Static task
static1
Behavioral task
behavioral1
Sample
bc5d04e49f512360e57490169e81e4d72f26b574002916f1403004dbeda51fc1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bc5d04e49f512360e57490169e81e4d72f26b574002916f1403004dbeda51fc1.exe
Resource
win10v2004-20220812-en
General
-
Target
bc5d04e49f512360e57490169e81e4d72f26b574002916f1403004dbeda51fc1
-
Size
349KB
-
MD5
dce56eda2ee7dde46f9059de39072fa5
-
SHA1
bafa0a73affbb5f916a2e2e4be57e94078c8a744
-
SHA256
bc5d04e49f512360e57490169e81e4d72f26b574002916f1403004dbeda51fc1
-
SHA512
93a6d807665af1a74ee7ee30b435b5274ad2962b4ddf91b32841578833ce2680a00c126353834e45ed3698816affc980b969268754322f755c17a0139f243dd6
-
SSDEEP
3072:ZoduVwToK052ZHjxALPEh7CnTH/+dPGFMt8rusQ9h951rogSlSFb+5ufXsfazdu1:Zo0+0K9ZD4PS+TWkFy9h9Tk9AOaztX
Malware Config
Signatures
Files
-
bc5d04e49f512360e57490169e81e4d72f26b574002916f1403004dbeda51fc1.exe windows x86
57c4d3061a1fa439ece80f91cd607d07
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtQuerySystemInformation
RtlxUnicodeStringToOemSize
RtlxUnicodeStringToAnsiSize
RtlOemToUnicodeN
RtlImageNtHeader
NtDeleteKey
RtlTimeToSecondsSince1970
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
NtAllocateVirtualMemory
NtOpenEvent
NtPowerInformation
RtlCreateTimer
RtlReAllocateHeap
NtUnmapViewOfSection
RtlCreateUserThread
RtlEnterCriticalSection
_wcsicmp
wcsrchr
RtlInitAnsiString
NtCreateKey
NlsMbOemCodePageTag
RtlCopySid
NtConnectPort
RtlFormatCurrentUserKeyPath
NtOpenKey
NtClose
_strnicmp
NtQueryVolumeInformationFile
NtQueryInformationProcess
RtlAdjustPrivilege
RtlLengthSid
RtlCopyUnicodeString
RtlExpandEnvironmentStrings_U
RtlInitString
NtSetInformationFile
RtlAnsiStringToUnicodeString
NtQueryValueKey
RtlSetOwnerSecurityDescriptor
RtlRunEncodeUnicodeString
NtOpenFile
NtQueryKey
NtAdjustPrivilegesToken
NtQueryInformationToken
NtQueryDirectoryFile
RtlDeleteElementGenericTable
wcslen
DbgBreakPoint
RtlNtStatusToDosError
RtlUnicodeToMultiByteSize
wcsncat
RtlUnicodeToMultiByteN
RtlUnicodeStringToInteger
RtlCreateUnicodeStringFromAsciiz
NtFreeVirtualMemory
RtlAcquireResourceShared
RtlCreateSecurityDescriptor
NtDeleteValueKey
RtlCreateUnicodeString
NtQueryDirectoryObject
RtlSetDaclSecurityDescriptor
RtlAllocateHeap
RtlRegisterWait
RtlUnicodeStringToOemString
NtSetSecurityObject
memmove
RtlLengthRequiredSid
RtlGetFullPathName_U
RtlInitializeSid
RtlReleaseResource
RtlUpcaseUnicodeStringToOemString
RtlGetNtProductType
RtlCompareMemory
RtlUpcaseUnicodeString
NtCreateFile
RtlRaiseStatus
atoi
RtlSubAuthoritySid
RtlOemStringToUnicodeString
RtlStringFromGUID
qsort
RtlSizeHeap
RtlConvertSidToUnicodeString
NtEnumerateKey
RtlDeleteResource
NtDuplicateToken
strchr
RtlDosPathNameToNtPathName_U
NtOpenProcess
RtlCreateEnvironment
wcscmp
RtlAllocateAndInitializeSid
_vsnprintf
NtQuerySymbolicLinkObject
NtOpenProcessToken
oleaut32
CreateErrorInfo
SafeArrayUnaccessData
GetActiveObject
VariantInit
SysStringByteLen
SafeArrayGetLBound
VariantClear
VariantCopy
VariantChangeTypeEx
SysFreeString
SafeArrayGetElement
SafeArrayAccessData
SysReAllocStringLen
OleLoadPicture
SafeArrayCreate
SysStringLen
VariantChangeType
LoadTypeLib
SysAllocStringByteLen
SetErrorInfo
SafeArrayPutElement
SysAllocStringLen
GetErrorInfo
SafeArrayGetUBound
RegisterTypeLib
comctl32
PropertySheetW
ImageList_ReplaceIcon
InitCommonControls
InitCommonControlsEx
ImageList_Destroy
ImageList_Draw
CreatePropertySheetPageW
PropertySheetA
shell32
SHGetSpecialFolderPathW
SHBindToParent
CommandLineToArgvW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteExW
DragQueryFileA
SHGetPathFromIDListA
SHGetMalloc
SHChangeNotify
DragQueryFileW
SHBrowseForFolderW
SHBrowseForFolderA
ShellExecuteW
SHGetDesktopFolder
comdlg32
ChooseFontA
PrintDlgExW
CommDlgExtendedError
GetFileTitleA
FindTextW
ChooseColorW
GetSaveFileNameA
PrintDlgA
FindTextA
PrintDlgW
rpcrt4
RpcStringBindingParseW
RpcServerUseProtseqEpW
NdrStubCall2
RpcBindingVectorFree
NdrDllCanUnloadNow
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoW
NdrOleFree
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
RpcBindingToStringBindingW
RpcServerInqBindings
CStdStubBuffer_AddRef
NdrCStdStubBuffer_Release
UuidFromStringW
CStdStubBuffer_IsIIDSupported
UuidToStringA
CStdStubBuffer_DebugServerRelease
NdrDllUnregisterProxy
UuidToStringW
NdrOleAllocate
RpcBindingFree
RpcServerUnregisterIf
RpcStringFreeA
CStdStubBuffer_CountRefs
RpcStringFreeW
RpcStringBindingComposeW
CStdStubBuffer_QueryInterface
NdrStubForwardingFunction
RpcImpersonateClient
UuidCreate
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
NdrCStdStubBuffer2_Release
RpcBindingSetAuthInfoExW
NdrServerCall2
NdrDllRegisterProxy
RpcEpResolveBinding
RpcRaiseException
RpcServerRegisterIfEx
CStdStubBuffer_DebugServerQueryInterface
RpcServerRegisterAuthInfoW
CStdStubBuffer_Connect
IUnknown_QueryInterface_Proxy
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
UnregisterTraceGuids
OpenSCManagerW
SetThreadToken
GetSecurityDescriptorDacl
ChangeServiceConfigW
GetUserNameA
CloseServiceHandle
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
RegSetValueExA
DuplicateTokenEx
OpenServiceW
GetSidSubAuthority
SetSecurityDescriptorOwner
CryptHashData
ConvertStringSidToSidW
GetLengthSid
FreeSid
SetEntriesInAclW
CryptDestroyHash
ControlService
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
RegDeleteKeyA
LsaOpenPolicy
ImpersonateLoggedOnUser
LsaQueryInformationPolicy
ReportEventW
LsaFreeMemory
UnlockServiceDatabase
RegOpenKeyExA
GetSidSubAuthorityCount
GetAce
GetTraceLoggerHandle
GetTokenInformation
RegQueryInfoKeyW
RegNotifyChangeKeyValue
OpenSCManagerA
InitializeSecurityDescriptor
MakeSelfRelativeSD
GetSidIdentifierAuthority
RegOpenKeyExW
LsaClose
SetSecurityDescriptorGroup
GetUserNameW
RegCloseKey
RegDeleteValueW
SetServiceStatus
GetSecurityDescriptorControl
RegQueryValueW
RegEnumValueW
RegSetValueExW
GetTraceEnableLevel
RegCreateKeyA
RevertToSelf
DeregisterEventSource
version
VerQueryValueW
VerFindFileW
GetFileVersionInfoSizeW
VerQueryValueA
GetFileVersionInfoSizeA
VerLanguageNameA
GetFileVersionInfoW
GetFileVersionInfoA
msvcrt
_ultow
memset
tolower
swprintf
__p__iob
__badioinfo
wcstoul
strtoul
_cexit
_fileno
srand
__pioinfo
printf
_ftol
_vsnprintf
toupper
_wcsicmp
malloc
_finite
exit
_CIacos
_purecall
towlower
_c_exit
_itoa
time
fread
_stat
setlocale
wcsncpy
free
_unlock
_snwprintf
ctime
__CxxFrameHandler
wcslen
__setusermatherr
_initterm
isdigit
isspace
iswalpha
_strlwr
_rotr
_snprintf
ceil
_ltow
_commit
__wgetmainargs
bsearch
_tell
_wcsupr
_vsnwprintf
rand
memcpy
_wcslwr
_wcsdup
isalpha
_rotl
_beginthreadex
wcstol
_controlfp
wcsncat
fopen
_except_handler3
__getmainargs
wcsstr
strrchr
_adjust_fdiv
towupper
__p__osver
strncpy
_local_unwind2
_exit
_ultoa
__p__fmode
strncmp
__p__commode
strstr
wcscat
??1type_info@@UAE@XZ
_access
_itow
_XcptFilter
qsort
sscanf
_wtoi
fseek
_wsplitpath
_iob
strchr
_stricmp
shlwapi
StrCatW
PathRemoveFileSpecA
PathAppendA
SHStrDupW
SHSetValueW
PathFindFileNameA
StrCmpNIA
StrRChrW
SHGetValueW
StrTrimW
StrStrIW
StrCpyW
PathAppendW
PathRemoveBlanksW
SHDeleteKeyW
SHDeleteKeyA
StrToIntExW
StrCmpW
wnsprintfW
PathGetDriveNumberW
PathAddBackslashW
StrCmpIW
PathIsRelativeW
wnsprintfA
StrCmpNW
PathIsURLW
StrChrW
StrChrIW
StrRetToBufW
SHDeleteValueW
PathSkipRootW
PathStripToRootW
PathStripToRootA
StrStrW
UrlCanonicalizeW
StrToIntW
StrCatBuffW
PathIsUNCW
SHRegGetBoolUSValueW
PathRemoveExtensionW
AssocQueryStringW
UrlIsW
PathIsRootW
kernel32
OutputDebugStringW
IsBadWritePtr
CreateFileMappingA
WaitForSingleObject
WaitForMultipleObjects
TlsFree
GetDriveTypeA
LCMapStringW
GlobalUnlock
GetEnvironmentStrings
CreateMutexA
GetModuleFileNameA
SetLastError
GetSystemTimeAsFileTime
GetCurrentDirectoryW
Sleep
VirtualAlloc
SystemTimeToFileTime
VirtualQuery
GetFileType
LocalAlloc
LoadLibraryExA
LeaveCriticalSection
GetModuleHandleW
GetCommandLineA
TlsGetValue
GetCommandLineW
MulDiv
OpenEventW
GetLastError
LCMapStringA
GetLocaleInfoW
OpenMutexW
GetVersion
SetFileAttributesA
GetFileAttributesA
GetACP
CreateDirectoryA
FindClose
GetCurrentProcessId
DeleteCriticalSection
lstrcmpiW
GetSystemDirectoryW
FindFirstFileW
SizeofResource
OpenEventA
GetFileAttributesW
IsBadReadPtr
GetLocalTime
UnmapViewOfFile
GetSystemTime
GlobalLock
CreateFileMappingW
GetConsoleMode
GetModuleHandleA
OpenMutexA
CancelIo
FindResourceW
ExitProcess
LockResource
GetExitCodeProcess
lstrcpyW
InterlockedExchange
GetThreadLocale
GetComputerNameW
SetErrorMode
WriteConsoleW
gdi32
SetPixel
GetPixel
CreateFontIndirectW
GetClipBox
RestoreDC
OffsetRgn
SetBrushOrgEx
Polyline
GetMapMode
EnumFontFamiliesExW
SetBkColor
GetTextColor
SetBkMode
SetStretchBltMode
ExtTextOutW
CloseMetaFile
CreateFontIndirectA
ExtSelectClipRgn
SetMapMode
CreateDCW
SetTextColor
PlayMetaFile
RealizePalette
GetObjectA
CreatePalette
BitBlt
GetBkMode
GetClipRgn
DeleteObject
StretchBlt
GetTextAlign
SetTextAlign
CreateCompatibleBitmap
GetGlyphOutlineA
SelectClipRgn
ScaleWindowExtEx
TranslateCharsetInfo
CreateBrushIndirect
GetViewportExtEx
CreatePatternBrush
GetTextExtentPoint32A
DPtoLP
GetNearestColor
LPtoDP
GetCurrentObject
GetTextMetricsW
GetTextExtentPointW
GetWindowExtEx
RectVisible
CreateMetaFileW
SetViewportExtEx
CreateMetaFileA
CreateCompatibleDC
MoveToEx
GetTextMetricsA
CreateDIBitmap
user32
IsWindowEnabled
MessageBoxA
SetCursor
CopyRect
GetMessagePos
GetSystemMenu
CheckDlgButton
GetWindowTextW
GetDlgCtrlID
CreateWindowExA
IsChild
IsWindowVisible
PostQuitMessage
CharNextW
LoadIconW
GetClientRect
GetCursorPos
MapWindowPoints
InvalidateRect
CharPrevW
GetDlgItemTextA
GetMenuItemCount
CheckRadioButton
SetCapture
WinHelpW
LoadStringW
DrawFocusRect
CharPrevA
DialogBoxParamA
RegisterClassA
CallNextHookEx
LoadImageW
GetSysColor
TranslateMessage
CharUpperW
EnableMenuItem
CreateWindowExW
GetCapture
CreatePopupMenu
IsIconic
SystemParametersInfoA
CharLowerW
EndPaint
EqualRect
LoadCursorW
ReleaseCapture
RegisterClassExA
LoadBitmapW
SetWindowTextA
SetDlgItemTextW
RedrawWindow
GetDC
GetWindowThreadProcessId
GetSysColorBrush
GetProcessWindowStation
DrawIcon
GetMessageW
Sections
.tls Size: 218KB - Virtual size: 218KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 490B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ