Static task
static1
Behavioral task
behavioral1
Sample
ad289ae012d2fa5714843ea93cdb4a93f1bfa831156aae15e185c3d6827a91f7.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ad289ae012d2fa5714843ea93cdb4a93f1bfa831156aae15e185c3d6827a91f7.dll
Resource
win10v2004-20220901-en
General
-
Target
ad289ae012d2fa5714843ea93cdb4a93f1bfa831156aae15e185c3d6827a91f7
-
Size
320KB
-
MD5
1dd4ef7122a5c3fdb560ffee1d152030
-
SHA1
61dbf8b3e9b9360e69bddd4d6049887803eaff62
-
SHA256
ad289ae012d2fa5714843ea93cdb4a93f1bfa831156aae15e185c3d6827a91f7
-
SHA512
06bdcc9ebb6195abcb0cbc0ab5b06c928ea24bb8b1bad6fd271a00269b99f436ba37aa8038328b1c4a2491a9e48ed80c6c4d7281c3052b8b0ff36a6cc1168842
-
SSDEEP
6144:7hQCMiWz8GsCK23vKPGQmsrN+vaFhpKAAJNWGipWWL:7hQCM3QGsC33yP+srsS/DEWGipWWL
Malware Config
Signatures
Files
-
ad289ae012d2fa5714843ea93cdb4a93f1bfa831156aae15e185c3d6827a91f7.dll windows x86
a8c8d7d4dfa8d5a1a1ef70b1fbdcba8f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathStripPathA
kernel32
GetLocaleInfoW
EnumSystemLocalesA
lstrcmpA
GetLastError
GetFileSize
CloseHandle
ReadFile
CreateFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ExitProcess
Thread32Next
Thread32First
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetProcAddress
GetModuleHandleA
LoadLibraryA
CopyFileA
lstrcatA
GetSystemDirectoryA
Module32Next
FreeLibrary
Module32First
SuspendThread
ResumeThread
OpenThread
GetCurrentProcessId
GetCurrentThreadId
VirtualFree
CreateThread
VirtualProtect
GetCurrentProcess
GetModuleFileNameA
VirtualAlloc
OpenFileMappingA
WideCharToMultiByte
WritePrivateProfileStringA
WriteProcessMemory
DeleteFileA
GetPrivateProfileStringA
Sleep
DisableThreadLibraryCalls
VirtualProtectEx
OpenProcess
ReadProcessMemory
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
SetConsoleCtrlHandler
GetTickCount
QueryPerformanceCounter
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetUserDefaultLCID
SetFilePointer
FlushFileBuffers
SetStdHandle
RaiseException
RtlUnwind
GetTimeFormatA
GetDateFormatA
GetSystemTimeAsFileTime
ExitThread
GetCommandLineA
HeapFree
HeapAlloc
SetUnhandledExceptionFilter
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
HeapReAlloc
TerminateProcess
HeapSize
GetTimeZoneInformation
GetSystemInfo
VirtualQuery
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
WriteFile
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetOEMCP
GetCPInfo
MultiByteToWideChar
InitializeCriticalSection
IsValidLocale
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfA
ClipCursor
mouse_event
GetForegroundWindow
GetAsyncKeyState
IsWindowVisible
ShowWindowAsync
MessageBoxA
EnumThreadWindows
IsWindow
winmm
timeGetTime
psapi
GetModuleInformation
GetModuleFileNameExA
Sections
.text Size: - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.???? Size: - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.??????0 Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.??????1 Size: - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.??????2 Size: 312KB - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ