Static task
static1
Behavioral task
behavioral1
Sample
d8acb56aacca7efb4ded41b705731c29ee36a7a66952feb191502eb409c02d21.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d8acb56aacca7efb4ded41b705731c29ee36a7a66952feb191502eb409c02d21.exe
Resource
win10v2004-20220901-en
General
-
Target
d8acb56aacca7efb4ded41b705731c29ee36a7a66952feb191502eb409c02d21
-
Size
392KB
-
MD5
606a1ba11ca3edd934c2b07698d1ad4d
-
SHA1
b87d08a67c88fb39ade2b74b1551156c73057d11
-
SHA256
d8acb56aacca7efb4ded41b705731c29ee36a7a66952feb191502eb409c02d21
-
SHA512
31479c6259725767807df205b858da8d2c51759777f13b9e052382567a5f873a651c8a01534514d4ea542c4a7d8b00fe9df92bfe931d7c4ad3330e5fdc5efb50
-
SSDEEP
12288:t6nB72Sf3+qWsnNmkjw6ZoEgkF1bpNivXl/VI:AH8EN1dNivX1
Malware Config
Signatures
Files
-
d8acb56aacca7efb4ded41b705731c29ee36a7a66952feb191502eb409c02d21.exe windows x86
15c0edd69546fcaf03ec0c62c372e473
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSAStartup
WSACleanup
closesocket
WSAGetLastError
select
inet_ntoa
__WSAFDIsSet
listen
accept
recvfrom
sendto
WSASetLastError
gethostbyname
socket
connect
setsockopt
getsockopt
htons
bind
ntohs
getsockname
send
recv
wldap32
ord46
ord27
ord301
ord33
ord200
ord79
ord35
ord32
ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord41
iphlpapi
GetAdaptersAddresses
libxvi010
OpenWiMAXDevice
SendWiMAXMessage
RegisterCallback
CloseWiMAXDevice
kernel32
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
SetStdHandle
GetModuleHandleA
LCMapStringW
LCMapStringA
GetConsoleCP
VirtualAlloc
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
Sleep
GetLastError
GetModuleFileNameA
GetSystemTime
WaitForSingleObject
SetEvent
CreateEventA
CreateMutexA
ReleaseMutex
CloseHandle
GetVersionExA
SetLastError
FormatMessageA
SleepEx
DuplicateHandle
GetCurrentProcess
WaitForMultipleObjects
GetExitCodeThread
TerminateThread
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
ExpandEnvironmentStringsA
GetLocaleInfoA
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapSize
SetEndOfFile
GetProcessHeap
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
EnterCriticalSection
LeaveCriticalSection
MoveFileA
DeleteFileA
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateFileA
DeleteCriticalSection
SetHandleCount
GetStartupInfoA
GetModuleHandleW
ExitProcess
RtlUnwind
MultiByteToWideChar
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
advapi32
ControlService
OpenSCManagerA
QueryServiceStatus
CreateServiceA
DeleteService
CloseServiceHandle
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
Sections
.text Size: 308KB - Virtual size: 308KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ