Static task
static1
Behavioral task
behavioral1
Sample
ccb865972178ac66ffdf75bbab8cddc729c0b7bd13215675585688b7363b25dc.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ccb865972178ac66ffdf75bbab8cddc729c0b7bd13215675585688b7363b25dc.exe
Resource
win10v2004-20220812-en
General
-
Target
ccb865972178ac66ffdf75bbab8cddc729c0b7bd13215675585688b7363b25dc
-
Size
85KB
-
MD5
afdbd5b379da8dcf863bbc3c862a4925
-
SHA1
d2cf47c3cc2870841994c7ae04462699e4637a83
-
SHA256
ccb865972178ac66ffdf75bbab8cddc729c0b7bd13215675585688b7363b25dc
-
SHA512
3ea798b062c53c55d284ff0cb580a1bedc30be41714b83110a211c554dce4a8272323a1d3f8d4b78ea237de2ba4ed283ee9080b8e0d27a83eb2ab5d5ac3c2e3b
-
SSDEEP
1536:2XuUIkuDGq6/sdaplX64WjS6bQcDqcOxI8qfy3CSt06Ym3ViFwIjmo3:2gfDb6UdaKFu6EczP8R35t06YmieIj
Malware Config
Signatures
Files
-
ccb865972178ac66ffdf75bbab8cddc729c0b7bd13215675585688b7363b25dc.exe windows x86
cb1f8a8854bd5458142dd7c582ed94db
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
UrlApplySchemeA
UrlEscapeA
ChrCmpIA
SHRegSetUSValueW
UrlGetLocationW
PathFindExtensionA
StrTrimW
UrlIsA
PathFindOnPathW
SHIsLowMemoryMachine
wvnsprintfA
SHRegEnumUSKeyW
PathRemoveBlanksW
StrDupA
SHRegDeleteEmptyUSKeyW
PathStripPathW
PathIsSystemFolderA
SHRegDeleteUSValueA
PathMatchSpecA
PathUnmakeSystemFolderA
SHEnumKeyExA
PathIsSameRootA
PathIsContentTypeW
PathSkipRootW
UrlGetLocationA
PathIsURLA
PathBuildRootA
UrlGetPartW
PathUndecorateW
StrStrIA
StrStrW
SHRegDeleteUSValueW
PathIsURLW
wnsprintfA
SHRegCloseUSKey
PathMakePrettyW
StrSpnW
SHRegSetUSValueA
SHGetValueW
StrPBrkA
StrFromTimeIntervalW
PathIsUNCServerA
PathRemoveFileSpecA
PathIsLFNFileSpecA
SHRegEnumUSValueA
PathGetArgsW
ChrCmpIW
UrlCompareA
PathStripToRootW
UrlCreateFromPathW
PathAddBackslashW
PathRemoveExtensionW
PathStripToRootA
PathCompactPathW
PathFindNextComponentA
AssocQueryKeyW
StrNCatW
SHGetValueA
SHRegEnumUSValueW
PathIsRelativeW
PathRelativePathToW
SHStrDupA
PathIsDirectoryEmptyW
StrNCatA
PathCommonPrefixA
PathMakeSystemFolderA
PathStripPathA
StrIsIntlEqualW
StrCmpNIA
PathCanonicalizeA
SHRegCreateUSKeyW
SHOpenRegStream2W
StrFormatByteSize64A
PathFindFileNameW
StrRStrIA
PathSkipRootA
IntlStrEqWorkerA
SHSetValueA
StrToIntExW
SHCreateStreamOnFileA
UrlUnescapeA
SHQueryValueExW
PathIsPrefixA
PathIsDirectoryA
PathIsPrefixW
PathGetCharTypeW
PathRemoveArgsA
UrlHashW
PathSetDlgItemPathA
wvnsprintfW
StrStrA
SHSetThreadRef
UrlGetPartA
StrRChrW
SHCreateStreamOnFileW
SHRegGetUSValueA
PathGetDriveNumberA
SHSetValueW
PathUnmakeSystemFolderW
PathSetDlgItemPathW
PathIsFileSpecW
ColorRGBToHLS
PathRemoveExtensionA
StrRetToBufA
PathGetDriveNumberW
SHStrDupW
PathMakeSystemFolderW
StrRetToBufW
IntlStrEqWorkerW
SHRegQueryUSValueA
PathCompactPathA
PathIsFileSpecA
PathIsUNCW
PathRenameExtensionW
PathFindNextComponentW
user32
DrawMenuBar
DrawAnimatedRects
CreateIconFromResource
DialogBoxIndirectParamW
OpenWindowStationA
DlgDirSelectExW
CharLowerW
GetDialogBaseUnits
TabbedTextOutW
IsChild
EnumWindows
ShowCaret
GetQueueStatus
UnhookWindowsHook
PostQuitMessage
GetThreadDesktop
GetWindowThreadProcessId
DdeDisconnect
FlashWindow
SetWindowsHookExW
GetWindowPlacement
CreateWindowStationW
ClipCursor
EnumClipboardFormats
GetKeyNameTextW
SetSystemCursor
DlgDirListA
DestroyWindow
DdeQueryNextServer
IsCharUpperA
ToUnicodeEx
LoadCursorFromFileA
DdeKeepStringHandle
DestroyIcon
GetUserObjectInformationW
WaitMessage
EndDialog
OpenIcon
ShowCursor
CharNextW
CreateCursor
ImpersonateDdeClientWindow
ScrollWindow
GetLastActivePopup
SendMessageW
CharUpperBuffA
SubtractRect
LoadIconW
GetDlgItem
IsCharLowerW
InsertMenuA
GetPropA
DdeImpersonateClient
OemKeyScan
SetCaretPos
EnumThreadWindows
SetRectEmpty
MapVirtualKeyW
IsCharAlphaA
CreateIconFromResourceEx
SetParent
CreatePopupMenu
SetDebugErrorLevel
IntersectRect
FillRect
UnregisterHotKey
DdeEnableCallback
MonitorFromRect
IsClipboardFormatAvailable
GetWindowModuleFileNameW
RegisterDeviceNotificationW
CloseWindowStation
EnableWindow
PostThreadMessageA
SetScrollPos
GetSubMenu
GetGuiResources
WaitForInputIdle
DefDlgProcW
GetTabbedTextExtentA
CharLowerA
GetMenuStringA
LoadAcceleratorsW
SetClipboardViewer
DrawFrameControl
GetProcessWindowStation
FreeDDElParam
CreateWindowStationA
GetTitleBarInfo
ModifyMenuA
GetMessageTime
GetClassNameW
SetForegroundWindow
ShowWindowAsync
CheckDlgButton
CopyRect
IsDialogMessage
WINNLSGetEnableStatus
ValidateRgn
DefDlgProcA
GetMessageExtraInfo
CreateMDIWindowW
SendIMEMessageExW
SetFocus
DialogBoxParamA
GetClassInfoA
OemToCharW
SetCapture
SwapMouseButton
GetWindowLongW
GetFocus
AnimateWindow
UnhookWindowsHookEx
DialogBoxIndirectParamA
ScrollWindowEx
OemToCharBuffA
CharPrevA
RegisterClassExA
DdeInitializeW
SetClassLongA
ValidateRect
SetKeyboardState
CloseClipboard
GetCaretBlinkTime
ClientToScreen
GetGUIThreadInfo
CharPrevExA
DragObject
CreateDialogIndirectParamA
SendMessageA
SwitchDesktop
GetMenuItemID
kernel32
BuildCommDCBW
GlobalAddAtomW
GetPrivateProfileSectionW
DeleteAtom
GetProfileSectionW
CancelWaitableTimer
SetConsoleCursorPosition
CreateMutexA
VirtualProtect
VirtualAlloc
GetThreadLocale
FindCloseChangeNotification
SetFileAttributesA
SetWaitableTimer
OutputDebugStringW
GetConsoleTitleA
GlobalDeleteAtom
OpenEventA
CompareFileTime
LCMapStringA
ReadProcessMemory
GetTempFileNameA
WaitForMultipleObjects
GetConsoleScreenBufferInfo
GetConsoleTitleW
VirtualQuery
UnmapViewOfFile
QueryPerformanceFrequency
LoadLibraryA
ResetEvent
FileTimeToSystemTime
SetProcessPriorityBoost
CreateFiber
MultiByteToWideChar
SetUnhandledExceptionFilter
LoadLibraryExA
RemoveDirectoryW
VirtualFreeEx
SetLocalTime
WinExec
IsBadWritePtr
IsDBCSLeadByte
GetUserDefaultLangID
ResetWriteWatch
GetTimeZoneInformation
GetFileType
SetThreadExecutionState
WriteConsoleOutputAttribute
GetModuleFileNameW
LocalSize
FreeLibrary
LockFile
Thread32Next
VirtualQueryEx
FlushFileBuffers
FreeConsole
GetSystemDefaultLCID
IsBadStringPtrA
UpdateResourceA
BeginUpdateResourceA
SetPriorityClass
GetLogicalDriveStringsW
ReadConsoleOutputW
GetModuleHandleW
GetStartupInfoA
GetShortPathNameW
WriteProfileSectionA
GetLongPathNameA
SetCalendarInfoW
EnumSystemLocalesW
GetPrivateProfileIntW
GetFileAttributesW
GetDefaultCommConfigA
GlobalAlloc
GetWindowsDirectoryW
GetLongPathNameW
GetProcessVersion
CreateSemaphoreW
HeapUnlock
FreeResource
WaitNamedPipeW
OpenFileMappingA
GetProfileStringA
OpenWaitableTimerW
VirtualAllocEx
GetProfileStringW
FindClose
EnumSystemCodePagesW
FormatMessageW
WritePrivateProfileStructW
ResumeThread
SignalObjectAndWait
CopyFileA
lstrcatA
GetBinaryTypeW
PrepareTape
Heap32ListNext
IsBadCodePtr
FlushInstructionCache
GetVolumeInformationW
GlobalFindAtomA
FileTimeToDosDateTime
PostQueuedCompletionStatus
Module32First
GetCommState
EnumResourceNamesW
FlushConsoleInputBuffer
FillConsoleOutputAttribute
BackupWrite
GlobalUnWire
GetCPInfoExA
IsDebuggerPresent
GetConsoleCP
SetLocaleInfoA
SetCommState
GetFileAttributesExA
HeapLock
Process32First
SetConsoleActiveScreenBuffer
SetConsoleTitleW
EnumCalendarInfoW
GetOEMCP
GetDiskFreeSpaceExW
GetTempPathA
WaitForMultipleObjectsEx
SetCommConfig
UnlockFileEx
MoveFileW
GenerateConsoleCtrlEvent
GetDateFormatA
SetConsoleWindowInfo
CreateDirectoryA
GetCommandLineA
GetPrivateProfileSectionNamesA
advapi32
GetAce
CryptVerifySignatureW
BuildImpersonateTrusteeA
ObjectCloseAuditAlarmW
RegQueryMultipleValuesA
SetNamedSecurityInfoA
DuplicateTokenEx
CryptDestroyKey
AddAccessDeniedAce
BackupEventLogA
AddAuditAccessAce
LookupPrivilegeDisplayNameW
GetServiceKeyNameW
GetServiceKeyNameA
SetFileSecurityA
GetEffectiveRightsFromAclA
GetSidLengthRequired
EnumDependentServicesW
CryptHashSessionKey
CryptDeriveKey
LookupPrivilegeValueA
CryptGenKey
QueryServiceObjectSecurity
QueryServiceConfigW
ReportEventA
RegCreateKeyA
CryptEnumProviderTypesW
CryptReleaseContext
CreateProcessAsUserW
OpenServiceA
AccessCheckAndAuditAlarmA
StartServiceCtrlDispatcherA
AreAnyAccessesGranted
EnumDependentServicesA
SetKernelObjectSecurity
RegDeleteValueW
RegSaveKeyA
BuildExplicitAccessWithNameA
RegisterServiceCtrlHandlerW
SetNamedSecurityInfoW
MakeAbsoluteSD
RegFlushKey
DestroyPrivateObjectSecurity
CryptGenRandom
IsValidSid
InitiateSystemShutdownW
AllocateLocallyUniqueId
GetKernelObjectSecurity
ReadEventLogA
BuildSecurityDescriptorA
AdjustTokenGroups
CreateServiceA
ObjectPrivilegeAuditAlarmW
GetExplicitEntriesFromAclW
CloseEventLog
RegisterEventSourceW
LookupSecurityDescriptorPartsA
CryptContextAddRef
GetOldestEventLogRecord
ObjectCloseAuditAlarmA
ReadEventLogW
SetSecurityDescriptorGroup
RegSetValueA
LookupAccountNameW
SetSecurityDescriptorSacl
RegQueryValueExW
LogonUserW
ObjectOpenAuditAlarmA
GetAclInformation
ConvertSecurityDescriptorToAccessW
SetNamedSecurityInfoExW
GetEffectiveRightsFromAclW
CreateServiceW
CancelOverlappedAccess
CloseServiceHandle
GetExplicitEntriesFromAclA
SetEntriesInAclW
SetEntriesInAccessListA
CryptHashData
ConvertSecurityDescriptorToAccessNamedW
RegOpenKeyExA
EqualSid
EqualPrefixSid
PrivilegedServiceAuditAlarmW
GetSecurityInfoExA
TrusteeAccessToObjectA
AreAllAccessesGranted
ObjectDeleteAuditAlarmA
SetSecurityDescriptorDacl
GetCurrentHwProfileW
ImpersonateSelf
RegQueryValueExA
AbortSystemShutdownW
DeleteAce
BuildSecurityDescriptorW
EnumServicesStatusA
RegNotifyChangeKeyValue
QueryServiceLockStatusA
QueryServiceConfigA
ObjectOpenAuditAlarmW
GetTrusteeTypeW
PrivilegeCheck
SetServiceObjectSecurity
CryptDecrypt
GetSecurityDescriptorGroup
BuildExplicitAccessWithNameW
GetSecurityInfoExW
ImpersonateNamedPipeClient
CryptCreateHash
RegisterEventSourceA
OpenEventLogA
GetSecurityDescriptorControl
RegRestoreKeyA
InitiateSystemShutdownA
AddAce
GetNamedSecurityInfoW
ole32
MonikerRelativePathTo
OleCreateEx
StgOpenStorageEx
UpdateDCOMSettings
StgGetIFillLockBytesOnFile
CoLockObjectExternal
CoFreeUnusedLibraries
ReadClassStg
OleFlushClipboard
CoFileTimeToDosDateTime
CoGetCurrentLogicalThreadId
CoGetInstanceFromFile
CoMarshalInterface
IIDFromString
CoRevokeClassObject
OleQueryLinkFromData
MonikerCommonPrefixWith
CoCreateFreeThreadedMarshaler
ReleaseStgMedium
CreateClassMoniker
OleRegEnumVerbs
StgIsStorageFile
CoMarshalInterThreadInterfaceInStream
CoGetInstanceFromIStorage
WriteClassStm
CoGetPSClsid
OleCreateLink
RevokeDragDrop
CoInitialize
SetConvertStg
CoGetCurrentProcess
CoResumeClassObjects
OleSetClipboard
CoRegisterSurrogate
CoQueryProxyBlanket
CreatePointerMoniker
StringFromCLSID
OleConvertIStorageToOLESTREAM
CoRegisterPSClsid
CoRegisterMallocSpy
StgSetTimes
GetHGlobalFromStream
CoIsHandlerConnected
OleRegGetUserType
GetConvertStg
UtGetDvtd16Info
CreateGenericComposite
ReadStringStream
IsAccelerator
CoGetClassObject
CoInitializeSecurity
CoQueryReleaseObject
OleCreateLinkEx
SetDocumentBitStg
StgCreateDocfileOnILockBytes
GetClassFile
OleCreate
CoRegisterClassObject
CoCreateGuid
CoDisconnectObject
CoGetCallContext
CoLoadLibrary
OleConvertIStorageToOLESTREAMEx
CreateDataAdviseHolder
CoQueryClientBlanket
BindMoniker
CoUnmarshalInterface
CoGetCallerTID
StgGetIFillLockBytesOnILockBytes
OleConvertOLESTREAMToIStorageEx
OleDraw
CoRevokeMallocSpy
CoCopyProxy
StgOpenStorage
CLSIDFromString
IsEqualGUID
OleCreateFromFileEx
StgCreateDocfile
StgIsStorageILockBytes
OleIsCurrentClipboard
OleCreateLinkFromData
RegisterDragDrop
OleBuildVersion
CoQueryAuthenticationServices
CoGetMalloc
UtGetDvtd32Info
UtConvertDvtd32toDvtd16
CoRegisterMessageFilter
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE