Static task
static1
Behavioral task
behavioral1
Sample
6e9769a15448efc467f489e5bce390e16d7d0ff99e1e31af4d4217a6130c76e8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6e9769a15448efc467f489e5bce390e16d7d0ff99e1e31af4d4217a6130c76e8.exe
Resource
win10v2004-20220812-en
General
-
Target
6e9769a15448efc467f489e5bce390e16d7d0ff99e1e31af4d4217a6130c76e8
-
Size
296KB
-
MD5
6257029e3fb251d16ecba49b638f6630
-
SHA1
f80e9fa362f8d73da9f9a058a68e0c062a78def7
-
SHA256
6e9769a15448efc467f489e5bce390e16d7d0ff99e1e31af4d4217a6130c76e8
-
SHA512
982c14eb450f653c594c61bb61ebf6d4fed6f3621c4c262e0e27b4a06d2b73d388341f130e73eda473d4e36e210c896005504ad45df709b9252561d13a10e357
-
SSDEEP
6144:sYkeH4vkMC5idvPfV24aWT4fEGzlU0+ieFlnd280YmW5tjfK7fYH4:seH4JCsfF/TFiA080jI1fI
Malware Config
Signatures
Files
-
6e9769a15448efc467f489e5bce390e16d7d0ff99e1e31af4d4217a6130c76e8.exe windows x86
1534b55bdd3bf9c8eaff192bdcaa0de8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
LoadLibraryA
Heap32First
GetDiskFreeSpaceW
GetStringTypeW
GetDiskFreeSpaceW
FindResourceW
CloseHandle
DeviceIoControl
SetEnvironmentVariableA
GetLastError
HeapCreate
lstrcpyW
WaitForSingleObject
lstrcmpA
ReadFileEx
GetPrivateProfileIntA
InterlockedIncrement
ExitProcess
ReadConsoleA
InterlockedDecrement
CreateEventW
adsldpc
ADsCloseSearchHandle
ADsDeleteClassDefinition
ADsExecuteSearch
ADsEnumAttributes
clbcatq
CheckMemoryGates
ComPlusMigrate
ComPlusMigrate
SetupOpen
SetSetupSave
SetSetupSave
DllGetClassObject
ComPlusMigrate
SetupOpen
CheckMemoryGates
DllGetClassObject
SetupOpen
CheckMemoryGates
version
VerFindFileA
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 292KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ