Static task
static1
Behavioral task
behavioral1
Sample
d63eb4374680389b7287a6da888a6ee5e12685e12dc0fb5788a95bf45fe92bef.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d63eb4374680389b7287a6da888a6ee5e12685e12dc0fb5788a95bf45fe92bef.exe
Resource
win10v2004-20220812-en
General
-
Target
d63eb4374680389b7287a6da888a6ee5e12685e12dc0fb5788a95bf45fe92bef
-
Size
456KB
-
MD5
748f6a472ce6bb3a555d5582f098d3f1
-
SHA1
b5c7d00f5cf9cd2f741993e3f640b06f77b07dbd
-
SHA256
d63eb4374680389b7287a6da888a6ee5e12685e12dc0fb5788a95bf45fe92bef
-
SHA512
916022cdf72683a247f8838fb792bb361bf07c861ab815ac3f5f62197ac64fca6a750d24cc17f2b50bca977e1558b1aacb4564fd247b41603decafdd8ef061d8
-
SSDEEP
6144:XSV5GnQTU0yG2usaKwQlxDoXqxxiOm+6VVnQM2toHWoxIR:XAnTULuklxbxx8FVD2tyZIR
Malware Config
Signatures
Files
-
d63eb4374680389b7287a6da888a6ee5e12685e12dc0fb5788a95bf45fe92bef.exe windows x86
760c3a1470329d7385e317c230ac1fec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90u
ord3231
ord933
ord938
ord4410
ord4541
ord4490
ord6164
ord277
ord2143
ord2469
ord1178
ord525
ord293
ord6169
ord1325
ord4250
ord5778
ord6822
ord6811
ord1243
ord5767
ord3768
ord611
ord595
ord3489
ord3286
ord2274
ord5867
ord3741
ord2901
ord6109
ord2551
ord337
ord613
ord4519
ord542
ord753
ord5661
ord321
ord3268
ord5152
ord5008
ord5168
ord4632
ord4608
ord5277
ord5301
ord5047
ord5231
ord5508
ord5511
ord5509
ord5510
ord374
ord639
ord4000
ord4741
ord5653
ord447
ord699
ord905
ord4477
ord3674
ord2283
ord1719
ord4660
ord3654
ord3907
ord1383
ord2372
ord1533
ord1108
ord2497
ord4451
ord585
ord1723
ord3149
ord1585
ord2705
ord788
ord2100
ord2097
ord1353
ord2758
ord6063
ord6572
ord6060
ord6566
ord4579
ord6569
ord6372
ord6547
ord6183
ord6096
ord6101
ord5974
ord6040
ord5863
ord5850
ord6418
ord6174
ord3513
ord367
ord6574
ord636
ord3537
ord1144
ord2470
ord6094
ord3486
ord3622
ord6095
ord2263
ord5979
ord4405
ord6513
ord5893
ord4351
ord757
ord3630
ord553
ord2130
ord4512
ord2282
ord3577
ord3856
ord4044
ord2676
ord3637
ord5194
ord333
ord6659
ord1043
ord2954
ord3531
ord400
ord4631
ord6311
ord814
ord6760
ord4131
ord1938
ord2057
ord5664
ord4652
ord1665
ord5572
ord617
ord341
ord5573
ord3589
ord2478
ord5632
ord5324
ord1810
ord1809
ord3353
ord6408
ord1492
ord4702
ord1641
ord3515
ord1405
ord2224
ord3355
ord6411
ord1754
ord1751
ord4345
ord1493
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord3743
ord5154
ord4700
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1640
ord6802
ord4174
ord6804
ord3682
ord5404
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord5650
ord3140
ord4910
ord4692
ord4774
ord2243
ord2596
ord1145
ord339
ord5078
ord5167
ord2653
ord6187
ord1044
ord783
ord581
ord5182
ord744
ord524
ord2592
ord2069
ord4518
ord2479
ord1357
ord1599
ord4682
ord1064
ord4543
ord6604
ord1486
ord6579
ord6577
ord6065
ord2904
ord4527
ord4530
ord1709
ord6376
ord1063
ord1088
ord1137
ord1688
ord2593
ord1354
ord285
ord3220
ord1607
ord3543
ord2106
ord3488
ord686
ord436
ord1100
ord265
ord266
ord1603
ord3374
ord5662
ord935
ord2597
ord1675
ord1248
ord2326
ord811
ord1250
ord1254
ord280
ord6687
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord4347
ord4996
ord5680
ord5663
ord6018
ord3115
ord4905
ord4681
ord3670
ord2771
ord2983
ord3112
ord4728
ord2966
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord2447
ord2208
ord2695
ord5939
ord1272
ord605
ord1274
ord1233
ord322
ord802
ord3953
ord797
ord1262
ord6636
ord1149
ord3621
ord5322
ord6098
ord778
ord1098
ord4043
ord4967
ord5567
ord794
ord589
ord799
ord909
ord267
ord2537
ord4324
ord296
ord1183
ord2084
ord813
ord286
ord3185
ord600
ord598
ord6091
ord801
msvcr90
_wcsupr_s
realloc
strchr
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
_wfopen
_snwprintf_s
strncpy_s
wcsnlen
__RTDynamicCast
__CxxFrameHandler3
memcpy
wcscat_s
free
memset
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
exit
_wcsdup
_wsplitpath
_wcsupr
wcsncpy
_waccess
memcpy_s
memmove_s
wcslen
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
_time64
wcscmp
_wtoi
_wcsicmp
wcscpy
_snwprintf
wcsrchr
wcschr
_wgetcwd
_wchdir
wcscpy_s
wcsstr
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
printf
wcsncat_s
wcsncpy_s
_wsplitpath_s
wcsncmp
iswalnum
iswspace
abort
_filelength
_read
_close
_lseek
_wsopen
strtoul
calloc
_errno
wcscat
wcsncat
malloc
vswprintf_s
_wfopen_s
fclose
swscanf_s
srand
rand
swprintf_s
?what@exception@std@@UBEPBDXZ
kernel32
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
DeviceIoControl
WideCharToMultiByte
FormatMessageW
LocalFree
GetVersionExW
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteFileW
WaitForSingleObject
lstrlenW
CreateFileW
GetPrivateProfileStringW
WritePrivateProfileStringW
lstrcmpiW
FreeResource
GetCPInfo
MultiByteToWideChar
lstrlenA
GetVersion
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
VerSetConditionMask
VerifyVersionInfoW
LocalAlloc
CloseHandle
GetModuleFileNameW
OpenEventW
SetEvent
SizeofResource
LockResource
LoadResource
FindResourceW
MulDiv
GetLastError
SetLastError
FreeLibrary
InterlockedIncrement
CreateEventW
WaitForMultipleObjects
ResetEvent
InterlockedDecrement
Sleep
GetTickCount
LoadLibraryW
GetModuleHandleW
GetProcAddress
FindResourceExW
OutputDebugStringW
GetPrivateProfileIntW
SetErrorMode
ExpandEnvironmentStringsA
LoadLibraryA
InterlockedExchange
InterlockedCompareExchange
GetExitCodeProcess
CreateProcessW
SetFileAttributesW
GetFileAttributesW
WriteFile
LoadLibraryExW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetStartupInfoW
user32
EqualRect
DrawStateW
SendMessageW
GetDC
ReleaseDC
GetSystemMetrics
DestroyIcon
GetParent
RegisterWindowMessageW
PostMessageW
BringWindowToTop
SetForegroundWindow
GetMenuItemCount
GetWindowRect
SystemParametersInfoW
FindWindowW
IsWindowVisible
SetTimer
CreatePopupMenu
GetClientRect
IsIconic
DrawIcon
IsMenu
GetMenu
GetSubMenu
GetMenuItemID
EnableWindow
GetDCEx
LoadImageW
SetCursor
GetMenuItemInfoW
SetRect
CopyRect
FillRect
DrawEdge
GetDesktopWindow
TabbedTextOutW
DrawTextW
LoadStringW
PostQuitMessage
DrawTextExW
GrayStringW
DrawIconEx
LoadBitmapW
AppendMenuW
InsertMenuW
ReleaseCapture
SetRectEmpty
SetWindowLongW
UpdateWindow
GetIconInfo
LoadCursorW
PtInRect
GetActiveWindow
GetLastActivePopup
SetCapture
GetForegroundWindow
ModifyMenuW
GetMenuState
CreateMenu
GetSysColorBrush
RemoveMenu
DeleteMenu
GetSysColor
InvalidateRect
LoadIconW
InflateRect
ScreenToClient
IsWindow
GetFocus
TranslateAcceleratorW
MessageBoxW
wsprintfW
gdi32
RoundRect
CreateHatchBrush
PatBlt
SetPixel
GetPixel
CreateDIBSection
DeleteDC
Ellipse
GetTextExtentPoint32W
GetObjectW
CreateHalftonePalette
ExtTextOutW
TextOutW
RectVisible
PtVisible
Rectangle
CreateFontIndirectW
GetBkMode
CreateSolidBrush
CreatePen
GetStockObject
GetDIBColorTable
Escape
CreatePalette
RealizePalette
FillRgn
CreatePolygonRgn
CreateRectRgnIndirect
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
CreatePatternBrush
SelectObject
DeleteObject
GetDeviceCaps
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SetEntriesInAclW
RegCreateKeyExW
RegSetValueExW
AllocateAndInitializeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
GetUserNameW
RegOpenKeyExW
RegQueryValueExW
shell32
DragFinish
DragQueryFileW
SHAppBarMessage
ShellExecuteW
msvcp90
??1_Lockit@std@@QAE@XZ
?_Xbad@tr1@std@@YAXW4error_type@regex_constants@12@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?id@?$collate@_W@std@@2V0locale@2@A
?_Xmem@tr1@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Getcat@?$collate@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?transform@?$collate@_W@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@PB_W0@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??1locale@std@@QAE@XZ
??0locale@std@@QAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
??0_Lockit@std@@QAE@H@Z
cctpc
?addGroup@CTaskPanelSheet@@QAEPAVCTaskPanelCtrlItem@@PB_WPAUHICON__@@1PAVCPropertyPage@@@Z
??0CTaskPanelSheet@@QAE@XZ
??1CTaskPanelSheet@@UAE@XZ
?GetActivePage@CTaskPanelSheet@@QAEPAVCPropertyPage@@XZ
?SetActivePage@CTaskPanelSheet@@QAEHH_N@Z
?GetRuntimeClass@CTaskPanelSheet@@UBEPAUCRuntimeClass@@XZ
?GetMessageMap@CTaskPanelSheet@@MBEPBUAFX_MSGMAP@@XZ
?useDC@CTaskPanelSheet@@QAEXPAUHDC__@@AAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?addItem@CTaskPanelSheet@@QAEPAVCTaskPanelCtrlItem@@PAV2@PB_WPAVCPropertyPage@@PAUHICON__@@3@Z
?OnInitDialog@CTaskPanelSheet@@MAEHXZ
comctl32
ImageList_GetIconSize
_TrackMouseEvent
ole32
CreateStreamOnHGlobal
gdiplus
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipGetImageWidth
GdipGetImageHeight
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipCreateFromHDC
GdipSaveImageToFile
GdipSetPixelOffsetMode
GdipDrawImageRect
GdipCloneBitmapAreaI
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectRect
GdipCreateBitmapFromResource
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDeleteGraphics
Sections
.text Size: 231KB - Virtual size: 230KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rrdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE