Static task
static1
Behavioral task
behavioral1
Sample
8e6883a4f22c6f7b16a0dd3fb9f399c80e9602f2fe3ea7176da7b66c9f95b5a5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8e6883a4f22c6f7b16a0dd3fb9f399c80e9602f2fe3ea7176da7b66c9f95b5a5.exe
Resource
win10v2004-20221111-en
General
-
Target
8e6883a4f22c6f7b16a0dd3fb9f399c80e9602f2fe3ea7176da7b66c9f95b5a5
-
Size
405KB
-
MD5
5de19dcafcf359b039fdfce54c65cf68
-
SHA1
16a97a74b32f01bf72ed04be1b0e7b671dc2273f
-
SHA256
8e6883a4f22c6f7b16a0dd3fb9f399c80e9602f2fe3ea7176da7b66c9f95b5a5
-
SHA512
3741398a05bacfccf56b13cab6a3bbf79fec64cc74130fb0ab5244a9bc1bd2a3d41053eef97ac0b83319bc20b467b48dfee02b501e9f17c3e4e5adc5d618e266
-
SSDEEP
12288:6OVNKd+WHIV9CTnwcdHqn2QHiVqLaTyv:6OVsdFoVywcYndyTyv
Malware Config
Signatures
Files
-
8e6883a4f22c6f7b16a0dd3fb9f399c80e9602f2fe3ea7176da7b66c9f95b5a5.exe windows x86
229a2d0eec99ac8efb05277c0a74d221
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegCloseKey
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
GetLengthSid
FreeSid
CopySid
CheckTokenMembership
AllocateAndInitializeSid
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegDeleteValueW
RegCreateKeyExW
kernel32
GetStartupInfoW
FindResourceW
WaitForMultipleObjects
SizeofResource
LockResource
LoadResource
LocalAlloc
LocalFree
GetModuleHandleW
GetLocalTime
LoadLibraryW
GetModuleFileNameW
GetSystemWindowsDirectoryW
GetSystemDirectoryW
CreateProcessW
CreateEventW
WaitForSingleObject
GetTempPathW
WriteFile
SetFilePointerEx
ReadFile
GetFullPathNameW
GetFileSizeEx
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FormatMessageW
GetThreadPriority
GetLastError
SetThreadPriority
GetCurrentThread
GetVersion
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryExW
GetVersionExW
SetWaitableTimer
CreateWaitableTimerW
CopyFileW
DeleteFileW
RemoveDirectoryW
MoveFileExW
GetTimeFormatW
GetDateFormatW
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
CloseHandle
InterlockedDecrement
InterlockedIncrement
OutputDebugStringW
IsDebuggerPresent
GetCommandLineW
SetFileAttributesW
GetProcAddress
Sleep
InterlockedExchange
InterlockedCompareExchange
OutputDebugStringA
RtlUnwind
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
msvcrt
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABV0@@Z
ungetc
realloc
__pioinfo
__badioinfo
_read
wcstombs
wctomb
mbtowc
localeconv
calloc
_fileno
isleadbyte
isxdigit
isdigit
_onexit
__dllonexit
_unlock
_lock
_controlfp
iswctype
memmove
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_wcmdln
wcslen
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_CxxThrowException
malloc
free
__CxxFrameHandler
_filelength
_wfopen
wprintf
printf
fread
fwrite
fseek
fclose
towlower
__RTDynamicCast
iswspace
feof
fgetws
wcsstr
memset
_initterm
memcpy
__mb_cur_max
_errno
_vsnwprintf
wcscmp
wcsrchr
wcschr
_wcsicmp
_purecall
strlen
??0exception@@QAE@XZ
rpcrt4
UuidCreate
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
Sections
.text Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 192KB - Virtual size: 1.3MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE