Static task
static1
Behavioral task
behavioral1
Sample
e206db1bfc9db50d9b991fff67dd8ae942c913986920aabcf11b69cf86d0a4e3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e206db1bfc9db50d9b991fff67dd8ae942c913986920aabcf11b69cf86d0a4e3.exe
Resource
win10v2004-20220812-en
General
-
Target
e206db1bfc9db50d9b991fff67dd8ae942c913986920aabcf11b69cf86d0a4e3
-
Size
52KB
-
MD5
5482e4f70fd0e19c47de51b0f3a77f86
-
SHA1
9a2becf4f3b256b33ba36fdc7f06afca2fbb9b6a
-
SHA256
e206db1bfc9db50d9b991fff67dd8ae942c913986920aabcf11b69cf86d0a4e3
-
SHA512
4d000dd43a62ac5764c544df1114fa9ec611f350907a2978ad59d503e45687fa499ad494656e338392f12cea8919038a51406ae779fbb47f5bdcbfceff910827
-
SSDEEP
1536:XKz1wfmGi/fFYygjfSqIS0b4Bwab/4Pi:XKzuNQFlgjSM0b4B9b/4P
Malware Config
Signatures
Files
-
e206db1bfc9db50d9b991fff67dd8ae942c913986920aabcf11b69cf86d0a4e3.exe windows x86
8b5686d23e3f146ff788e0b8aff4733f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AddAuditAccessObjectAce
GetExplicitEntriesFromAclW
AddUsersToEncryptedFile
SetInformationCodeAuthzLevelW
I_ScSendTSMessage
RegEnumKeyExA
ElfBackupEventLogFileA
ConvertSecurityDescriptorToAccessNamedW
AllocateAndInitializeSid
BuildTrusteeWithNameW
SetNamedSecurityInfoA
OpenSCManagerW
CredMarshalCredentialW
GetManagedApplicationCategories
GetSecurityInfoExW
GetLocalManagedApplicationData
AddAccessDeniedObjectAce
BuildTrusteeWithObjectsAndNameA
OpenEventLogW
CredIsMarshaledCredentialA
RegDeleteValueW
CreateProcessAsUserA
CryptDestroyHash
GetSecurityInfo
GetUserNameW
RegEnumKeyA
LsaFreeMemory
msvcirt
?get@istream@@QAEHXZ
??_8istream_withassign@@7B@
?seekoff@strstreambuf@@UAEJJW4seek_dir@ios@@H@Z
??4strstream@@QAEAAV0@AAV0@@Z
??1stdiostream@@UAE@XZ
??6ostream@@QAEAAV0@H@Z
??_7streambuf@@6B@
??_Eostream_withassign@@UAEPAXI@Z
?sync@stdiobuf@@UAEHXZ
?pcount@ostrstream@@QBEHXZ
?attach@ifstream@@QAEXH@Z
??4ofstream@@QAEAAV0@ABV0@@Z
??0filebuf@@QAE@XZ
?str@strstreambuf@@QAEPADXZ
?getline@istream@@QAEAAV1@PACHD@Z
?sputn@streambuf@@QAEHPBDH@Z
?setf@ios@@QAEJJJ@Z
??_Gostream_withassign@@UAEPAXI@Z
??1ostream@@UAE@XZ
?lockbuf@ios@@QAAXXZ
??_8ostream@@7B@
??0ostrstream@@QAE@ABV0@@Z
?hex@@YAAAVios@@AAV1@@Z
?rdbuf@stdiostream@@QBEPAVstdiobuf@@XZ
?setbuf@ofstream@@QAEPAVstreambuf@@PADH@Z
?dec@@YAAAVios@@AAV1@@Z
??_Gistream_withassign@@UAEPAXI@Z
?get@istream@@IAEAAV1@PADHH@Z
??_Gstrstreambuf@@UAEPAXI@Z
??6ostream@@QAEAAV0@K@Z
??1exception@@UAE@XZ
??0ostream_withassign@@QAE@XZ
??1strstreambuf@@UAE@XZ
?delbuf@ios@@QAEXH@Z
sqlunirl
_VkKeyScanEx_@8
_RemoveProp@8
_BackupEventLog_@8
_CreateNamedPipe_@32
_CreateStatusWindow_@16
_WritePrivateProfileString_@16
AbortSystemShutdown_
_GetOpenFileName@4
_EnumFontFamiliesEx_@20
_GetFileAttributesEx_@12
_GetClassLong_@8
_OemToCharBuff_@12
_AppendMenu_@16
_GetTimeFormat_@24
_GetDiskFreeSpaceEx_@16
_Shell_NotifyIcon_@8
_StartService_@12
_IsDialogMessage@8
_GetShortPathName_@12
_CreateService_@52
_RegUnLoadKey_@8
_CharNext_@4
_CallNamedPipe_@28
_NDdeGetErrorString_@12
_CharToOemBuff_@12
_DlgDirSelectComboBoxEx_@16
_ReadConsoleInput_@16
_MoveFile@8
_IsCharUpper_@4
_SetFileSecurity_@12
_MessageBoxEx_@20
_ChooseFont_@4
msvcrt
_ecvt
_wstati64
_sopen
_getche
__p__pgmptr
_wtempnam
log
_adj_fprem
_getdiskfree
_fstat64
islower
??0bad_cast@@QAE@ABQBD@Z
_chmod
strncpy
??1bad_typeid@@UAE@XZ
__DestructExceptionObject
_yn
??0exception@@QAE@ABQBD@Z
_creat
__crtGetLocaleInfoW
_kbhit
acos
??_Gbad_cast@@UAEPAXI@Z
_mbctolower
__lconv_init
_abnormal_termination
_adj_fdiv_m32i
ferror
_beep
?_query_new_mode@@YAHXZ
_y0
clock
_wcslwr
_ismbclegal
$I10_OUTPUT
??_7bad_cast@@6B@
__p__acmdln
_winmajor
isalnum
query
?Flush@CDynStream@@QAEXXZ
?SetI8@CStorageVariant@@QAEXT_LARGE_INTEGER@@I@Z
?UnMarshall@CDbByGuid@@QAEHAAVPDeSerStream@@@Z
?Setup@CPropStoreManager@@QAEXKKKKHK@Z
?Init@CPidLookupTable@@QAEHPAVPRcovStorageObj@@@Z
?GetStr@CKey@@QBEPAGXZ
??0CDbNatLangRestriction@@QAE@PBGABVCDbColumnNode@@K@Z
?Marshall@CDbCmdTreeNode@@QBEXAAVPSerStream@@@Z
?Release@CQueryUnknown@@UAGKXZ
?Initialize@CImpersonationTokenCache@@QAEXPBGHHHKKK@Z
?SetRestriction@CDbSelectNode@@QAEHPAVCDbCmdTreeNode@@@Z
??0CInternalPropertyRestriction@@QAE@KKABVCStorageVariant@@PAVCRestriction@@@Z
??3CDbCmdTreeNode@@SGXPAX@Z
?Remove@CDbSortSet@@QAEXI@Z
??0CGetDbProps@@QAE@XZ
??0CDriveInfo@@QAE@PBGK@Z
?GetStackTrace@@YGXPADK@Z
?Write@CDynStream@@QAEXPAXK@Z
?_wcstoui64@@YA_KPBGPAPAGH@Z
?EnableVPathNotify@CMetaDataMgr@@QAEXPAVCMetaDataVPathChangeCallBack@@@Z
?DoIt@CCopyRcovObject@@QAEJXZ
?Close@CPhysStorage@@QAEXXZ
?Clone@CDbCmdTreeNode@@QBEPAV1@H@Z
?Marshall@CNotRestriction@@QBEXAAVPSerStream@@@Z
?Find@CStaticPropertyList@@UAEPBVCPropEntry@@PBG@Z
?Next@CPropertyList@@UAEPBVCPropEntry@@XZ
?MakeBackupCopy@CPhysStorage@@QAEXAAV1@AAVPSaveProgressTracker@@@Z
?ExtensionHasScriptMap@CMetaDataMgr@@QAEHPBG@Z
?AcqRst@CRangeKeyRepository@@QAEPAVCRangeRestriction@@XZ
?LookupSDID@CSdidLookupTable@@QAEKPAXK@Z
?QueryInterface@CEmptyPropertyList@@UAGJABU_GUID@@PAPAX@Z
msdart
??0CReaderWriterLock3@@QAE@XZ
?Unlock@CLockedDoubleList@@QAEXXZ
??1CLockedDoubleList@@QAE@XZ
?_TryWriteLock@CReaderWriterLock2@@AAE_NJ@Z
??1CSingleList@@QAE@XZ
?TryReadLock@CReaderWriterLock3@@QAE_NXZ
?SetDefaultSpinAdjustmentFactor@CSpinLock@@SGXN@Z
?_H1@CLKRLinearHashTable@@CGKKK@Z
??0CSpinLock@@QAE@XZ
?_LockSpin@CSpinLock@@AAEXXZ
?sm_llGlobalList@CLKRLinearHashTable@@0VCLockedDoubleList@@A
?ReadUnlock@CReaderWriterLock3@@QAEXXZ
?ConvertExclusiveToShared@CLKRLinearHashTable@@QBEXXZ
?_H0@CLKRLinearHashTable@@ABEKK@Z
?_ExtractKey@CLKRHashTable@@ABE?BKPBX@Z
?DeleteKey@CLKRHashTable@@QAE?AW4LK_RETCODE@@K@Z
MpHeapValidate
?_LockSpin@CReaderWriterLock2@@AAEX_N@Z
?Lock@CLockedDoubleList@@QAEXXZ
?WriteUnlock@CSpinLock@@QAEXXZ
?Clear@CLKRLinearHashTable@@QAEXXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock3@@SGNXZ
MpHeapAlloc
?IsValid@CLKRLinearHashTable@@QBE_NXZ
?_WriteLockSpin@CReaderWriterLock3@@AAEXXZ
?GetSpinCount@CReaderWriterLock@@QBEGXZ
MpGetHeapHandle
?IsReadUnlocked@CReaderWriterLock@@QBE_NXZ
?FindKey@CLKRLinearHashTable@@QBE?AW4LK_RETCODE@@KPAPBX@Z
?GetDefaultSpinCount@CReaderWriterLock@@SGGXZ
??1CSpinLock@@QAE@XZ
UMSEnterCSWraper
?ReadOrWriteUnlock@CReaderWriterLock3@@QAEX_N@Z
?ReadUnlock@CSpinLock@@QAEXXZ
?Pop@CLockedSingleList@@QAEQAVCSingleListEntry@@XZ
?_TryWriteLock@CReaderWriterLock@@AAE_NXZ
?_DeleteKey@CLKRLinearHashTable@@AAE?AW4LK_RETCODE@@KK@Z
?TryWriteLock@CReaderWriterLock3@@QAE_NXZ
?RemoveTail@CLockedDoubleList@@QAEQAVCListEntry@@XZ
??4CReaderWriterLock3@@QAEAAV0@ABV0@@Z
kernel32
GetStringTypeExW
GetShortPathNameW
DosPathToSessionPathW
GetLastError
HeapFree
GlobalReAlloc
RegisterConsoleIME
SetHandleCount
GetStdHandle
GetSystemTimeAsFileTime
IsValidLocale
IsProcessorFeaturePresent
GetCurrentProcessId
VirtualLock
RemoveDirectoryW
CreateTimerQueue
CreateHardLinkW
LoadLibraryA
OutputDebugStringW
ReplaceFile
GlobalHandle
DeleteVolumeMountPointA
LockResource
ExpandEnvironmentStringsW
WriteConsoleInputW
TzSpecificLocalTimeToSystemTime
CreateWaitableTimerA
EndUpdateResourceW
GlobalUnWire
FindActCtxSectionStringW
BackupSeek
WriteConsoleInputA
VirtualAlloc
FileTimeToLocalFileTime
user32
DefWindowProcA
PostQuitMessage
RegisterClassA
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ