Static task
static1
Behavioral task
behavioral1
Sample
ed13e7d8f11ea262382e6e0c8745556dd08513a6aa6c174542a8f090a410e225.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ed13e7d8f11ea262382e6e0c8745556dd08513a6aa6c174542a8f090a410e225.exe
Resource
win10v2004-20221111-en
General
-
Target
ed13e7d8f11ea262382e6e0c8745556dd08513a6aa6c174542a8f090a410e225
-
Size
60KB
-
MD5
0b30c00d5001a247f8f99196bbaf59fe
-
SHA1
46849a530c3d33df1f23db59816ae3b32a51e2f7
-
SHA256
ed13e7d8f11ea262382e6e0c8745556dd08513a6aa6c174542a8f090a410e225
-
SHA512
994fe36633ecf36212f333325e8b3cd2abfbd9587d159536b372783e72e556e3c63b9169de6aea6ffb51fcf93fe8703d9f7fdb7219d46096ad408476273b97ab
-
SSDEEP
768:5IKllekPJQsNffBaVLZpXCmUC5mo6FOYsXOqw6unxFDZbFMuUNZnbClYdhaBd:9lleYfBCL6NgvX1LixJdF+ZnbuYzaB
Malware Config
Signatures
Files
-
ed13e7d8f11ea262382e6e0c8745556dd08513a6aa6c174542a8f090a410e225.exe windows x86
d8e1e0a84929a8f9011bac489e95a2aa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rtm
RtmDeleteRoute
MgmReleaseInterfaceOwnership
MgmAddGroupMembershipEntry
MgmGroupEnumerationEnd
RtmDeregisterEntity
RtmGetChangeStatus
RtmLookupIPDestination
RtmFindNextHop
RtmGetEnumDests
RtmDeleteRouteList
RtmGetDestInfo
RtmIsBestRoute
RtmGetMostSpecificDestination
RtmDeleteNextHop
RtmIsRoute
RtmGetExactMatchRoute
RtmReferenceHandles
RtmLockNextHop
RtmLockRoute
RtmGetExactMatchDestination
RtmInsertInRouteList
RtmReleaseDestInfo
MgmTakeInterfaceOwnership
advapi32
ClearEventLogW
BuildTrusteeWithNameW
LsaGetRemoteUserName
RegOpenUserClassesRoot
AddAce
ConvertToAutoInheritPrivateObjectSecurity
CryptDuplicateHash
RegEnumKeyExA
DuplicateTokenEx
RemoveUsersFromEncryptedFile
RegisterIdleTask
I_ScIsSecurityProcess
SaferGetLevelInformation
WmiSetSingleItemW
QueryAllTracesW
LsaClose
UpdateTraceW
CryptSetProviderA
RegCreateKeyExA
SetUserFileEncryptionKey
GetTraceEnableFlags
ConvertSidToStringSidA
CryptImportKey
wmi
WmiSetSingleItemA
WmiQuerySingleInstanceA
WmiNotificationRegistrationA
QueryAllTracesW
WmiNotificationRegistrationW
StartTraceW
StartTraceA
WmiMofEnumerateResourcesW
WmiQueryAllDataA
WmiFreeBuffer
WmiDevInstToInstanceNameA
EnableTrace
RemoveTraceCallback
ControlTraceW
OpenTraceA
TraceEvent
WmiDevInstToInstanceNameW
WmiExecuteMethodW
WmiExecuteMethodA
WmiQueryGuidInformation
WmiSetSingleItemW
UnregisterTraceGuids
WmiQuerySingleInstanceW
TraceEventInstance
ProcessTrace
WmiOpenBlock
RegisterTraceGuidsW
GetTraceEnableLevel
WmiSetSingleInstanceA
kernel32
UnregisterConsoleIME
WaitForDebugEvent
FatalAppExitW
VirtualUnlock
BuildCommDCBW
SetFirmwareEnvironmentVariableA
CreateSemaphoreA
GetPrivateProfileSectionW
GetComputerNameExW
HeapCreate
VirtualAlloc
SearchPathA
IsBadHugeWritePtr
GetConsoleAliasExesLengthA
PrivMoveFileIdentityW
PulseEvent
GetFileSizeEx
lstrcat
LoadLibraryA
GetNumberOfConsoleFonts
VerifyConsoleIoHandle
RemoveVectoredExceptionHandler
CreateMailslotA
SetConsoleCursorMode
FreeUserPhysicalPages
GetPrivateProfileIntA
CloseConsoleHandle
LoadLibraryExW
LocalReAlloc
mssign32
PvkPrivateKeyAcquireContext
FreeCryptProvFromCert
PvkPrivateKeySaveA
PvkGetCryptProv
PvkPrivateKeyAcquireContextFromMemory
SignerTimeStamp
SignerTimeStampEx
PvkFreeCryptProv
PvkPrivateKeyAcquireContextFromMemoryA
PvkPrivateKeyReleaseContext
SignerAddTimeStampResponseEx
DllUnregisterServer
SignerCreateTimeStampRequest
SignerAddTimeStampResponse
PvkPrivateKeyLoadFromMemory
PvkPrivateKeySaveToMemoryA
PvkPrivateKeyLoadA
PvkPrivateKeySave
SignError
SignerSignEx
SpcGetCertFromKey
GetCryptProvFromCert
PvkPrivateKeyLoad
PvkPrivateKeySaveToMemory
DllRegisterServer
query
?StopCI@CMachineAdmin@@QAEHXZ
?GetCD@CCatState@@QAEPBGXZ
?Flush@CDynStream@@QAEXXZ
?ReportEventW@CEventLog@@QAEXAAVCEventItem@@@Z
?EnumerateFilesInDir@CiStorage@@SGXPBGAAVCEnumString@@@Z
?SetRestriction@CDbSelectNode@@QAEHPAVCDbCmdTreeNode@@@Z
?_FindOrAddAnchor@CDbSortNode@@AAEPAVCDbSortListAnchor@@XZ
?GetWChar@CMemDeSerStream@@UAEXPAGK@Z
?GetStartupData@CGenericCiProxy@@QAEPBEAAU_GUID@@AAK@Z
?NumberOfSortProps@CCatState@@QBEIXZ
?ClearList@CCombinedPropertyList@@QAEXXZ
?SetLPSTR@CStorageVariant@@QAEXPBDI@Z
DoneFILTERPerformanceData
?SetColumn@CCatState@@QAEXPBGI@Z
?EnumerateProperty@CPidLookupTable@@QAEHAAVCFullPropSpec@@AAI@Z
?Copy@CDbParameter@@QAEHABUtagDBPARAMETER@@@Z
?Add@CDbSortSet@@QAEHABVCDbSortKey@@I@Z
?SetDATE@CStorageVariant@@QAEXNI@Z
?ChangeCurrentScope@CCatState@@QAEXPBG@Z
??1CImpersonateSystem@@QAE@XZ
?GetChar@CMemDeSerStream@@UAEXPADK@Z
??0CImpersonateRemoteAccess@@QAE@PAVCImpersonationTokenCache@@@Z
msvcp60
?id@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?max@?$numeric_limits@F@std@@SAFXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@O@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0PBG@Z
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
??0locale@std@@QAE@ABV01@0H@Z
?_Getyes@_Locinfo@std@@QBEPBDXZ
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@H@2@V32@F@Z
?setstate@ios_base@std@@QAEXF@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Makpat@?$_Mpunct@D@std@@AAEXAAUpattern@money_base@2@DDD@Z
??Mstd@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z
?denorm_min@?$numeric_limits@K@std@@SAKXZ
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$complex@O@0@@Z
?log10@std@@YA?AV?$complex@O@1@ABV21@@Z
?out@?$codecvt@GDH@std@@QBEHAAHPBG1AAPBGPAD3AAPAD@Z
??1?$_Mpunct@G@std@@UAE@XZ
?widen@?$ctype@G@std@@QBEPBDPBD0PAG@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?_Doraise@out_of_range@std@@MBEXXZ
?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
d3dim
SurfaceFlipNotify
D3DMalloc
PaletteUpdateNotify
FlushD3DDevices
Direct3DCreateTexture
Direct3DGetSWRastZPixFmts
Direct3DCreateDevice
D3DRealloc
PaletteAssociateNotify
FlushD3DDevices2
Direct3D_HALCleanUp
D3DFree
Direct3DCreate
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ