Static task
static1
Behavioral task
behavioral1
Sample
b9436356c18e8efb46cd3bb3015964b08c0c20f3c9cfe38a2408e2c3a72a242c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b9436356c18e8efb46cd3bb3015964b08c0c20f3c9cfe38a2408e2c3a72a242c.exe
Resource
win10v2004-20220812-en
General
-
Target
b9436356c18e8efb46cd3bb3015964b08c0c20f3c9cfe38a2408e2c3a72a242c
-
Size
168KB
-
MD5
58a20df98b286bda0dc12330cfbaa255
-
SHA1
0c84b5297e63a99128603e4385d78130d5a6956f
-
SHA256
b9436356c18e8efb46cd3bb3015964b08c0c20f3c9cfe38a2408e2c3a72a242c
-
SHA512
6dc4afcf88f6b1292c070567f948b7819803f43060976ed728ffd730b6e424637cdb2204819615216f1cce5f24286da5be0ed1b7bfeaae3ad95f9f792b14fdd4
-
SSDEEP
3072:/bKXD1OhOI8V0yIB5wEsAYrvV5IGBmdDQ+rI5zlalX+wx8cV:25OhO/eyIBjerzciQXdf
Malware Config
Signatures
Files
-
b9436356c18e8efb46cd3bb3015964b08c0c20f3c9cfe38a2408e2c3a72a242c.exe windows x86
ec50ad7825b134d7d50c9abd199f4370
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
common
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?Stop@TXBugMonitor@@YAHXZ
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??BCTXStringW@@QBEPB_WXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
ord25
?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z
?OnExitWinMain@Misc@Util@@YAXXZ
?NotifyIdle@TXTimer@@YAXXZ
??0CTXStringW@@QAE@PB_W@Z
?GetLength@CTXStringW@@QBEHXZ
?MinimzeMemory@Sys@Util@@YAXXZ
??BCTXBSTR@@QBEPA_WXZ
??0CTXStringW@@QAE@PA_W@Z
?SetIdleCallback@TXTimer@@YAHPAUITXIdleCallback@@I@Z
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
??0CTXStringW@@QAE@ABV0@@Z
??1CTXBSTR@@QAE@XZ
?CheckVistaAndStartSelfMediumLevel@Sys@Util@@YAHXZ
?OnUninitCom@Misc@Util@@YAXXZ
?NotifyIdle@Window@Util@@YAJXZ
?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
?Format@CTXStringW@@QAAXPB_WZZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??0CTXStringW@@QAE@XZ
??1CTXStringW@@QAE@XZ
?AddIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
??0CFmtString@@QAE@XZ
??1CFmtString@@QAE@XZ
?PropertyStr@CFmtString@@QAEHPB_W0@Z
?AddFmtString@TXStringBundle@@YAXABVCFmtString@@@Z
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
?GetSession@TXLog@@YAKXZ
?GetLCID@NLS@@YAKXZ
?ValidateBugReport@TXBugReport@@YAXXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?InitNetwork@Network@Util@@YAHXZ
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?SetTencentProductName@ProductConfig@Util@@YAHABVCTXStringW@@@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?EraseIdleCallback@TXTimer@@YAHPAUITXIdleCallback@@I@Z
?GetMemoryUsage@Sys@Util@@YAXAAK0@Z
imdllbuild
?Init@Version@@YAHXZ
?GetMajorVer@Version@@YAEXZ
?GetMinorVer@Version@@YAEXZ
?GetBuildVer@Version@@YAKXZ
?GetProgramRootDir@Sys@Util@@YA?AVCTXStringW@@XZ
?GetEmbedModePipeName@CommandLine@Util@@YA?AVCTXStringW@@XZ
?GetStartupType@CommandLine@Util@@YAHXZ
kernel32
SetEvent
GetCurrentThreadId
Sleep
GetProcAddress
FreeLibrary
CreateThread
GetModuleHandleW
InterlockedDecrement
DeleteCriticalSection
GetEnvironmentVariableW
SetEnvironmentVariableW
GetSystemInfo
InitializeCriticalSection
QueryPerformanceFrequency
GlobalMemoryStatus
CloseHandle
WriteProcessMemory
QueryPerformanceCounter
GetCurrentProcessId
GetModuleFileNameW
CreateEventW
RaiseException
LocalAlloc
InterlockedExchange
GetLastError
LoadLibraryA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
OpenEventW
WaitForSingleObject
InterlockedIncrement
GetTickCount
GetCurrentThread
GetCurrentProcess
SetThreadPriority
user32
WaitMessage
MessageBoxW
PostThreadMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
ole32
OleUninitialize
CoCreateInstance
CoUninitialize
OleInitialize
atl80
ord32
ord64
ord30
msvcp80
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
msvcr80
_except_handler4_common
__set_app_type
_crt_debugger_hook
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
__CxxFrameHandler3
__p__fmode
??3@YAXPAX@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??1exception@std@@UAE@XZ
__argc
__wargv
wcsncmp
_time64
_wtoi
_CxxThrowException
memset
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
Sections
.text Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
@TC Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE