Static task
static1
Behavioral task
behavioral1
Sample
ee75049054bafd86a03f88dbd41c98791ba07648015504ea123b2607ab3307ef.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee75049054bafd86a03f88dbd41c98791ba07648015504ea123b2607ab3307ef.exe
Resource
win10v2004-20220812-en
General
-
Target
ee75049054bafd86a03f88dbd41c98791ba07648015504ea123b2607ab3307ef
-
Size
128KB
-
MD5
744745ea94f99aa5dc1177f7bd83c175
-
SHA1
429d4750fe433758e9002f439f621855ae5d2692
-
SHA256
ee75049054bafd86a03f88dbd41c98791ba07648015504ea123b2607ab3307ef
-
SHA512
37a7378d84daa5c28e6d7fa84997a85e48a94189f4e42aafb7d8157947b1d3f396734ffe521f76a142b09c14d4b1bab2f213c6b70543e232272541bcdf26e4e6
-
SSDEEP
1536:2T1RveYTzYJT8x9GM5osdJrwBhQ39JdooYlCwcQwQ9zfZQvlOofzIQIRg/uEztzo:Kwwx9G+wTop0UjoLm98QIQuEzYL
Malware Config
Signatures
Files
-
ee75049054bafd86a03f88dbd41c98791ba07648015504ea123b2607ab3307ef.exe windows x86
8f4af1d809a954616ae90e696151a2f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
_ui64toa
RtlpUnWaitCriticalSection
ZwWriteVirtualMemory
RtlIdentifierAuthoritySid
NtCallbackReturn
ZwSetDefaultHardErrorPort
NtCreatePagingFile
RtlPcToFileHeader
RtlFreeHeap
_CIcos
NtGetPlugPlayEvent
NtQuerySecurityObject
LdrProcessRelocationBlock
RtlConvertLongToLargeInteger
_snwprintf
ZwShutdownSystem
ZwSetSystemTime
NtPrivilegeObjectAuditAlarm
ZwSetEventBoostPriority
LdrSetDllManifestProber
NtSetDefaultHardErrorPort
NtQueryInformationPort
RtlConvertUlongToLargeInteger
RtlFirstFreeAce
RtlResetRtlTranslations
msvcrt40
??_Gistream@@UAEPAXI@Z
_chmod
__p__osver
_wrename
??1ifstream@@UAE@XZ
?fill@ios@@QBEDXZ
?osfx@ostream@@QAEXXZ
?xsputn@streambuf@@UAEHPBDH@Z
ungetc
_ismbbalpha
swscanf
??4exception@@QAEAAV0@ABV0@@Z
_spawnv
ldiv
??_7bad_cast@@6B@
??5istream@@QAEAAV0@AAH@Z
_wexecl
isleadbyte
gmtime
?x_statebuf@ios@@0PAJA
??_Gostream@@UAEPAXI@Z
clock
?unlock@streambuf@@QAEXXZ
?terminate@@YAXXZ
fwprintf
??_Eistream_withassign@@UAEPAXI@Z
iswdigit
?rdbuf@strstream@@QBEPAVstrstreambuf@@XZ
sqrt
wcscoll
strtok
_putws
wcscspn
_chdir
??5istream@@QAEAAV0@AAF@Z
_ismbcprint
_adj_fdiv_m32
wcsspn
?dbp@streambuf@@QAEXXZ
_ismbclower
??0strstreambuf@@QAE@H@Z
__isascii
_adj_fdivr_m64
_wspawnv
msvcirt
??5istream@@QAEAAV0@AAD@Z
?rdbuf@ostrstream@@QBEPAVstrstreambuf@@XZ
?lock@ios@@QAAXXZ
??_8ostrstream@@7B@
??_Diostream@@QAEXXZ
??_Dofstream@@QAEXXZ
?cout@@3Vostream_withassign@@A
??0ios@@IAE@XZ
??6ostream@@QAEAAV0@D@Z
??1fstream@@UAE@XZ
??_8stdiostream@@7Bistream@@@
??4istream_withassign@@QAEAAVistream@@PAVstreambuf@@@Z
?tellg@istream@@QAEJXZ
??4ifstream@@QAEAAV0@ABV0@@Z
?blen@streambuf@@IBEHXZ
??5istream@@QAEAAV0@AAN@Z
?pbump@streambuf@@IAEXH@Z
??5istream@@QAEAAV0@AAM@Z
??4logic_error@@QAEAAV0@ABV0@@Z
?attach@ifstream@@QAEXH@Z
??0ifstream@@QAE@H@Z
??6ostream@@QAEAAV0@PBD@Z
?fd@filebuf@@QBEHXZ
??6ostream@@QAEAAV0@H@Z
?doallocate@streambuf@@MAEHXZ
?pptr@streambuf@@IBEPADXZ
?gcount@istream@@QBEHXZ
??0stdiobuf@@QAE@ABV0@@Z
??6ostream@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
?sunk_with_stdio@ios@@0HA
??_Glogic_error@@UAEPAXI@Z
??0exception@@QAE@ABQBD@Z
?rdbuf@fstream@@QBEPAVfilebuf@@XZ
??0ostrstream@@QAE@PADHH@Z
??_8istrstream@@7B@
??4ostream_withassign@@QAEAAVostream@@PAVstreambuf@@@Z
?attach@ofstream@@QAEXH@Z
??_Gifstream@@UAEPAXI@Z
?read@istream@@QAEAAV1@PADH@Z
??_Gstdiobuf@@UAEPAXI@Z
?xsgetn@streambuf@@UAEHPADH@Z
??0strstreambuf@@QAE@ABV0@@Z
??0strstreambuf@@QAE@H@Z
?osfx@ostream@@QAEXXZ
??0ifstream@@QAE@PBDHH@Z
?clear@ios@@QAEXH@Z
?pbase@streambuf@@IBEPADXZ
??1streambuf@@UAE@XZ
??6ostream@@QAEAAV0@O@Z
?fill@ios@@QBEDXZ
?cin@@3Vistream_withassign@@A
?seekoff@strstreambuf@@UAEJJW4seek_dir@ios@@H@Z
??5istream@@QAEAAV0@P6AAAVios@@AAV1@@Z@Z
?x_curindex@ios@@0HA
??5istream@@QAEAAV0@AAK@Z
?xsputn@streambuf@@UAEHPBDH@Z
?str@strstream@@QAEPADXZ
?base@streambuf@@IBEPADXZ
??1Iostream_init@@QAE@XZ
??0fstream@@QAE@XZ
?put@ostream@@QAEAAV1@C@Z
??_Dostream_withassign@@QAEXXZ
?sync@streambuf@@UAEHXZ
??_Gstrstream@@UAEPAXI@Z
??_7istrstream@@6B@
??_7iostream@@6B@
?setbuf@streambuf@@UAEPAV1@PADH@Z
??_Gistream@@UAEPAXI@Z
?stdiofile@stdiobuf@@QAEPAU_iobuf@@XZ
?flush@@YAAAVostream@@AAV1@@Z
??0ostrstream@@QAE@XZ
?width@ios@@QAEHH@Z
??6ostream@@QAEAAV0@PBC@Z
??4istream_withassign@@QAEAAVistream@@ABV1@@Z
??_Estreambuf@@UAEPAXI@Z
?tie@ios@@QAEPAVostream@@PAV2@@Z
??0streambuf@@IAE@XZ
?allocate@streambuf@@IAEHXZ
gdi32
GetRgnBox
EngQueryLocalTime
EngDeletePath
SetBkMode
AbortPath
DdEntry23
GetTextExtentPoint32A
CreateDCA
ArcTo
GetKerningPairsA
DeleteEnhMetaFile
PathToRegion
GetKerningPairsW
GetClipRgn
DdEntry44
GetMiterLimit
SelectFontLocal
SetStretchBltMode
GdiEntry7
SetWorldTransform
GetTextFaceW
SetROP2
GetEnhMetaFilePaletteEntries
FrameRgn
GetRasterizerCaps
GetEnhMetaFileW
DdEntry30
CreateDCW
DdEntry18
PlayEnhMetaFile
GdiQueryFonts
GdiEntry13
DdEntry7
expsrv
rtcSendKeys
rtcMIRR
rtcBstrFromError
rtcPackDate
__vbaVarTextTstLt
rtcRightVar
__vbaVarTextTstGe
__vbaLdZeroAry
PutMem2
__vbaRecUniToAnsi
__vbaVarSetVar
__vbaFpI4
_CIcos
Zombie_Release
_adj_fdivr_m16i
rtcMidCharVar
__vbaVarCmpLe
EVENT_SINK2_AddRef
_CItan
rtcCurrentDir
__vbaR4Var
__vbaStrVarMove
_adj_fdiv_m32i
__vbaVarAdd
rtcIRR
PutMemObj
EbIsProjectOnStack
rtcUpperCaseVar
rtcCommandVar
rtBoolFromErrVar
rtcSqr
__vbaLateIdNamedCall
rtcReplace
__vbaLateMemNamedCallLd
__vbaAryVar
TipGetAddressOfPredeclaredInstance
__vbaVarTextTstGt
rtcLeftVar
rtcAppActivate
rtDecFromVar
__vbaUbound
__vbaVarLikeVar
EVENT_SINK_Invoke
__vbaNameFile
kernel32
HeapValidate
EnumDateFormatsW
SetCommConfig
GetConsoleKeyboardLayoutNameW
BaseUpdateAppcompatCache
PrivCopyFileExW
GetCPInfo
GlobalUnlock
AllocateUserPhysicalPages
SetConsoleCP
WaitNamedPipeW
GetDefaultCommConfigW
GetConsoleFontInfo
LeaveCriticalSection
DeleteCriticalSection
FindClose
GetEnvironmentVariableA
GlobalHandle
CreateHardLinkW
ReadFile
QueueUserAPC
GetPrivateProfileSectionW
IsBadHugeWritePtr
SetTapePosition
SetLastConsoleEventActive
GetCommState
SetLocaleInfoW
EnterCriticalSection
GetProcessPriorityBoost
VirtualAlloc
GetDiskFreeSpaceA
GetSystemDirectoryW
GetTimeFormatW
HeapCompact
EnumTimeFormatsW
ReadConsoleOutputCharacterW
Heap32ListNext
SetSystemPowerState
DisconnectNamedPipe
DelayLoadFailureHook
GetConsoleOutputCP
LoadLibraryA
msvcrt
__iscsymf
_ismbbkprint
_strtime
_safe_fprem1
_fpreset
_mbsrchr
__p__osver
iswprint
_fputchar
?_query_new_mode@@YAHXZ
_setmbcp
_umask
_cwait
_ismbchira
__p__pwctype
fabs
_atoi64
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_mbstok
_wgetenv
_ismbcspace
_environ
__CxxRegisterExceptionObject
_outp
atan2
_fstat
_ismbcsymbol
iscntrl
_wexecle
_pctype
tan
msi
MsiGetUserInfoA
MsiDatabaseOpenViewA
MsiViewModify
MsiSetPropertyW
MsiGetPropertyA
MsiOpenProductA
MsiEnumClientsA
MsiPreviewDialogW
MsiProcessAdvertiseScriptW
MsiDecomposeDescriptorA
MsiGetComponentStateA
MsiSetFeatureAttributesA
MsiDatabaseMergeA
MsiGetFeatureInfoW
MsiSetMode
MsiLoadStringA
MsiDatabaseExportW
MsiGetSummaryInformationA
MsiOpenPackageA
MsiSourceListAddSourceA
MsiQueryFeatureStateW
MsiQueryProductStateA
MsiGetFeatureCostA
MsiRecordReadStream
MsiGetSourcePathW
MsiEnumFeaturesA
MsiDatabaseApplyTransformW
MsiInvalidateFeatureCache
MsiEnumRelatedProductsA
MsiGetShortcutTargetA
MsiDoActionW
MsiProvideQualifiedComponentExW
MsiAdvertiseScriptA
MsiGetProductInfoFromScriptW
MsiGetFeatureStateW
MsiOpenPackageExA
MsiEnumPatchesW
shell32
SHGetMalloc
wshext
RemoveSignedDataMsg
CreateIndirectData
VerifyIndirectData
DllGetClassObject
DllUnregisterServer
IsFileSupportedName
GetSignedDataMsg
PutSignedDataMsg
DllRegisterServer
user32
MessageBoxW
EndDialog
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 86KB - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ