Static task
static1
Behavioral task
behavioral1
Sample
b59a8bd6640aa6c554bf0d0afda0bc6f63c8c6a9b8674f440cc4b295834f352e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b59a8bd6640aa6c554bf0d0afda0bc6f63c8c6a9b8674f440cc4b295834f352e.exe
Resource
win10v2004-20220812-en
General
-
Target
b59a8bd6640aa6c554bf0d0afda0bc6f63c8c6a9b8674f440cc4b295834f352e
-
Size
320KB
-
MD5
34b5b23de8233071de0b3d3a62ce4313
-
SHA1
4d9ce01f4e13be7a03316de54feca28263933d71
-
SHA256
b59a8bd6640aa6c554bf0d0afda0bc6f63c8c6a9b8674f440cc4b295834f352e
-
SHA512
b075f0fb9ecbc56bd0dcb4b9ca91914d5d07788e5ec6805307949a12484931bf7d829fc920dc6b87e77f3ee89292c85fc5d6c2eaf0b860766195ed3b226457b1
-
SSDEEP
6144:LjqPODnAWPlsmJsALXqo1jmUZxL6xQGQm9UmM7I+6cw:LjqIAWWmXLXqs76ve7I+L
Malware Config
Signatures
Files
-
b59a8bd6640aa6c554bf0d0afda0bc6f63c8c6a9b8674f440cc4b295834f352e.exe windows x86
2d7841b7c31f4ffb728a7bac6f39c4dd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
common
?GetLength@CTXStringW@@QBEHXZ
??4CTXStringW@@QAEAAV0@PA_W@Z
??0CTXBSTR@@QAE@PB_W@Z
??1CTXBSTR@@QAE@XZ
??0CTXStringW@@QAE@PA_W@Z
??0CTXStringW@@QAE@ABV0@@Z
??0CTXStringW@@QAE@PB_W@Z
?TrimLeft@CTXStringW@@QAEAAV1@XZ
?Trim@CTXStringW@@QAEAAV1@XZ
??H@YA?AVCTXStringW@@ABV0@0@Z
?Right@CTXStringW@@QBE?AV1@H@Z
??0CTXStringW@@QAE@PB_WH@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?ExtractCabEx@Zip@Util@@YAHPB_W0@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?RemoveFileSystem@FS@@YAHPB_W@Z
?AddFileSystem@FS@@YAHW4FILESYSTEM_TYPE@@PB_W1HH@Z
ord37
??4CTXStringW@@QAEAAV0@ABV0@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?IsDirectoryExist@FS@@YAHPB_W@Z
??0CTXBSTR@@QAE@XZ
?Find@CTXStringW@@QBEHPB_WH@Z
?Format@CTXStringW@@QAAXPB_WZZ
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??ICTXBSTR@@QAEPAPA_WXZ
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?IsEmpty@CTXBSTR@@QAEHXZ
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?CopyDirectory@FS@@YAHPB_W0PAUITXCopyDirProgress@@@Z
?DeleteDirectory@FS@@YAHPB_W@Z
??BCTXBSTR@@QBEPA_WXZ
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?GuidFromString@Com@Util@@YAJPA_WAAU_GUID@@@Z
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
??8CTXBSTR@@QBE_NPB_W@Z
??8@YA_NABVCTXStringW@@PB_W@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?IsFileExist@FS@@YAHPB_W@Z
?Find@CTXStringW@@QBEH_WH@Z
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
?DeleteFileW@FS@@YAHPB_W@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
?GetAt@CTXStringW@@QBE_WH@Z
?MakeLower@CTXStringW@@QAEAAV1@XZ
??1CTXStringW@@QAE@XZ
??BCTXStringW@@QBEPB_WXZ
??0CTXStringW@@QAE@XZ
mfc80u
ord2239
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord3942
ord1079
ord1178
ord1198
ord4562
ord5226
ord5209
ord5562
ord3327
ord3824
ord757
ord566
ord3677
ord4535
ord2531
ord2725
ord2829
ord590
ord4301
ord331
ord2708
ord2832
ord2534
ord2640
ord2527
ord2936
ord3712
ord807
ord3713
ord3703
ord2638
ord762
ord3943
ord4475
ord4255
ord1194
ord3163
ord265
ord266
ord764
msvcr80
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_except_handler4_common
_exit
_cexit
__wgetmainargs
_amsg_exit
_wtoi
free
malloc
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
memset
__CxxFrameHandler3
__argc
_wcsicmp
__wargv
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_CxxThrowException
_XcptFilter
_invoke_watson
_wtol
_invalid_parameter_noinfo
_time64
kernel32
QueryPerformanceCounter
CreateDirectoryW
GetModuleHandleW
GetFileSize
WriteFile
ReadFile
FindFirstFileW
FindNextFileW
FindClose
GetDiskFreeSpaceExW
GetTickCount
GetCurrentProcessId
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetProcAddress
LoadLibraryW
CloseHandle
FreeLibrary
CreateFileW
user32
SendMessageW
RegisterClassExW
ShowWindow
DefWindowProcW
PeekMessageW
CreateWindowExW
IsWindow
DispatchMessageW
TranslateMessage
WaitMessage
SendMessageTimeoutW
gdi32
GetStockObject
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoCreateGuid
CoCreateInstance
CoUninitialize
oleaut32
VariantClear
SysAllocString
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
wintrust
WTHelperGetProvCertFromChain
CryptCATAdminAcquireContext
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATAdminReleaseCatalogContext
crypt32
CertGetNameStringW
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tc Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE