostream@@QAEAAV0@PBD@Z
_strerror
fscanf
?close@filebuf@@QAEPAV1@XZ
_ismbcalpha
??5istream@@QAEAAV0@AAM@Z
iswupper
_stat
difftime
wcsxfrm
?openprot@filebuf@@2HB
?setrwbuf@stdiobuf@@QAEHHH@Z
_setmbcp
_filelength
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 706KB - Virtual size: 2.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ