Static task
static1
Behavioral task
behavioral1
Sample
f0d9e82d498473549384eb0fbeeb8115cc89be87fcc6493cee218a5a566e24d4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f0d9e82d498473549384eb0fbeeb8115cc89be87fcc6493cee218a5a566e24d4.exe
Resource
win10v2004-20220812-en
General
-
Target
f0d9e82d498473549384eb0fbeeb8115cc89be87fcc6493cee218a5a566e24d4
-
Size
876KB
-
MD5
b309be14153b825b7d7a2230535327ab
-
SHA1
f3f2edf4a3615c912c1004b14cb993554981cef3
-
SHA256
f0d9e82d498473549384eb0fbeeb8115cc89be87fcc6493cee218a5a566e24d4
-
SHA512
c490304f86947fe46bf6080b0179bc98fa7fcc41e62ea22eaeb060d46b24e7a0c903b46bb123288a448d37efae296116f1dbd348ff1742705944a20e775815fe
-
SSDEEP
24576:TW3lOwMUAuNtKgXNWfQQOiQiFyFboEkQH2nOgyz3IjkbUXAce:+IwMUAuNt6fZqssH2Ogy8HQ
Malware Config
Signatures
Files
-
f0d9e82d498473549384eb0fbeeb8115cc89be87fcc6493cee218a5a566e24d4.exe windows x86
22643980658812ca65a93844ea5c767d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
untfs
??1NTFS_UPCASE_FILE@@UAE@XZ
?ReadSet@NTFS_FRS_STRUCTURE@@QAEEPAVTLINK@@@Z
??0NTFS_UPCASE_TABLE@@QAE@XZ
??1NTFS_MFT_FILE@@UAE@XZ
?QueryAttributeByOrdinal@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAEKK@Z
??0NTFS_MFT_INFO@@QAE@XZ
?CompareFileName@NTFS_MFT_INFO@@SGEPAXKPAU_FILE_NAME@@PAG@Z
?Initialize@NTFS_BITMAP_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?WriteRemainingBootCode@NTFS_SA@@QAEEXZ
??1NTFS_SA@@UAE@XZ
?GetNextAttributeRecord@NTFS_FRS_STRUCTURE@@QAEPAXPBXPAVMESSAGE@@PAE@Z
??0NTFS_BITMAP@@QAE@XZ
??0NTFS_ATTRIBUTE_LIST@@QAE@XZ
?ReadAgain@NTFS_FRS_STRUCTURE@@QAEEVBIG_INT@@@Z
Format
?Extend@NTFS_MASTER_FILE_TABLE@@QAEEK@Z
?QueryDefaultClustersPerIndexBuffer@NTFS_SA@@SGKPBVDP_DRIVE@@K@Z
?Initialize@NTFS_MFT_INFO@@QAEEVBIG_INT@@PAVNTFS_UPCASE_TABLE@@EE_K@Z
?CopyIterator@NTFS_INDEX_TREE@@QAEEPAV1@@Z
?InsertEntry@NTFS_INDEX_TREE@@QAEEKPAXU_MFT_SEGMENT_REFERENCE@@E@Z
?Initialize@NTFS_UPCASE_TABLE@@QAEEPAVNTFS_ATTRIBUTE@@@Z
?Initialize@NTFS_BAD_CLUSTER_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?AddSecurityDescriptor@NTFS_FILE_RECORD_SEGMENT@@QAEEW4_CANNED_SECURITY_TYPE@@PAVNTFS_BITMAP@@@Z
??0NTFS_EXTENT_LIST@@QAE@XZ
?SafeQueryAttribute@NTFS_FRS_STRUCTURE@@QAEEKPAVNTFS_ATTRIBUTE@@0@Z
Chkdsk
?Resize@NTFS_ATTRIBUTE@@UAEEVBIG_INT@@PAVNTFS_BITMAP@@@Z
?NtfsUpcaseCompare@@YGJPBGK0KPBVNTFS_UPCASE_TABLE@@E@Z
??1NTFS_UPCASE_TABLE@@UAE@XZ
?Flush@NTFS_MFT_FILE@@QAEEXZ
?IsAllocated@NTFS_BITMAP@@QBEEVBIG_INT@@0@Z
?Initialize@NTFS_BOOT_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??1NTFS_INDEX_TREE@@UAE@XZ
?Initialize@NTFS_UPCASE_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?Relocate@NTFS_CLUSTER_RUN@@QAEXVBIG_INT@@@Z
??0NTFS_MFT_FILE@@QAE@XZ
?QueryNumberOfExtents@NTFS_EXTENT_LIST@@QBEKXZ
??1NTFS_REFLECTED_MASTER_FILE_TABLE@@UAE@XZ
??1NTFS_ATTRIBUTE_DEFINITION_TABLE@@UAE@XZ
?Initialize@NTFS_LOG_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??0NTFS_LOG_FILE@@QAE@XZ
??1NTFS_LOG_FILE@@UAE@XZ
??1NTFS_ATTRIBUTE_RECORD@@UAE@XZ
??1NTFS_BOOT_FILE@@UAE@XZ
??0NTFS_FILE_RECORD_SEGMENT@@QAE@XZ
sqlunirl
_CreateWaitableTimer_@12
_RegCreateKey_@12
_GetWindowText@12
_OpenEventLog_@8
_LoadIcon@8
_SetVolumeLabel_@8
_VkKeyScanEx_@8
_TranslateAccelerator@12
_GetPrivateProfileInt_@16
_GetBinaryType_@8
_GetWindowLong@8
AbortSystemShutdown_
_SetFileSecurity_@12
_RegisterWindowMessage_@4
_GetSaveFileName@4
_NDdeGetErrorString_@12
_DlgDirSelectEx_@16
_SetWindowLong@12
_PolyTextOut_@12
_GlobalGetAtomName_@12
_CommDlg_OpenSave_GetSpec@12
_GetUnicodeRedirectionLayer@0
_EnumResourceNames_@16
_RegSetValue_@20
_GetDateFormat_@24
_RegSetValueEx_@24
_ReportEvent_@36
_OpenWaitableTimer_@12
_GetProcAddress_@8
newMultiByteFromWideCharEx
_GetTabbedTextExtent_@20
_ShellExecuteEx_@4
_RegCreateKeyEx_@36
_GetTextFace_@12
_BuildCommDCBAndTimeouts_@12
_OpenFile_@12
_GetWindowTextLength@4
_GetTimeFormat_@24
_FindFirstFile_@8
wsprintf_
_NDdeShareEnum_@24
AllocConvertMultiSZNameToA
_FindAtom_@4
netapi32
NetGroupSetInfo
I_BrowserResetNetlogonState
NetUserSetInfo
NetServerEnum
NetpwNameCanonicalize
I_NetServerPasswordGet
DsRoleAbortDownlevelServerUpgrade
DsGetDcNameWithAccountW
NetValidateName
NetpInitFtinfoContext
I_NetLogonControl2
NetLocalGroupDelMembers
NetGetJoinInformation
NetpGetConfigBool
I_BrowserQueryEmulatedDomains
NetQueryDisplayInformation
DsEnumerateDomainTrustsA
I_BrowserDebugCall
NetServerTransportAdd
I_NetLogonSamLogon
NetScheduleJobGetInfo
NetLocalGroupAddMember
NetSetPrimaryComputerName
NetApiBufferReallocate
DsEnumerateDomainTrustsW
NlBindingSetAuthInfo
NetUserAdd
NetServerComputerNameAdd
NetapipBufferAllocate
DsGetDcNameW
NetReplImportDirLock
NetMessageNameEnum
NetUserGetGroups
DsGetDcCloseW
NetShareSetInfo
DsRoleServerSaveStateForUpgrade
NetpDbgPrint
NetServerTransportEnum
ifsutil
?IsEntryPresent@AUTOREG@@SGEPBVWSTRING@@0@Z
?GetDrive@SECRUN@@QAEPAVIO_DP_DRIVE@@XZ
?Write@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?IsFileSystemEnabled@IFS_SYSTEM@@SGEPBVWSTRING@@PAE@Z
?FileSetAttributes@IFS_SYSTEM@@SGEPBVWSTRING@@KPAK@Z
?ChkDsk@VOL_LIODPDRV@@QAEEW4FIX_LEVEL@@PAVMESSAGE@@KKGPAKPBVWSTRING@@@Z
?EnableVolumeUpgrade@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
?EnableFileSystem@IFS_SYSTEM@@SGEPBVWSTRING@@@Z
?Initialize@MOUNT_POINT_MAP@@QAEEXZ
?GetBuffer@TLINK@@QAEPAXPAX@Z
?Initialize@SPARSE_SET@@QAEEXZ
?CheckValidSecurityDescriptor@IFS_SYSTEM@@SGEKPAU_SECURITY_DESCRIPTOR@@@Z
?ReverseCopy@INTSTACK@@QAEEPAV1@@Z
?IsEntryPresent@AUTOREG@@SGEPBVWSTRING@@@Z
?Initialize@NUMBER_SET@@QAEEXZ
?AddEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?GetMessageW@IO_DP_DRIVE@@QAEPAVMESSAGE@@XZ
?QueryAutochkTimeOut@VOL_LIODPDRV@@SGEPAK@Z
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EG@Z
?Initialize@TLINK@@QAEEG@Z
?ComputeVolId@SUPERAREA@@SGKK@Z
?SetCache@IO_DP_DRIVE@@QAEXPAVDRIVE_CACHE@@@Z
?SendSonyMSTestUnitReadyCmd@DP_DRIVE@@QAEEPAU_SENSE_DATA@@@Z
?GetSortedFirst@TLINK@@QAEPAXXZ
?IsFrontEndPresent@AUTOREG@@SGEPBVWSTRING@@0@Z
??1VOL_LIODPDRV@@UAE@XZ
??0MOUNT_POINT_TUPLE@@QAE@XZ
?SetAutochkTimeOut@VOL_LIODPDRV@@SGEK@Z
?IsATformat@DP_DRIVE@@QBEEXZ
?AddDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?AddNext@NUMBER_SET@@QAEEVBIG_INT@@@Z
?GetData@TLINK@@QAEAAVBIG_INT@@PAX@Z
?Remove@NUMBER_SET@@QAEEPBV1@@Z
?QueryFileSystemName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@PAJ1@Z
?Pop@INTSTACK@@QAEXK@Z
?QueryChildren@DIGRAPH@@QBEEKPAVNUMBER_SET@@@Z
??1INTSTACK@@UAE@XZ
?QueryCanonicalNtDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?Add@NUMBER_SET@@QAEEVBIG_INT@@0@Z
?Initialize@CANNED_SECURITY@@QAEEXZ
kernel32
GetConsoleAliasesLengthW
RtlMoveMemory
QueryPerformanceCounter
FreeEnvironmentStringsA
ConvertFiberToThread
GetComputerNameExW
Toolhelp32ReadProcessMemory
GetPrivateProfileStringW
FatalExit
GetCommTimeouts
ReadConsoleInputW
QueryPerformanceFrequency
EnumSystemLanguageGroupsW
CallNamedPipeW
AddConsoleAliasA
OpenFile
ResumeThread
GlobalFindAtomA
SetComputerNameA
IsDBCSLeadByte
WriteFileGather
GetFirmwareEnvironmentVariableA
GetConsoleInputWaitHandle
LocalAlloc
CancelTimerQueueTimer
VirtualAlloc
RegisterWaitForInputIdle
GetCalendarInfoW
RegisterWaitForSingleObjectEx
GetEnvironmentStringsW
QueryActCtxW
DeviceIoControl
GetConsoleCommandHistoryLengthW
GetProfileStringA
GetCurrentThread
RegisterWowExec
lstrcmp
LoadLibraryA
FindVolumeMountPointClose
GetProfileSectionW
SetUnhandledExceptionFilter
EnumTimeFormatsW
ReadConsoleInputA
GetDiskFreeSpaceExA
GetBinaryType
SetProcessAffinityMask
GetConsoleFontSize
BuildCommDCBAndTimeoutsW
RequestWakeupLatency
SetEvent
EnumSystemLocalesW
Sections
.text Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 312KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 397KB - Virtual size: 397KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ