Static task
static1
Behavioral task
behavioral1
Sample
ac992a0a9036bb3882cf4be3129fa298873e6ae2e54a430af9d028d2dd12bf54.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ac992a0a9036bb3882cf4be3129fa298873e6ae2e54a430af9d028d2dd12bf54.exe
Resource
win10v2004-20220812-en
General
-
Target
ac992a0a9036bb3882cf4be3129fa298873e6ae2e54a430af9d028d2dd12bf54
-
Size
43KB
-
MD5
6ba144fa165d719d9b868a99d9f7f836
-
SHA1
2903617c6f333dc7e63ddb5d9c4927f64363a707
-
SHA256
ac992a0a9036bb3882cf4be3129fa298873e6ae2e54a430af9d028d2dd12bf54
-
SHA512
e0f12fd02f51de1ca6e1d7a4c631022948ed1a5669767e754b23f6bb274da8dc47eb4634e5aefacaef136db8afe723b12adbdbbfbcb8643126ccab45f6477c27
-
SSDEEP
768:eH676V3/fHVEcrYzYkLkX43yKD2tOCXdVJZSodLedq3RiXpwX9:eHnV1broYkZy//nSodL4q3RiXSX9
Malware Config
Signatures
Files
-
ac992a0a9036bb3882cf4be3129fa298873e6ae2e54a430af9d028d2dd12bf54.exe windows x86
7e41a41dbb536331b2c80e74c24bdeb8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt40
?str@istrstream@@QAEPADXZ
??4ostrstream@@QAEAAV0@ABV0@@Z
??0ostream_withassign@@QAE@ABV0@@Z
??0__non_rtti_object@@QAE@ABV0@@Z
?attach@ofstream@@QAEXH@Z
_isctype
fread
strftime
_access
_cwait
_wfopen
wcslen
?cerr@@3Vostream_withassign@@A
atol
_mbbtombc
??_Dofstream@@QAEXXZ
??_7bad_cast@@6B@
?egptr@streambuf@@IBEPADXZ
??_Estdiostream@@UAEPAXI@Z
??0stdiostream@@QAE@ABV0@@Z
kernel32
UnregisterConsoleIME
VirtualAlloc
ProcessIdToSessionId
CallNamedPipeW
GetFirmwareEnvironmentVariableA
ReadConsoleW
FillConsoleOutputAttribute
GetModuleHandleA
MoveFileWithProgressW
SetConsoleMode
GlobalSize
LoadLibraryA
GetDefaultCommConfigW
GetBinaryTypeW
GetNumberOfConsoleMouseButtons
SetTimeZoneInformation
GetCommandLineA
GetSystemTimeAsFileTime
SetEnvironmentVariableW
DeactivateActCtx
ScrollConsoleScreenBufferW
LoadModule
GetProcessShutdownParameters
SetVDMCurrentDirectories
ReleaseMutex
QueueUserWorkItem
SetInformationJobObject
rasman
RasSecurityDialogGetInfo
RasGetDeviceName
RasGetHConnFromEntry
RasSecurityDialogSend
RasGetDialParams
RasPortGetProtocolCompression
RasSetCommSettings
RasCreateConnection
RasStartRasAutoIfRequired
RasSecurityDialogReceive
RasPortStoreUserData
RasPortSetFramingEx
RasPortGetBundledPort
RasRpcDisconnect
RasRpcSetUserPreferences
RasRpcUnloadDll
RasRpcRemoteSetUserPreferences
RasActivateRoute
RasGetCustomScriptDll
RasGetConnectionUserData
RasReferenceRasman
RasRpcEnumConnections
RasRpcGetDevConfig
RasPortGetInfo
ntdll
strtoul
NlsMbOemCodePageTag
atol
RtlConvertUiListToApiList
RtlUnicodeToMultiByteSize
NtSecureConnectPort
RtlConsoleMultiByteToUnicodeN
wcscspn
RtlEqualDomainName
RtlApplyRXact
ZwUnlockFile
RtlCompressBuffer
KiUserApcDispatcher
RtlSubtreeSuccessor
RtlxOemStringToUnicodeSize
RtlLogStackBackTrace
RtlAppendUnicodeToString
RtlIpv4AddressToStringA
RtlExtendedMagicDivide
ZwQueueApcThread
RtlEnlargedUnsignedMultiply
RtlUnicodeStringToAnsiString
RtlAnsiCharToUnicodeChar
RtlUnicodeStringToAnsiSize
ZwSetTimer
RtlMultiByteToUnicodeSize
NtReadFile
bsearch
RtlMakeSelfRelativeSD
RtlFindMessage
NtOpenDirectoryObject
LdrShutdownProcess
ZwDelayExecution
ZwTerminateJobObject
NtNotifyChangeMultipleKeys
_allrem
NtReadRequestData
DbgUiConnectToDbg
ZwLoadDriver
ZwLockFile
NtLockFile
RtlAddAuditAccessObjectAce
RtlUnicodeStringToOemString
_wcsupr
__isascii
NtImpersonateClientOfPort
winmm
mciGetDeviceIDFromElementIDA
sndPlaySoundW
waveInOpen
midiInOpen
mmioInstallIOProcA
mmioStringToFOURCCA
mmioInstallIOProcW
mci32Message
midiConnect
mmsystemGetVersion
mmioSetInfo
mciDriverYield
DriverCallback
midiOutLongMsg
waveOutMessage
waveOutUnprepareHeader
PlaySoundW
waveOutOpen
PlaySound
mciSendStringA
midiInGetNumDevs
mciGetDeviceIDFromElementIDW
mmioOpenW
msvcp60
?pow@std@@YA?AV?$complex@O@1@ABV21@0@Z
?max@?$numeric_limits@E@std@@SAEXZ
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
?precision@ios_base@std@@QBEHXZ
?_Stinit@?1??_Init@?$basic_filebuf@GU?$char_traits@G@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGPAGG@Z
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
??0?$basic_fstream@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
?infinity@?$numeric_limits@H@std@@SAHXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@KAPADPADDH@Z
?length@?$codecvt@DDH@std@@QBEHAAHPBD1I@Z
??1?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
_Tolower
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??_7?$moneypunct@D$00@std@@6B@
??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?ends@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@1@AAV21@@Z
?decimal_point@?$numpunct@D@std@@QBEDXZ
??1facet@locale@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0ID@Z
?_Isnan@?$_Ctr@O@std@@SA_NO@Z
??0?$moneypunct@D$0A@@std@@QAE@I@Z
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXF@Z
?clear@ios_base@std@@QAEXF@Z
Sections
.text Size: 1024B - Virtual size: 678B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ