Static task
static1
Behavioral task
behavioral1
Sample
cab46613c503d24d2f80a4106d8b8beb8d6679bc983fa6b0ef836f2e11582168.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cab46613c503d24d2f80a4106d8b8beb8d6679bc983fa6b0ef836f2e11582168.exe
Resource
win10v2004-20220812-en
General
-
Target
cab46613c503d24d2f80a4106d8b8beb8d6679bc983fa6b0ef836f2e11582168
-
Size
47KB
-
MD5
7f40d50319d78c0ea8ed23c456d0ba12
-
SHA1
5f298b99ee6d5db2e8835d433cf4d6b14b8f910b
-
SHA256
cab46613c503d24d2f80a4106d8b8beb8d6679bc983fa6b0ef836f2e11582168
-
SHA512
61389b01bfd60940d70a40c859b368d2e4f2064ccb5c91de3b2c3a36a112cebf772545ec3ee69d40e9af7d9ae121ef6370ab69094384a15f0b2394e117dd2210
-
SSDEEP
768:3yapBa+VkOryurHJYFy1l4TS1NCrGBFk87ITEaoe4/zB4EIVrTP4gf:V1Agl4T8HQ88TEveCIVPP4g
Malware Config
Signatures
Files
-
cab46613c503d24d2f80a4106d8b8beb8d6679bc983fa6b0ef836f2e11582168.exe windows x86
bc5742767cb61039530fbf4bbb40ca5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crtdll
_dup
_fcvt
_fullpath
_beginthread
fprintf
_putenv
calloc
_getcwd
_findclose
__iscsymf
_iob
wcsxfrm
wcscpy
towupper
fgetpos
iswalnum
exit
__argv_dll
_hypot
_mbsnset
_getsystime
_open_osfhandle
_XcptFilter
realloc
_ismbbprint
wcstoul
__mb_cur_max_dll
wcstol
clearerr
_flushall
msvcp60
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIABV12@@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Kstd@@YA?AV?$complex@M@0@ABMABV10@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@ABV01@@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAM@Z
??Xstd@@YAAAV?$complex@M@0@AAV10@ABV10@@Z
?pow@std@@YA?AV?$complex@M@1@ABMABV21@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0_Winit@std@@QAE@XZ
?norm@std@@YAOABV?$complex@O@1@@Z
?_Initcvt@?$basic_filebuf@GU?$char_traits@G@std@@@std@@IAEXXZ
??Y?$_Complex_base@N@std@@QAEAAV01@ABN@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??4_Locinfo@std@@QAEAAV01@ABV01@@Z
?_Doraise@domain_error@std@@MBEXXZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z
??1out_of_range@std@@UAE@XZ
?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A
_FRteps
??8std@@YA_NABV?$complex@N@0@ABN@Z
?decimal_point@?$_Mpunct@D@std@@QBEDXZ
mfcsubs
??0CString@@QAE@PBG@Z
??1CCriticalSection@@UAE@XZ
?ElementAt@CStringArray@@QAEAAVCString@@H@Z
??H@YG?AVCString@@ABV0@G@Z
??P@YG_NABVCString@@PBG@Z
?SetAt@CMapStringToPtr@@QAEXPBGPAX@Z
?GetHashTableSize@CMapStringToPtr@@QBEIXZ
?InitHashTable@CMapStringToPtr@@QAEXIH@Z
?GetBufferSetLength@CString@@QAEPAGH@Z
?FreeExtra@CStringArray@@QAEXXZ
?GetUpperBound@CStringArray@@QBEHXZ
?AllocBuffer@CString@@IAEXH@Z
?AssignCopy@CString@@IAEXHPBG@Z
?UnlockBuffer@CString@@QAEXXZ
?Compare@CString@@QBEHPBG@Z
??N@YG_NABVCString@@0@Z
?CompareNoCase@CString@@QBEHPBG@Z
??BCString@@QBEPBGXZ
??0CString@@QAE@GH@Z
?GetData@CStringArray@@QAEPAVCString@@XZ
?FreeExtra@CString@@QAEXXZ
??4CString@@QAEABV0@ABV0@@Z
??0CObject@@IAE@XZ
??M@YG_NPBGABVCString@@@Z
??M@YG_NABVCString@@PBG@Z
?Lock@CCriticalSection@@UAEHK@Z
??0CStringArray@@QAE@XZ
??9@YG_NABVCString@@0@Z
?InsertAt@CStringArray@@QAEXHPAV1@@Z
?IsEmpty@CString@@QBEHXZ
rpcrt4
I_RpcGetBufferWithObject
NdrpGetTypeFormatString
NdrClientContextUnmarshall
RpcErrorSaveErrorInfo
NdrConformantVaryingStructBufferSize
NdrServerCall
NdrGetBuffer
data_into_ndr
CStdStubBuffer_Disconnect
NdrMesTypeAlignSize2
NdrServerUnmarshall
I_RpcServerUseProtseqEp2W
NdrDllUnregisterProxy
RpcCertGeneratePrincipalNameA
RpcRevertToSelf
I_RpcEnableWmiTrace
I_RpcAsyncAbortCall
NDRSContextMarshall2
NdrServerContextNewUnmarshall
RpcServerTestCancel
float_from_ndr
NdrConformantVaryingArrayUnmarshall
UuidCreateNil
RpcServerUseProtseqEpW
MIDL_wchar_strcpy
NdrStubInitialize
I_RpcAllocate
odbctrac
TraceSQLDisconnect
TraceSQLGetCursorName
TraceSQLColumnPrivilegesW
TraceSQLSetConnectOption
TraceSQLSetConnectAttr
TraceSQLTablePrivilegesW
TraceSQLStatistics
TraceSQLColAttributeW
TraceSQLSetDescFieldW
TraceSQLFreeEnv
TraceSQLSpecialColumns
TraceSQLNumResultCols
TraceSQLFreeStmt
TraceSQLBindCol
TraceSQLDriverConnectW
TraceSQLParamOptions
TraceSQLExecDirectW
TraceSQLDataSourcesW
TraceSQLGetDiagRecW
TraceSQLGetEnvAttr
TraceSQLProceduresW
TraceSQLSetConnectOptionW
TraceSQLSetDescRec
msvcrt20
_fgetwchar
fputs
_ungetch
_tccpy
__p__winmajor
??7ios@@QBEHXZ
_wspawnvpe
_mbsupr
_close
_ismbchira
??0istrstream@@QAE@ABV0@@Z
_tcsnicmp
_wtempnam
_pwctype
isdigit
??_Eios@@UAEPAXI@Z
_tcsninc
iswalpha
_wstat
_write
?fLockcInit@ios@@0HA
??5istream@@QAEAAV0@AAG@Z
_mbctombb
_chdir
_mbsset
??0ifstream@@QAE@ABV0@@Z
_chgsign
?snextc@streambuf@@QAEHXZ
_lrotr
??_Gstdiobuf@@UAEPAXI@Z
d3dxof
DllCanUnloadNow
DllGetClassObject
DirectXFileCreate
kernel32
SetConsoleWindowInfo
ExpandEnvironmentStringsW
GetUserDefaultLCID
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetModuleHandleA
DeleteTimerQueueEx
GetConsoleSelectionInfo
FindFirstVolumeMountPointW
BackupWrite
DefineDosDeviceW
RemoveVectoredExceptionHandler
SignalObjectAndWait
GetEnvironmentVariableA
LoadLibraryA
RemoveLocalAlternateComputerNameA
MapUserPhysicalPages
Thread32First
GetTimeFormatW
UpdateResourceW
ExpandEnvironmentStringsA
GetCommProperties
SetVolumeLabelA
VirtualAlloc
GetDefaultCommConfigA
WriteConsoleOutputCharacterW
ReadFileScatter
FillConsoleOutputCharacterA
OpenWaitableTimerA
MoveFileExA
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ