Static task
static1
Behavioral task
behavioral1
Sample
a4420eab62bd2de42462268fece668e111cc29277041c273995896f71d4364ec.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a4420eab62bd2de42462268fece668e111cc29277041c273995896f71d4364ec.exe
Resource
win10v2004-20221111-en
General
-
Target
a4420eab62bd2de42462268fece668e111cc29277041c273995896f71d4364ec
-
Size
161KB
-
MD5
a2e9d8cab3518e2367c62c0efc7456a4
-
SHA1
5be622c3d3e5617cea170368676472211fa77a24
-
SHA256
a4420eab62bd2de42462268fece668e111cc29277041c273995896f71d4364ec
-
SHA512
8617a141a5e2cd0fd61e0badb4c58e222997d073215dcc15b5caeb7adc25b6453b41cbdd0ed7594ffb5a638c8e319f8e9dcfb2f1fa79d6dccce5a3990a72310a
-
SSDEEP
3072:XcmpMzvMGHIBjLTqoOgPln8Mu4tnOE1vy/doIgPbtlkbI+QXfmVq:XVpOuldNPl8MHOE15IWbtleriC
Malware Config
Signatures
Files
-
a4420eab62bd2de42462268fece668e111cc29277041c273995896f71d4364ec.exe windows x86
7f2bd6b27979f0335e8aec26f9d37113
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
CreateFileA
CreateThread
EnterCriticalSection
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleFileNameA
GetProcAddress
GetProcessHeap
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
LeaveCriticalSection
LocalAlloc
lstrcmpiA
advapi32
ChangeServiceConfigA
CloseServiceHandle
DeleteService
EqualSid
FreeSid
LookupPrivilegeValueA
OpenServiceA
QueryServiceConfig2A
RegFlushKey
RegQueryValueExA
RegisterServiceCtrlHandlerA
SetSecurityDescriptorDacl
StartServiceA
UnlockServiceDatabase
Sections
.text Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 962B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ