Static task
static1
Behavioral task
behavioral1
Sample
965200de5d46aa61659067a2f697976663beedefcad56944dae7ab3acc136d22.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
965200de5d46aa61659067a2f697976663beedefcad56944dae7ab3acc136d22.exe
Resource
win10v2004-20220812-en
General
-
Target
965200de5d46aa61659067a2f697976663beedefcad56944dae7ab3acc136d22
-
Size
44KB
-
MD5
7ea44d9c3d3256db37abd14bb17fbe92
-
SHA1
d3f152aad45ae33ca1a259f1c4057b29c1248e25
-
SHA256
965200de5d46aa61659067a2f697976663beedefcad56944dae7ab3acc136d22
-
SHA512
7a828b6978bc2a0fa5144a39d791f818932a9ee16bf9dd8bed524f28d7f423599df3044b34d02723b1f0942cce5e583a96b50c16af992f0f5008942524c7a7e3
-
SSDEEP
768:zoOF+tTt7Imx1lx7rGTWqgq0imbL1BK0/ho7nSBAExrLLFY0AvUfl5bK:zxEtDxfx7CTWqOo0/henSBA8G0xfl5u
Malware Config
Signatures
Files
-
965200de5d46aa61659067a2f697976663beedefcad56944dae7ab3acc136d22.exe windows x86
cb726d435bde4c01892a962604d518ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winsta
WinStationSetInformationW
WinStationRenameA
WinStationWaitSystemEvent
LogonIdFromWinStationNameW
WinStationEnumerateW
WinStationShutdownSystem
ServerSetInternetConnectorStatus
WinStationActivateLicense
ServerLicensingGetAvailablePolicyIds
WinStationOpenServerA
_WinStationReadRegistry
ServerLicensingGetPolicy
_WinStationFUSCanRemoteUserDisconnect
WinStationVirtualOpen
_WinStationReInitializeSecurity
_WinStationUpdateUserConfig
WinStationShadow
WinStationCloseServer
WinStationRemoveLicense
WinStationQueryInformationW
_WinStationUpdateClientCachedCredentials
WinStationQueryLicense
WinStationQueryUpdateRequired
ServerQueryInetConnectorInformationW
ServerQueryInetConnectorInformationA
_WinStationAnnoyancePopup
msvcp60
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@O@Z
?copy@?$char_traits@D@std@@SAPADPADPBDI@Z
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
??0?$complex@M@std@@QAE@ABM0@Z
?conj@std@@YA?AV?$complex@N@1@ABV21@@Z
??_7?$basic_fstream@GU?$char_traits@G@std@@@std@@6B@
_FDnorm
?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ
?cosh@std@@YA?AV?$complex@N@1@ABV21@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@@Z
??Dstd@@YA?AV?$complex@M@0@ABV10@0@Z
?_Init@?$numpunct@D@std@@IAEXABV_Locinfo@2@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?cos@?$_Ctr@O@std@@SAOO@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??0strstream@std@@QAE@PADHH@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
??1?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@UAE@XZ
??Kstd@@YA?AV?$complex@O@0@ABV10@ABO@Z
?overflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
?_Getyes@_Locinfo@std@@QBEPBDXZ
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGH@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?grouping@?$numpunct@G@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??Dstd@@YA?AV?$complex@O@0@ABV10@0@Z
?_Getcat@?$codecvt@DDH@std@@SAIXZ
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?is_open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIXZ
??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
__Wcrtomb_lk
??0?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@V32@H@Z
?sqrt@std@@YA?AV?$complex@M@1@ABV21@@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@N@0@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?round_error@?$numeric_limits@J@std@@SAJXZ
??1?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBDI@Z
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
catsrvps
DllUnregisterServer
GetProxyDllInfo
DllRegisterServer
DllGetClassObject
DllCanUnloadNow
msvcrt
isalnum
_access
__lconv_init
_write
_locking
_wstat64
scanf
_CIacos
_ismbcl2
_mbctoupper
_mbstok
gets
_getmbcp
mktime
strtod
_cwprintf
_wexecvpe
_ismbbprint
_mbsspnp
_wstrdate
getenv
__badioinfo
isupper
_adj_fdivr_m32i
$I10_OUTPUT
kernel32
CompareStringA
WriteConsoleOutputCharacterA
VirtualAlloc
GetVolumeNameForVolumeMountPointW
LoadLibraryA
GetModuleHandleA
GetVersion
ReadConsoleOutputCharacterA
DebugBreak
AddConsoleAliasA
CloseConsoleHandle
ReadDirectoryChangesW
InterlockedIncrement
SetProcessPriorityBoost
Heap32ListNext
CreateTimerQueue
BuildCommDCBW
GetConsoleCommandHistoryA
InterlockedDecrement
GetCurrentDirectoryA
GlobalWire
GetWindowsDirectoryA
DuplicateConsoleHandle
SetPriorityClass
InitAtomTable
IsValidCodePage
Thread32First
DebugBreakProcess
GetDiskFreeSpaceW
CreateTapePartition
EnumSystemLanguageGroupsA
wininet
InternetFortezzaCommand
InternetSetCookieExW
InternetAutodialCallback
InternetReadFileExW
HttpEndRequestA
GopherOpenFileW
InternetGetCookieExA
GetUrlCacheEntryInfoW
InternetWriteFile
GopherCreateLocatorA
DeleteUrlCacheEntryA
InternetWriteFileExA
RegisterUrlCacheNotification
FtpRemoveDirectoryW
DllInstall
SetUrlCacheGroupAttributeW
LoadUrlCacheContent
ForceNexusLookupExW
InternetSetDialState
InternetCombineUrlW
InternetCrackUrlA
GopherGetAttributeA
HttpQueryInfoW
FreeUrlCacheSpaceA
InternetHangUp
FindNextUrlCacheContainerA
InternetGetConnectedStateExW
InternetLockRequestFile
user32
DefWindowProcW
PostQuitMessage
RegisterClassW
Sections
.text Size: 1024B - Virtual size: 714B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ