Static task
static1
Behavioral task
behavioral1
Sample
38d64b170fca5f560f6d2270c910f94981ad3532469563550a5bfe6a6d174e6e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
38d64b170fca5f560f6d2270c910f94981ad3532469563550a5bfe6a6d174e6e.exe
Resource
win10v2004-20220901-en
General
-
Target
38d64b170fca5f560f6d2270c910f94981ad3532469563550a5bfe6a6d174e6e
-
Size
273KB
-
MD5
b46afc83a2b537631f7acd899a6f9533
-
SHA1
f93505723b979c5576edea237566c69b9f113c33
-
SHA256
38d64b170fca5f560f6d2270c910f94981ad3532469563550a5bfe6a6d174e6e
-
SHA512
fbc0396f7822a50854de431e23ceb9aea654c17880aaeb906bcaed3138bea979267a4d5f0dfe6a241030684603bb342d207b881094782da918d00639ca90ee40
-
SSDEEP
6144:QeK9TBjiU7W6p4sbXf50yHDtE/e60gZHBmBrj6k0CXK7+ux+Kp8I7Xpm:QeK9TViUzOwfCyHDtEGjg90ld8+ux+VX
Malware Config
Signatures
Files
-
38d64b170fca5f560f6d2270c910f94981ad3532469563550a5bfe6a6d174e6e.exe windows x86
c1770df87b344115ff4ae1a52c2b2b14
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtTerminateProcess
LdrGetDllHandle
NtQueryInformationProcess
RtlUnwind
LdrLoadDll
kernel32
GetCurrentProcess
InterlockedCompareExchange
GetCurrentThread
FlushInstructionCache
VirtualAlloc
VirtualProtect
GetCurrentThreadId
ResumeThread
VirtualFree
LoadLibraryA
TlsAlloc
TlsFree
ExpandEnvironmentStringsW
GetSystemTime
CreateMutexW
OpenMutexW
ReleaseMutex
FreeLibrary
lstrcmpiW
SetThreadPriority
GetThreadPriority
GetEnvironmentVariableW
CreateProcessW
OpenProcess
Thread32First
Thread32Next
CreateToolhelp32Snapshot
TerminateThread
DuplicateHandle
lstrlenA
HeapReAlloc
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
MoveFileExW
UnregisterWait
RegisterWaitForSingleObject
VirtualQuery
ExitProcess
GetSystemTimeAsFileTime
LoadLibraryW
WTSGetActiveConsoleSessionId
VirtualFreeEx
GetProcessId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
LocalFree
lstrcatW
FindFirstFileW
FindClose
FindNextFileW
DosDateTimeToFileTime
VirtualAllocEx
WriteProcessMemory
RemoveDirectoryW
SetErrorMode
OpenEventW
lstrcpyA
lstrcmpA
GetVersionExW
GetComputerNameW
GetVolumeNameForVolumeMountPointW
QueryPerformanceCounter
SystemTimeToFileTime
GetTimeZoneInformation
GetLocalTime
GetExitCodeThread
WideCharToMultiByte
MultiByteToWideChar
GetHandleInformation
lstrcmpiA
CreateRemoteThread
Process32FirstW
Process32NextW
FileTimeToDosDateTime
GetTempFileNameW
lstrcpynA
FileTimeToLocalFileTime
GetThreadContext
SetThreadContext
TlsSetValue
TlsGetValue
ResetEvent
InterlockedDecrement
InterlockedIncrement
lstrlenW
SetFileAttributesW
GetFileInformationByHandle
DeleteFileW
GetFileTime
GetFileSizeEx
GetTempPathW
FlushFileBuffers
CreateFileW
ReadFile
GetFileAttributesW
IsBadReadPtr
WriteFile
SetFileTime
CreateDirectoryW
SetFilePointerEx
SetEndOfFile
CreateThread
GetCurrentProcessId
GlobalUnlock
GlobalLock
GetLastError
CloseHandle
DeleteCriticalSection
WaitForMultipleObjects
CreateEventW
EnterCriticalSection
LeaveCriticalSection
Sleep
InitializeCriticalSection
SetEvent
TryEnterCriticalSection
GetProcAddress
GetPrivateProfileIntW
GetPrivateProfileStringW
GetModuleHandleW
GetVolumeInformationW
lstrcpyW
GetDiskFreeSpaceExW
GetUserDefaultUILanguage
GlobalMemoryStatusEx
lstrcmpW
GetModuleFileNameW
GetProcessTimes
GetLogicalDrives
GetSystemDefaultUILanguage
GetDriveTypeW
GetNativeSystemInfo
GetCommandLineW
SetLastError
WaitForSingleObject
GetTickCount
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetFilePointer
OutputDebugStringA
user32
PostQuitMessage
GetClipboardData
CharToOemW
LoadCursorW
DrawIcon
GetIconInfo
ExitWindowsEx
CharLowerA
GetLastInputInfo
GetSystemMetrics
MsgWaitForMultipleObjects
GetCursorPos
TranslateMessage
CharUpperW
ToUnicode
GetKeyboardState
CharLowerW
DispatchMessageW
PeekMessageW
advapi32
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertSidToStringSidW
GetLengthSid
IsWellKnownSid
InitiateSystemShutdownExW
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegFlushKey
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
EqualSid
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateProcessAsUserW
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
GetSidSubAuthority
OpenProcessToken
CryptDestroyKey
CryptImportKey
CryptGetKeyParam
CryptVerifySignatureW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
shlwapi
StrCmpNIA
StrCmpNW
wvnsprintfW
wvnsprintfA
ord14
StrRChrA
UrlUnescapeA
PathQuoteSpacesW
StrCmpW
StrCmpNA
StrChrA
PathSkipRootW
PathMatchSpecW
StrCmpIW
PathIsURLW
StrCmpNIW
PathFindExtensionW
PathRemoveFileSpecW
PathIsDirectoryW
PathUnquoteSpacesW
PathRenameExtensionW
PathRemoveBackslashW
PathAddBackslashW
StrStrIW
PathRemoveExtensionW
PathFindFileNameW
StrChrW
PathGetDriveNumberW
shell32
ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
secur32
DecryptMessage
DeleteSecurityContext
GetUserNameExW
EncryptMessage
ole32
CLSIDFromString
CoCreateInstance
CoTaskMemFree
CoSetProxyBlanket
CreateStreamOnHGlobal
CoUninitialize
CoInitializeSecurity
CoInitializeEx
StringFromGUID2
gdi32
BitBlt
DeleteDC
GetDeviceCaps
CreateDCW
DeleteObject
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
ws2_32
FreeAddrInfoW
getaddrinfo
accept
WSASend
recv
listen
bind
WSACleanup
WSACloseEvent
WSAIoctl
shutdown
WSAAddressToStringW
WSAEnumNetworkEvents
WSAEventSelect
setsockopt
WSACreateEvent
getsockopt
WSAAddressToStringA
WSAStringToAddressW
getpeername
recvfrom
getsockname
sendto
getservbyname
connect
WSAStartup
select
WSARecv
WSAGetOverlappedResult
freeaddrinfo
closesocket
GetAddrInfoW
gethostbyname
send
WSASetLastError
WSAGetLastError
socket
crypt32
CertDeleteCertificateFromStore
CryptUnprotectData
PFXImportCertStore
PFXExportCertStoreEx
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreW
wininet
InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpAddRequestHeadersA
HttpEndRequestA
HttpOpenRequestA
InternetWriteFile
InternetSetOptionA
InternetReadFile
InternetCrackUrlA
InternetConnectA
HttpQueryInfoA
HttpSendRequestExA
oleaut32
VariantClear
SysFreeString
VariantInit
SysAllocString
netapi32
NetApiBufferFree
NetUserEnum
NetUserGetInfo
iphlpapi
GetAdaptersAddresses
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
msvcrt
_except_handler3
_errno
memcpy
memset
_purecall
memcmp
memchr
_vsnwprintf
_vsnprintf
strcmp
memmove
_ultow
strtoul
Sections
.text Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ