Static task
static1
Behavioral task
behavioral1
Sample
d65d243d2e0f0f24074b1e13c4b2212ce8bd12779edabe144beb20c9149d3c9d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d65d243d2e0f0f24074b1e13c4b2212ce8bd12779edabe144beb20c9149d3c9d.exe
Resource
win10v2004-20221111-en
General
-
Target
d65d243d2e0f0f24074b1e13c4b2212ce8bd12779edabe144beb20c9149d3c9d
-
Size
268KB
-
MD5
e7957c039b14581343b20dec57ea9c57
-
SHA1
0bb553c1990053101fdf6f62b04e4ae52883c90c
-
SHA256
d65d243d2e0f0f24074b1e13c4b2212ce8bd12779edabe144beb20c9149d3c9d
-
SHA512
61462059e6fc335a719a2cfb4043642a0db51a4ab0c8c7a1f9a9b0478bff3e652eb421bd7f62d91239ba8422b85df5c5b041a4f0983bdc1129777618e72e72af
-
SSDEEP
6144:nvlk21KMsBPpxZOA7Yd3w0mrfH1fkPc7u7:vlN8P/ZOA7Mw04f4B7
Malware Config
Signatures
Files
-
d65d243d2e0f0f24074b1e13c4b2212ce8bd12779edabe144beb20c9149d3c9d.exe windows x86
6a52c44cd6e1fc07995def31864d1c71
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatA
lstrlenA
ExpandEnvironmentStringsA
lstrcpyA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
GetLastError
CreateMutexA
MoveFileA
RemoveDirectoryA
DeleteFileA
CreateDirectoryA
GetTempPathA
GetCommandLineA
GetModuleFileNameA
Sleep
GetLocalTime
GetTickCount
ReadFile
GetProcessHeap
SetEndOfFile
LoadLibraryA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetFilePointer
InitializeCriticalSectionAndSpinCount
VirtualAlloc
HeapReAlloc
HeapSize
HeapAlloc
FlushFileBuffers
VirtualFree
HeapFree
HeapCreate
GetFileAttributesExA
WriteFile
HeapDestroy
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryW
ExitProcess
OutputDebugStringW
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
DebugBreak
LCMapStringW
LCMapStringA
MultiByteToWideChar
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetLastError
TlsFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
GetModuleHandleW
TlsGetValue
GetProcAddress
IsBadReadPtr
HeapValidate
GetStartupInfoA
GetModuleFileNameW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
user32
wsprintfA
GetClassLongA
advapi32
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
ole32
CoInitialize
shell32
ShellExecuteA
shlwapi
PathFileExistsA
PathFindFileNameA
PathIsDirectoryA
PathGetArgsA
PathRemoveBlanksA
gdi32
SetColorSpace
GetEnhMetaFilePixelFormat
GetTextExtentPoint32A
CreateFontIndirectExA
EnumFontFamiliesExW
GetKerningPairsA
Escape
SetDIBColorTable
SetBkMode
SetPixelV
SelectClipPath
SetStretchBltMode
StrokePath
CopyEnhMetaFileW
SetEnhMetaFileBits
ExtFloodFill
PlayEnhMetaFile
CreatePolygonRgn
GdiSetBatchLimit
ColorCorrectPalette
SetMapperFlags
GetViewportExtEx
GetNearestColor
GetBitmapDimensionEx
UpdateColors
CloseMetaFile
GetTextCharset
GetCharABCWidthsFloatA
CreateBitmap
EnumICMProfilesA
CreateHalftonePalette
CreateRoundRectRgn
DeleteObject
PlayMetaFile
GetPixel
FloodFill
GetNearestPaletteIndex
PolyBezierTo
ExtCreatePen
CreatePenIndirect
ExtCreateRegion
GetCharWidthFloatA
GetCurrentObject
GetEnhMetaFileA
GetEnhMetaFileBits
StartPage
GetTextExtentPointA
CreateCompatibleBitmap
RemoveFontResourceA
SetMapMode
EnumFontFamiliesExA
GdiTransparentBlt
Pie
StrokeAndFillPath
MaskBlt
GetMetaRgn
GetTextColor
GetBkMode
ChoosePixelFormat
CloseFigure
GetObjectW
SetPaletteEntries
PathToRegion
SetBkColor
GetBitmapBits
GetRgnBox
DeleteDC
TranslateCharsetInfo
GetTextExtentExPointI
SetWinMetaFileBits
SetTextCharacterExtra
DeleteMetaFile
CreateEnhMetaFileW
SetRectRgn
TextOutA
RemoveFontResourceExA
ColorMatchToTarget
CopyMetaFileA
ExtTextOutW
LPtoDP
GetPaletteEntries
GdiFlush
FillPath
SetAbortProc
SetROP2
DeleteEnhMetaFile
GetCharWidthI
StretchDIBits
GetTextMetricsA
PlgBlt
GetCharWidth32A
PolyPolyline
GetRasterizerCaps
ScaleViewportExtEx
GetMapMode
CreateDCW
CreateBitmapIndirect
StartDocA
GetEnhMetaFileHeader
FrameRgn
CreateDIBitmap
GetTextExtentPointW
EndPath
GetStretchBltMode
PolylineTo
RestoreDC
SetDIBits
EnumFontsW
CreateSolidBrush
SaveDC
GetGlyphIndicesW
GetSystemPaletteUse
GetColorSpace
CreateDiscardableBitmap
GetSystemPaletteEntries
ResetDCA
GetCharWidthFloatW
SetBrushOrgEx
GetFontUnicodeRanges
GetRegionData
SetBoundsRect
UnrealizeObject
PlayEnhMetaFileRecord
GetObjectType
GdiGradientFill
GetObjectA
ScaleWindowExtEx
GdiComment
GetArcDirection
EnumFontFamiliesW
GetLayout
EnumFontFamiliesA
SetDCPenColor
CreateRectRgn
PolyTextOutA
GetCharWidth32W
CreateFontIndirectExW
Arc
CreateColorSpaceW
CreateMetaFileW
EnumICMProfilesW
CreateEllipticRgnIndirect
DPtoLP
GetMetaFileBitsEx
GetWorldTransform
DrawEscape
GetOutlineTextMetricsW
GetTextFaceW
SetPixelFormat
CreatePolyPolygonRgn
CreateBrushIndirect
OffsetViewportOrgEx
AddFontResourceA
CreateRectRgnIndirect
SetTextAlign
GetPixelFormat
GdiGetBatchLimit
GdiAlphaBlend
SetICMProfileW
ResetDCW
CreateICW
SetWorldTransform
ExcludeClipRect
DescribePixelFormat
CancelDC
GetWinMetaFileBits
GetFontData
EnumMetaFile
ExtTextOutA
RoundRect
SetICMProfileA
GetCharABCWidthsA
ws2_32
recv
closesocket
__WSAFDIsSet
select
connect
ioctlsocket
htons
socket
gethostbyname
WSAStartup
send
netapi32
Netbios
comdlg32
ReplaceTextA
PrintDlgW
GetOpenFileNameW
ChooseFontA
ChooseFontW
FindTextA
CommDlgExtendedError
comsvcs
SafeRef
RecycleSurrogate
crypt32
CryptMsgUpdate
CertSetCertificateContextProperty
CertFindAttribute
CryptSignAndEncryptMessage
CertSetEnhancedKeyUsage
CertVerifyRevocation
CryptUnregisterDefaultOIDFunction
CertGetNameStringA
CertAddCertificateContextToStore
CryptRegisterDefaultOIDFunction
CertCreateCertificateChainEngine
CryptSignMessage
CryptSetKeyIdentifierProperty
CryptSetOIDFunctionValue
CryptGetAsyncParam
CertEnumCertificatesInStore
CertCreateSelfSignCertificate
CryptHashCertificate
CertGetEnhancedKeyUsage
CertEnumCRLsInStore
CryptMsgClose
CertAddEncodedCertificateToStore
CryptMsgCalculateEncodedLength
CryptDecodeObjectEx
CryptInstallOIDFunctionAddress
CertDuplicateStore
CertFreeCertificateChainEngine
CertDuplicateCRLContext
CertEnumCTLContextProperties
CertSetCertificateContextPropertiesFromCTLEntry
CertSaveStore
CryptFormatObject
PFXVerifyPassword
CertOpenStore
CertCompareIntegerBlob
CertGetIssuerCertificateFromStore
CryptMsgVerifyCountersignatureEncodedEx
CryptMsgVerifyCountersignatureEncoded
PFXExportCertStoreEx
CryptQueryObject
CryptMsgOpenToDecode
CertDeleteCRLFromStore
PFXImportCertStore
CryptUnregisterOIDInfo
CertIsValidCRLForCertificate
PFXIsPFXBlob
CertControlStore
CertFindCertificateInCRL
CryptAcquireCertificatePrivateKey
CertUnregisterPhysicalStore
CryptEnumOIDFunction
CertEnumCTLsInStore
CertVerifyCertificateChainPolicy
CryptMsgControl
CertGetStoreProperty
CertRegisterPhysicalStore
CertDuplicateCTLContext
CryptMsgEncodeAndSignCTL
CryptVerifyMessageHash
CertAddCTLContextToStore
CryptExportPublicKeyInfoEx
CryptFindOIDInfo
CryptCreateAsyncHandle
CertSerializeCertificateStoreElement
CertGetIntendedKeyUsage
CryptRegisterOIDInfo
CertDeleteCertificateFromStore
CertEnumSystemStoreLocation
CryptStringToBinaryW
CertVerifySubjectCertificateContext
CryptVerifyDetachedMessageHash
CertVerifyValidityNesting
CryptInstallDefaultContext
CryptFreeOIDFunctionAddress
CryptMemAlloc
CertVerifyCRLRevocation
CryptVerifyMessageSignatureWithKey
CertFindChainInStore
CertFindCTLInStore
CryptSignCertificate
CryptGetOIDFunctionAddress
CryptVerifyCertificateSignatureEx
CertVerifyCRLTimeValidity
CryptHashMessage
CertFindCertificateInStore
CryptImportPublicKeyInfoEx
CertGetValidUsages
CertAddCRLLinkToStore
CertAlgIdToOID
CryptGetMessageSignerCount
CryptStringToBinaryA
CertStrToNameA
CertGetSubjectCertificateFromStore
CryptMsgCountersign
CryptCreateKeyIdentifierFromCSP
CertGetCertificateChain
CryptEncodeObject
CertComparePublicKeyInfo
CertFindSubjectInCTL
CryptVerifyDetachedMessageSignature
CertDeleteCTLFromStore
CertAddCRLContextToStore
CertFreeCertificateContext
CertGetCRLContextProperty
CryptGetDefaultOIDDllList
CertRDNValueToStrA
CertCreateCertificateContext
CryptExportPublicKeyInfo
CryptMsgCountersignEncoded
CertCompareCertificate
CertAddEncodedCertificateToSystemStoreW
CryptUnprotectData
CertCreateCTLEntryFromCertificateContextProperties
CertCreateCRLContext
CryptFindLocalizedName
CryptMemRealloc
CertVerifyCTLUsage
imm32
ImmGetDefaultIMEWnd
ImmIsUIMessageW
ImmGetCandidateListCountW
ImmGetConversionListW
ImmGetIMEFileNameW
ImmGetDescriptionW
ImmGetCandidateListW
ImmConfigureIMEA
ImmSetCompositionStringW
ImmGetGuideLineW
ImmRegisterWordW
iphlpapi
GetAdapterOrderMap
GetUdpStatistics
SetTcpEntry
SetIpTTL
CreateIpForwardEntry
UnenableRouter
GetIpNetTable
GetBestInterface
NhpAllocateAndGetInterfaceInfoFromStack
GetNetworkParams
SetIpStatistics
GetUdpStatisticsEx
GetExtendedTcpTable
SetIpNetEntry
GetIcmpStatistics
GetFriendlyIfIndex
CreateProxyArpEntry
GetIpErrorString
GetUdpTable
RestoreMediaSense
DeleteIpForwardEntry
GetBestRoute
GetOwnerModuleFromTcpEntry
IpRenewAddress
GetIpForwardTable
DisableMediaSense
GetTcpStatistics
GetExtendedUdpTable
GetIcmpStatisticsEx
GetRTTAndHopCount
GetTcpTable
NotifyRouteChange
DeleteProxyArpEntry
CancelIPChangeNotify
msi
ord190
ord266
ord101
ord244
ord267
ord108
ord5
ord272
ord228
ord176
ord203
ord141
ord36
ord126
ord68
ord88
ord172
ord180
ord175
ord55
ord189
ord90
ord213
ord86
ord60
ord110
ord42
ord173
ord39
ord193
ord168
ord72
ord41
ord209
ord223
ord248
ord204
ord245
ord231
ord264
ord241
ord232
ord251
ord129
ord208
ord224
ord246
ord69
ord45
ord227
ord250
ord261
ord154
ord247
ord70
ord155
ord254
ord174
ord67
ord65
ord259
ord104
ord230
ord95
ord277
ord240
ord217
ord178
ord211
ord195
ord205
ord265
ord71
ord43
ord8
ord268
ord137
msimg32
TransparentBlt
msvfw32
ICInfo
ICDrawBegin
ICClose
ICImageCompress
MCIWndRegisterClass
ICSeqCompressFrameEnd
MCIWndCreateA
ICLocate
ICSendMessage
DrawDibTime
ICSeqCompressFrameStart
ord2
DrawDibRealize
DrawDibChangePalette
DrawDibOpen
DrawDibSetPalette
DrawDibGetBuffer
mswsock
AcceptEx
WSARecvEx
Sections
.text Size: 173KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ