Static task
static1
Behavioral task
behavioral1
Sample
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe
Resource
win10v2004-20221111-en
General
-
Target
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba
-
Size
702KB
-
MD5
21d82a5c9d977f7c5c5015829c321a13
-
SHA1
ffb493214fd5ac83f2a628bc0e15f5a060c36ffc
-
SHA256
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba
-
SHA512
91e5480b1e9d329c411f62c4eb99bfeda6161e07cb238acf3b00073e4d6cdadc9c1d6859561a5135833f585b5026228b063ab3aff81ff04f9534c31b08a99c34
-
SSDEEP
12288:5IODa1GPYOBsDMOUaIQpGyEV3T5W241YgNxMmDsbiYltjHR7r4w9QvbfsZ6jlPm5:5IO+aYxHjpYT5s1YgNxMmDsbiYltjHRj
Malware Config
Signatures
Files
-
30140a3a441d4d92bc78e6726d9de9a293e83f812c16658222c32ce408c453ba.exe windows x86
4320331bcf9a46674ed5540b0553eb3e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentThreadId
LoadLibraryExW
SetFilePointerEx
ReadFile
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
CloseHandle
AreFileApisANSI
ExitProcess
EnumSystemLocalesW
GetOEMCP
SetStdHandle
ReadConsoleW
CreateFileW
SetEndOfFile
MultiByteToWideChar
CreateDirectoryW
GetWindowsDirectoryA
LoadLibraryA
CreateEventW
lstrlenA
Sleep
WaitForSingleObject
LocalFree
LocalAlloc
GlobalFree
GlobalAlloc
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetCommandLineW
RtlUnwind
WriteConsoleW
GetModuleHandleExW
GetModuleFileNameW
GetFileType
GetStdHandle
IsProcessorFeaturePresent
GetStringTypeW
WideCharToMultiByte
EncodePointer
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent
HeapReAlloc
HeapAlloc
DecodePointer
user32
CheckMenuRadioItem
GetParent
GetWindowLongA
PtInRect
UnionRect
SetRect
FillRect
GetCursorPos
SendMessageA
GetClientRect
ScrollWindow
SetFocus
DrawIconEx
GetKeyState
TrackPopupMenu
UpdateWindow
GetDC
ReleaseDC
GetDlgItem
EnumWindowStationsW
DestroyIcon
GetScrollInfo
SetScrollInfo
LoadStringA
GetIconInfo
InvalidateRect
gdi32
GetObjectA
SetTextJustification
SetBkColor
SelectObject
GetDeviceCaps
DeleteObject
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
CombineRgn
comdlg32
GetOpenFileNameA
advapi32
SetSecurityDescriptorDacl
InitializeAcl
AllocateAndInitializeSid
FreeSid
SetEntriesInAclW
RegOpenKeyExW
GetUserNameW
LookupAccountNameA
MakeSelfRelativeSD
AddAccessAllowedAce
GetSecurityDescriptorLength
InitializeSecurityDescriptor
GetLengthSid
shell32
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetMalloc
ole32
MkParseDisplayName
CreateBindCtx
CoCreateInstance
CoUninitialize
CoInitialize
oleaut32
SafeArrayPutElement
OleTranslateColor
VariantInit
SysFreeString
SysAllocString
VariantClear
SafeArrayUnaccessData
opengl32
wglMakeCurrent
wglCreateContext
wglCopyContext
ws2_32
bind
closesocket
ioctlsocket
WSAStartup
WSAHtonl
WSAHtons
WSARecvFrom
WSASendTo
WSASocketA
WSALookupServiceEnd
WSAGetLastError
setupapi
CM_Get_Device_Interface_ListW
CM_Get_Global_State
CM_Get_Device_Interface_AliasW
msacm32
acmDriverDetailsA
mpr
WNetAddConnection2A
netapi32
NetApiBufferFree
NetUserGetInfo
avifil32
AVIStreamGetFrameOpen
rpcrt4
RpcBindingFree
UuidToStringA
UuidCreate
RpcBindingSetAuthInfoA
RpcMgmtWaitServerListen
RpcServerUseProtseqEpA
RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
RpcServerListen
snmpapi
SnmpUtilIdsToA
SnmpUtilOidToA
ntdsapi
DsWriteAccountSpnA
d2d1
ord1
dwrite
DWriteCreateFactory
Sections
.text Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 263KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ