Static task
static1
Behavioral task
behavioral1
Sample
5f1ccd3a8e5f42b029be29c7607769f81e170123e717231a71f63eb4335634c1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5f1ccd3a8e5f42b029be29c7607769f81e170123e717231a71f63eb4335634c1.exe
Resource
win10v2004-20220901-en
General
-
Target
5f1ccd3a8e5f42b029be29c7607769f81e170123e717231a71f63eb4335634c1
-
Size
296KB
-
MD5
2880ae35d291263ebdc09493b78ddcf0
-
SHA1
55e4dc48f1b35e4512646e4f7327cb8d3b42294d
-
SHA256
5f1ccd3a8e5f42b029be29c7607769f81e170123e717231a71f63eb4335634c1
-
SHA512
1ac5fbf91136303fcb20f6fc0b93b4f44e9a260cf25a6b99236dff2c01bb1ba14e19d39308d467a009f42bcfc8b8eeb605a97110930517bc9cd136d9de861dc6
-
SSDEEP
6144:3yZeH4vkdFNLyNIff17Ydh5sTgaf50UYiv33gWuz1dASfLk:QeH46FNQW97Y+g2OUYqgW4ASfLk
Malware Config
Signatures
Files
-
5f1ccd3a8e5f42b029be29c7607769f81e170123e717231a71f63eb4335634c1.exe windows x86
d883be7b0a004b2ab8a4d86e860e44a2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CreateEventW
ReadConsoleA
WaitForSingleObject
lstrcmpA
DeviceIoControl
GetStringTypeW
Heap32First
LoadLibraryA
lstrcpyW
InterlockedIncrement
CloseHandle
FindResourceW
GetPrivateProfileIntA
InterlockedDecrement
HeapCreate
ReadFileEx
ExitProcess
GetLastError
GetDiskFreeSpaceW
GetDiskFreeSpaceW
SetEnvironmentVariableA
adsldpc
ADsEnumAttributes
ADsCloseSearchHandle
ADsExecuteSearch
ADsDeleteClassDefinition
clbcatq
CheckMemoryGates
DllGetClassObject
CheckMemoryGates
ComPlusMigrate
ComPlusMigrate
SetupOpen
SetSetupSave
ComPlusMigrate
SetupOpen
SetSetupSave
SetupOpen
DllGetClassObject
CheckMemoryGates
version
VerFindFileA
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 292KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ