Static task
static1
Behavioral task
behavioral1
Sample
e7e88d4138ea35d1d2845da78a49d346bbf3a53bac4c3fd4d194c50ac8050782.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e7e88d4138ea35d1d2845da78a49d346bbf3a53bac4c3fd4d194c50ac8050782.exe
Resource
win10v2004-20220812-en
General
-
Target
e7e88d4138ea35d1d2845da78a49d346bbf3a53bac4c3fd4d194c50ac8050782
-
Size
169KB
-
MD5
09e11bfa5efc08e031de24f3b69969e4
-
SHA1
0fb0bee3940fa4cbb2c46c24d58a5bdd028e74b1
-
SHA256
e7e88d4138ea35d1d2845da78a49d346bbf3a53bac4c3fd4d194c50ac8050782
-
SHA512
26873007bef2e50ab92a0627852125b35a0a921ecc56ca24fd11d0c8766ae2074d542404f964239fb8c909801f9fcd639ac89060dcf74970d6d738477e5a740d
-
SSDEEP
1536:FldtPRBqtihwUNLyHhcSBjWVOZMms1uZ+DxU0G2FjH9+NjUM22cd4:nvRBqwyUJSBSEjs1uSxXoNgM2lm
Malware Config
Signatures
Files
-
e7e88d4138ea35d1d2845da78a49d346bbf3a53bac4c3fd4d194c50ac8050782.exe windows x86
929737858c643ec10d056943a7342b65
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSAStartup
closesocket
send
getsockname
inet_addr
getpeername
WSAGetLastError
ntohs
recv
gethostbyname
gethostname
listen
bind
htons
socket
setsockopt
accept
kernel32
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
ExitProcess
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryA
GetProcAddress
GetLastError
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
WritePrivateProfileStringA
FindNextFileA
FindFirstFileA
FindClose
GetTempPathA
GetTempFileNameA
GetACP
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
CloseHandle
CreateThread
lstrcmpiA
lstrcpynA
CreateEventA
GetTickCount
Sleep
SetEvent
GetModuleFileNameA
GetModuleHandleA
WaitForMultipleObjects
TerminateThread
GetCurrentThreadId
WriteFile
CreateFileA
GetShortPathNameA
GetExitCodeThread
GetCurrentProcessId
MultiByteToWideChar
OutputDebugStringW
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileIntA
IsBadReadPtr
IsBadWritePtr
user32
GetMessageA
LoadStringA
IsWindow
SendMessageA
PostMessageA
DispatchMessageA
LoadIconA
GetActiveWindow
wvsprintfA
wsprintfA
DefWindowProcA
PostQuitMessage
MoveWindow
MessageBoxA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassA
LoadCursorA
PostThreadMessageA
gdi32
GetStockObject
advapi32
RegDeleteKeyA
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
ole32
CoRevokeClassObject
CoTaskMemAlloc
CoInitialize
CoUninitialize
StringFromCLSID
CoTaskMemFree
CoRegisterClassObject
msvcr71
_initterm
__getmainargs
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
_vsnprintf
wcslen
isupper
_mbsnbcpy
wcstombs
localtime
isxdigit
strtok
_mkdir
__CxxFrameHandler
_controlfp
_except_handler3
__setusermatherr
memset
__security_error_handler
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
ctime
gmtime
time
_read
strstr
_stricmp
_creat
??3@YAXPAX@Z
??2@YAPAXI@Z
_strdup
free
_ftime
calloc
_mbschr
atoi
_snprintf
_write
_open
_close
_unlink
sprintf
_errno
strncpy
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_lseek
_mbsnbcat
rename
_mbscmp
_stat
_mbsrchr
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE