Static task
static1
Behavioral task
behavioral1
Sample
a81bd8b7879be0cc1a782551de3f1bf0ff05a163b51e9f682c31b1b4e5325d1f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a81bd8b7879be0cc1a782551de3f1bf0ff05a163b51e9f682c31b1b4e5325d1f.exe
Resource
win10v2004-20221111-en
General
-
Target
a81bd8b7879be0cc1a782551de3f1bf0ff05a163b51e9f682c31b1b4e5325d1f
-
Size
548KB
-
MD5
f4a44ed97461c19b7e21645cb3ccb25a
-
SHA1
cb6ee04d6a9987314bcb1b784528f000372694d5
-
SHA256
a81bd8b7879be0cc1a782551de3f1bf0ff05a163b51e9f682c31b1b4e5325d1f
-
SHA512
e8e44be2e9d003fd99c679cd189941dabb729b4c165ea6583c36b24c585d63d6e14e2d962b67fc67bdeb91618bc2dc57ec85d25f64fdb78e0a9caace7a88d8a4
-
SSDEEP
12288:mF7UwBkbm6taDDf/ftRiKM/QdTqwxFGZt1mKTFnJ9KvwbKzdyfy+TfQMj:mpNBkudxsNJ9Kvw3y+T4Mj
Malware Config
Signatures
Files
-
a81bd8b7879be0cc1a782551de3f1bf0ff05a163b51e9f682c31b1b4e5325d1f.exe windows x86
bdbfe3c255122b55490583c1b0535831
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
CreateEventW
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
DuplicateHandle
GetSystemDirectoryW
LoadLibraryW
GetVersionExW
lstrcpynW
CreateFileW
WriteFile
MoveFileExW
DeleteFileW
GetTempFileNameW
SetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
CopyFileW
GetFileSize
GetTempPathW
ReadFile
FileTimeToLocalFileTime
FileTimeToSystemTime
SetEndOfFile
MultiByteToWideChar
CreateProcessW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetCurrentProcessId
TerminateProcess
GetStartupInfoW
ResumeThread
GetDriveTypeW
SleepEx
SetFilePointer
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetCurrentThreadId
GetLocalTime
EnterCriticalSection
SetLastError
InterlockedExchange
LeaveCriticalSection
Sleep
FormatMessageA
ExpandEnvironmentStringsA
VerifyVersionInfoW
VerSetConditionMask
SetEnvironmentVariableA
WriteConsoleW
SetStdHandle
ReadConsoleW
PeekNamedPipe
GetFileInformationByHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
WideCharToMultiByte
InitializeCriticalSection
OutputDebugStringW
SetEvent
InterlockedCompareExchange
CreateDirectoryW
UnmapViewOfFile
GetFileAttributesW
GetModuleFileNameW
FreeLibrary
GetProcAddress
GetModuleHandleW
SetUnhandledExceptionFilter
CloseHandle
CreateMutexW
SetDllDirectoryW
GetCommandLineW
DeleteCriticalSection
DecodePointer
HeapSize
HeapReAlloc
GetLastError
RaiseException
HeapDestroy
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapFree
GetFileType
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
AreFileApisANSI
GetModuleHandleExW
ExitProcess
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapAlloc
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetFullPathNameW
LoadLibraryExW
ExitThread
CreateThread
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetStringTypeW
EncodePointer
IsDebuggerPresent
user32
GetMessageW
TranslateMessage
DispatchMessageW
KillTimer
DefWindowProcW
SetTimer
SendMessageTimeoutW
FindWindowA
PostMessageW
DestroyWindow
CallWindowProcW
GetWindowLongW
PostQuitMessage
IsWindow
SetWindowLongW
CreateWindowExW
RegisterWindowMessageW
SendMessageW
advapi32
CryptEncrypt
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptGetHashParam
CryptAcquireContextW
CryptReleaseContext
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptImportKey
CryptDestroyKey
shell32
CommandLineToArgvW
SHGetSpecialFolderPathW
ole32
CoLoadLibrary
shlwapi
PathAddBackslashW
wnsprintfW
PathAppendW
wininet
InternetConnectW
InternetCrackUrlW
HttpQueryInfoW
InternetOpenW
InternetSetStatusCallbackW
InternetCloseHandle
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetReadFileExA
ws2_32
bind
connect
WSAGetLastError
ntohs
recvfrom
htons
WSASetLastError
select
WSAStartup
setsockopt
ioctlsocket
recv
send
WSACleanup
getsockopt
closesocket
socket
getaddrinfo
getsockname
getpeername
gethostname
WSAIoctl
__WSAFDIsSet
accept
freeaddrinfo
listen
sendto
wldap32
ord133
ord142
ord46
ord301
ord27
ord147
ord167
ord208
ord145
ord14
ord216
ord79
ord26
ord41
ord127
ord118
Sections
.text Size: 405KB - Virtual size: 405KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ