Static task
static1
Behavioral task
behavioral1
Sample
b8fd2d56b5c6cffcaac33f43b2ebd006d14b721c1a46b4c9a975992178e8bd35.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b8fd2d56b5c6cffcaac33f43b2ebd006d14b721c1a46b4c9a975992178e8bd35.exe
Resource
win10v2004-20220901-en
General
-
Target
b8fd2d56b5c6cffcaac33f43b2ebd006d14b721c1a46b4c9a975992178e8bd35
-
Size
87KB
-
MD5
a1265fe11a32901a6fba656bf1af2158
-
SHA1
3555ab14eb2580b5ceaf63540883f316dbbae4e2
-
SHA256
b8fd2d56b5c6cffcaac33f43b2ebd006d14b721c1a46b4c9a975992178e8bd35
-
SHA512
09e75fa6007355a47e0b6b2430170503bcc34c073ba74f56e2b0d3a7e6600809fa8350c324a686c389881b29f9254412ccbb2bfe8b3c0e45480d8ad23756934f
-
SSDEEP
1536:BPOomml0JcoahTwc2NpU+9EvgLTdiNmuZeb4AZfjA92XJGhmnfnkwUEkLW:BPNIJJaSNpO0x2Zi1m2abwUdW
Malware Config
Signatures
Files
-
b8fd2d56b5c6cffcaac33f43b2ebd006d14b721c1a46b4c9a975992178e8bd35.exe windows x86
a0575f07ba06d0fdca48c2e132c314f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
SetEntriesInAccessListW
GetAuditedPermissionsFromAclW
ConvertSecurityDescriptorToAccessA
LookupPrivilegeNameW
OpenProcessToken
RegOpenKeyW
GetTokenInformation
CryptEnumProvidersW
SetSecurityDescriptorDacl
RegQueryMultipleValuesW
CreateProcessAsUserW
GetAccessPermissionsForObjectW
CryptSetProviderExA
GetSecurityDescriptorControl
CloseServiceHandle
CreateServiceA
CryptSignHashW
OpenSCManagerW
LookupPrivilegeValueA
RegCreateKeyW
ObjectCloseAuditAlarmW
ObjectOpenAuditAlarmA
GetMultipleTrusteeA
GetNumberOfEventLogRecords
LookupSecurityDescriptorPartsW
ImpersonateLoggedOnUser
NotifyChangeEventLog
BuildImpersonateTrusteeW
BuildExplicitAccessWithNameA
CryptAcquireContextA
ControlService
CryptGetProvParam
RegUnLoadKeyA
LookupPrivilegeDisplayNameA
LogonUserW
StartServiceCtrlDispatcherA
CryptSignHashA
AddAuditAccessAce
CryptDuplicateHash
ObjectCloseAuditAlarmA
CryptEnumProviderTypesW
LookupPrivilegeDisplayNameW
ReportEventA
EnumDependentServicesW
BuildTrusteeWithNameA
AddAccessDeniedAce
GetSecurityDescriptorGroup
StartServiceA
AccessCheckAndAuditAlarmA
CryptSetProviderA
RegReplaceKeyA
GetExplicitEntriesFromAclA
RegEnumKeyW
AbortSystemShutdownA
AreAllAccessesGranted
OpenServiceA
BuildImpersonateExplicitAccessWithNameA
AreAnyAccessesGranted
AddAccessAllowedAce
RegConnectRegistryA
RegCreateKeyA
RegReplaceKeyW
SetSecurityInfoExW
RegQueryValueW
RegCreateKeyExW
BackupEventLogW
AdjustTokenPrivileges
CryptVerifySignatureA
RegFlushKey
AdjustTokenGroups
SetKernelObjectSecurity
OpenThreadToken
CryptGetKeyParam
CryptSetKeyParam
SetSecurityDescriptorSacl
RegSetValueExA
StartServiceW
GetServiceKeyNameA
DuplicateToken
CryptDuplicateKey
RegOpenKeyExA
CloseEventLog
OpenBackupEventLogA
IsTextUnicode
GetSidSubAuthority
CryptSetHashParam
RegSetValueW
ConvertSecurityDescriptorToAccessW
IsValidSid
GetMultipleTrusteeOperationW
ObjectPrivilegeAuditAlarmW
InitializeAcl
OpenSCManagerA
SetSecurityDescriptorGroup
BuildImpersonateTrusteeA
GetMultipleTrusteeOperationA
MakeSelfRelativeSD
RegRestoreKeyW
CreateProcessAsUserA
OpenEventLogW
ImpersonateSelf
GetNamedSecurityInfoExA
FreeSid
RegSetKeySecurity
CryptGetHashParam
GetCurrentHwProfileW
GetOverlappedAccessResults
ClearEventLogA
ObjectOpenAuditAlarmW
OpenBackupEventLogW
RegisterServiceCtrlHandlerA
SetNamedSecurityInfoExA
BuildSecurityDescriptorA
GetNamedSecurityInfoW
GetAuditedPermissionsFromAclA
RegDeleteValueW
EqualPrefixSid
RegConnectRegistryW
AddAce
CopySid
GetAce
shlwapi
StrRetToStrW
StrCSpnA
StrCatBuffA
PathFindNextComponentA
StrCatW
SHSetValueW
SHRegDeleteUSValueA
PathStripPathW
SHRegDeleteUSValueW
UrlGetLocationA
UrlCompareW
UrlIsNoHistoryW
StrRStrIA
SHQueryInfoKeyW
PathCombineA
UrlIsA
PathAddExtensionA
SHRegEnumUSKeyW
PathAppendA
ColorHLSToRGB
PathParseIconLocationA
PathQuoteSpacesA
SHCopyKeyW
SHGetValueW
wvnsprintfA
PathIsNetworkPathW
StrDupA
PathGetCharTypeW
PathFindExtensionA
SHDeleteEmptyKeyA
IntlStrEqWorkerW
StrRChrW
PathSearchAndQualifyA
StrChrW
StrCmpIW
IntlStrEqWorkerA
PathRemoveExtensionW
StrRetToStrA
PathFindNextComponentW
StrRetToBufA
UrlUnescapeA
UrlGetLocationW
SHCopyKeyA
PathIsUNCServerA
StrRChrIA
SHRegGetBoolUSValueA
PathMatchSpecA
PathRelativePathToA
SHSetValueA
StrStrA
SHRegEnumUSKeyA
PathAddExtensionW
StrTrimA
SHRegDuplicateHKey
PathIsContentTypeW
PathFileExistsA
SHStrDupW
PathRemoveFileSpecA
StrCmpNW
SHRegQueryInfoUSKeyW
StrToIntA
StrFormatKBSizeW
UrlEscapeW
UrlCreateFromPathA
SHQueryValueExA
PathAddBackslashW
SHRegGetBoolUSValueW
PathUnmakeSystemFolderA
StrPBrkW
PathFindFileNameA
UrlIsOpaqueW
UrlIsW
SHRegQueryUSValueW
SHGetInverseCMAP
PathRemoveArgsW
StrChrA
StrStrW
PathIsSameRootA
UrlHashW
PathIsUNCServerShareW
PathFindExtensionW
SHSkipJunction
SHQueryInfoKeyA
SHRegDeleteEmptyUSKeyW
SHOpenRegStreamA
SHDeleteKeyA
PathRenameExtensionW
PathRemoveExtensionA
PathRemoveArgsA
PathUndecorateA
PathSearchAndQualifyW
SHAutoComplete
UrlEscapeA
SHCreateStreamOnFileA
SHRegOpenUSKeyW
PathCompactPathExA
PathBuildRootW
PathCompactPathA
PathCanonicalizeW
PathMatchSpecW
StrCSpnIA
PathCommonPrefixW
ChrCmpIW
SHRegSetUSValueW
PathGetArgsA
StrCSpnIW
PathFindFileNameW
SHStrDupA
AssocQueryStringA
user32
EnumPropsExA
RegisterDeviceNotificationW
SetClassWord
MapDialogRect
GetClipboardOwner
IsWindow
ChangeMenuW
SendNotifyMessageA
SetCursor
IsCharAlphaNumericA
SetWindowsHookExA
CreateDialogParamW
SetMessageQueue
SetWindowsHookA
DdeSetUserHandle
DdeUninitialize
ShowCursor
SetDlgItemInt
TranslateMessage
GetKeyNameTextA
ModifyMenuA
CreateWindowExA
GetUpdateRect
SetDebugErrorLevel
SetMenuContextHelpId
ReplyMessage
SetParent
CallWindowProcA
GetQueueStatus
AttachThreadInput
SetClipboardViewer
EnumChildWindows
DefFrameProcA
CountClipboardFormats
SetKeyboardState
RemovePropA
SetMenuItemInfoW
DdeKeepStringHandle
FlashWindow
CascadeChildWindows
ArrangeIconicWindows
ToUnicodeEx
ClipCursor
SetProcessWindowStation
PostMessageA
InsertMenuItemA
LoadMenuW
DdeAccessData
UnloadKeyboardLayout
GetNextDlgTabItem
SetCaretPos
GetMenuItemID
MessageBoxIndirectW
InvalidateRgn
ChangeDisplaySettingsA
GetShellWindow
GetCursorPos
GetInputState
ScrollDC
MsgWaitForMultipleObjects
SendMessageW
GetNextDlgGroupItem
CascadeWindows
ExcludeUpdateRgn
DefDlgProcW
DlgDirListA
MonitorFromPoint
DispatchMessageW
DdeFreeStringHandle
GetInputDesktop
FlashWindowEx
GetLastActivePopup
CreateWindowStationW
WindowFromDC
DialogBoxParamW
ToAscii
SetWindowWord
RemoveMenu
IsDialogMessage
GetMenuInfo
ChildWindowFromPointEx
SetScrollRange
GetFocus
CallWindowProcW
WINNLSEnableIME
SetMessageExtraInfo
GetCursor
BroadcastSystemMessageA
GetWindowThreadProcessId
DrawTextA
GetSubMenu
RegisterClipboardFormatW
IsZoomed
DrawTextW
GetClassNameA
InsertMenuA
LoadMenuIndirectW
IntersectRect
BringWindowToTop
CreateDialogIndirectParamW
GetMenuItemCount
CharPrevA
EnumWindows
DeferWindowPos
ValidateRgn
GetSysColorBrush
OpenIcon
ExitWindowsEx
SwitchDesktop
CreateDialogParamA
MoveWindow
CharLowerW
DdeAbandonTransaction
ShowCaret
GetDC
InvalidateRect
TrackPopupMenu
GrayStringW
AnimateWindow
OemToCharBuffA
CallMsgFilterW
DrawStateA
GetWindowTextLengthW
IsCharAlphaW
LoadKeyboardLayoutW
PeekMessageA
CreatePopupMenu
CreateWindowStationA
EnumPropsW
DdeConnectList
RegisterWindowMessageW
GetKeyboardLayout
OpenInputDesktop
DdeEnableCallback
BeginPaint
UnregisterClassW
LoadBitmapW
GetDoubleClickTime
CheckMenuRadioItem
ole32
StgCreateDocfileOnILockBytes
IIDFromString
CoGetCallerTID
OleBuildVersion
OleLockRunning
OleNoteObjectVisible
DoDragDrop
GetRunningObjectTable
OleInitialize
CoQueryAuthenticationServices
OleCreateFromDataEx
CoMarshalHresult
CoGetCurrentProcess
FreePropVariantArray
OleIsCurrentClipboard
UpdateDCOMSettings
CoLoadLibrary
CoGetTreatAsClass
CoRegisterMessageFilter
CreateFileMoniker
CoDisconnectObject
CoFileTimeNow
CoGetMarshalSizeMax
WriteStringStream
DllDebugObjectRPCHook
OleCreateMenuDescriptor
CoRegisterChannelHook
CreateClassMoniker
OleConvertIStorageToOLESTREAMEx
OleFlushClipboard
CreateDataCache
CoRevokeClassObject
CreateDataAdviseHolder
OleConvertIStorageToOLESTREAM
CoGetCallContext
RevokeDragDrop
CoCreateGuid
CoCreateFreeThreadedMarshaler
ReadClassStm
CoFileTimeToDosDateTime
GetHGlobalFromStream
WriteFmtUserTypeStg
StgOpenStorageOnILockBytes
OleCreate
CoResumeClassObjects
CoTaskMemAlloc
CoGetCurrentLogicalThreadId
OleSaveToStream
CoUninitialize
CoTreatAsClass
CoCreateInstance
MonikerRelativePathTo
CoQueryClientBlanket
OleCreateDefaultHandler
CoReleaseServerProcess
StringFromCLSID
CreateItemMoniker
CreateAntiMoniker
CoQueryProxyBlanket
UtConvertDvtd32toDvtd16
PropVariantCopy
OleLoad
CreateStreamOnHGlobal
CoIsOle1Class
CoFreeUnusedLibraries
CoSuspendClassObjects
ReadStringStream
CoGetPSClsid
OleQueryLinkFromData
OleQueryCreateFromData
OleGetAutoConvert
CoRegisterMallocSpy
CoRegisterClassObject
WriteOleStg
MonikerCommonPrefixWith
CoSwitchCallContext
CoQueryReleaseObject
OleGetClipboard
OleGetIconOfClass
CreateILockBytesOnHGlobal
CoUnmarshalHresult
WriteClassStm
OleConvertOLESTREAMToIStorage
CreateObjrefMoniker
CoLockObjectExternal
SetConvertStg
OleCreateFromFileEx
OleCreateLinkFromData
OleSetClipboard
CoBuildVersion
OleSetAutoConvert
StgGetIFillLockBytesOnILockBytes
OleDoAutoConvert
OleCreateLinkToFileEx
StgSetTimes
StgIsStorageILockBytes
CoImpersonateClient
OleCreateFromData
OleGetIconOfFile
CoRevertToSelf
StgGetIFillLockBytesOnFile
ReleaseStgMedium
StgCreateStorageEx
GetDocumentBitStg
CoFreeAllLibraries
kernel32
ScrollConsoleScreenBufferW
EnumResourceTypesW
ConvertDefaultLocale
SetThreadLocale
GlobalReAlloc
SetComputerNameW
ReadProcessMemory
VirtualQuery
GetPrivateProfileIntW
CreatePipe
RaiseException
GetBinaryTypeW
SetCommMask
FlushInstructionCache
SetConsoleWindowInfo
EnumTimeFormatsW
GetStringTypeExA
SetErrorMode
HeapCompact
WaitNamedPipeW
SetConsoleCP
IsBadStringPtrA
LocalFlags
SetLocaleInfoA
SetThreadExecutionState
GetProcessWorkingSetSize
GetEnvironmentStringsA
ClearCommBreak
MoveFileExA
VirtualLock
WriteConsoleInputA
FatalAppExitA
FindFirstFileExA
QueryPerformanceFrequency
GetShortPathNameA
CreateRemoteThread
GetCurrencyFormatW
SetDefaultCommConfigW
WriteConsoleOutputA
LockFile
IsValidLocale
CreateIoCompletionPort
EnumCalendarInfoW
ReleaseSemaphore
EnumDateFormatsExA
GetCommConfig
CreateMailslotW
DebugBreak
GetCommTimeouts
UpdateResourceA
RequestWakeupLatency
SetNamedPipeHandleState
CreateFiber
GetProcessPriorityBoost
RemoveDirectoryW
FindFirstFileExW
GetPrivateProfileSectionW
GetWindowsDirectoryA
SetWaitableTimer
GetConsoleCP
GetWindowsDirectoryW
GetHandleInformation
EraseTape
GetThreadSelectorEntry
CreateDirectoryExA
WriteFileGather
GetLargestConsoleWindowSize
OpenMutexA
FindResourceExW
lstrcpyA
GetEnvironmentVariableA
SetHandleCount
QueueUserAPC
SleepEx
FindFirstFileW
CreateNamedPipeA
RemoveDirectoryA
GetFileAttributesA
FormatMessageA
VirtualProtectEx
SizeofResource
IsValidCodePage
lstrlen
IsDBCSLeadByteEx
MoveFileW
lstrcat
VirtualAlloc
GetProfileStringW
Heap32First
GetWriteWatch
lstrcpynA
lstrcmpiA
MapViewOfFile
ReadDirectoryChangesW
WriteConsoleInputW
IsBadWritePtr
GetCommState
LocalFileTimeToFileTime
HeapLock
ReadConsoleInputW
GetCurrentProcessId
GetCPInfoExW
FillConsoleOutputAttribute
GetProfileIntW
WriteProfileStringA
lstrcpyn
GetCurrentProcess
GetProcessAffinityMask
WritePrivateProfileStringA
SetEvent
RtlFillMemory
WritePrivateProfileSectionW
GlobalCompact
SetFileApisToOEM
RequestDeviceWakeup
GetEnvironmentStringsW
GetThreadPriorityBoost
CreateSemaphoreW
BackupWrite
Toolhelp32ReadProcessMemory
FreeEnvironmentStringsW
ReadConsoleInputA
GetLocaleInfoA
SetConsoleScreenBufferSize
CreateSemaphoreA
FormatMessageW
VirtualProtect
Sections
.text Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 328B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE