??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Static task
static1
Behavioral task
behavioral1
Sample
4107f6562f00c5e999af69470fba687c4dd274beb1ff1a016510ebc247b9d51f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4107f6562f00c5e999af69470fba687c4dd274beb1ff1a016510ebc247b9d51f.exe
Resource
win10v2004-20220901-en
General
-
Target
4107f6562f00c5e999af69470fba687c4dd274beb1ff1a016510ebc247b9d51f
-
Size
1.4MB
-
MD5
7081169e99db92426c7d2d7acc8e472d
-
SHA1
26b88c33706ad5da5a9fb492cca59b0bce13899f
-
SHA256
4107f6562f00c5e999af69470fba687c4dd274beb1ff1a016510ebc247b9d51f
-
SHA512
dbdb440903a6e1f8e837089aa1429b03ac0b040b78f096ca4c166dcad71e952eab966d3551372bb53e2004df1d8fec90fad707b9384f3f2812cd5a8a9784060c
-
SSDEEP
24576:8NQEfuFdZaZ35a+AQP/HkfG9zmY+tGIjR1OA7O1Z2jxKlHHjvu7h:8tu/Z4zgRAAzxKtHjml
Malware Config
Signatures
Files
-
4107f6562f00c5e999af69470fba687c4dd274beb1ff1a016510ebc247b9d51f.exe windows x86
b81f8b18ad661197775462a510173a95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htonl
recv
htons
send
ntohl
shlwapi
PathFileExistsA
PathFileExistsW
PathRemoveFileSpecW
libxml2
xmlFree
xmlNewTextChild
xmlDocDumpMemory
xmlDocGetRootElement
xmlFreeDoc
xmlNodeAddContent
xmlNewChild
xmlParseMemory
wininet
InternetReadFile
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
sqlite3
sqlite3_free
sqlite3_open
sqlite3_exec
sqlite3_close
kernel32
FindResourceExW
FindResourceW
LoadResource
WideCharToMultiByte
SizeofResource
MultiByteToWideChar
GetLastError
LockResource
FreeLibrary
LoadLibraryW
DeleteFileW
GetFileAttributesW
GetModuleFileNameW
GetCurrentDirectoryW
PeekNamedPipe
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CreateEventW
FormatMessageW
GetLocalTime
LocalFree
DeleteFileA
GetProcAddress
GetModuleHandleW
CreateMutexW
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
TerminateProcess
GlobalFree
GlobalAlloc
GetFileSizeEx
EnterCriticalSection
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
DeleteCriticalSection
GetFileSize
FindFirstFileW
SetFilePointer
WriteFile
CopyFileW
GetTimeZoneInformation
FindClose
FindNextFileW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
SetFileAttributesW
CopyFileA
RemoveDirectoryW
CreateFileA
SetDllDirectoryW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
CloseHandle
DuplicateHandle
CreatePipe
GetCurrentProcess
ReadFile
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
RaiseException
GetFileType
SystemTimeToFileTime
DosDateTimeToFileTime
InterlockedDecrement
InterlockedIncrement
MulDiv
ExitProcess
FreeResource
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
Sleep
CreateFileW
user32
DestroyWindow
CharUpperW
LoadCursorW
GetSystemMetrics
RegisterClassExW
GetWindowRgn
CreateWindowExW
DefWindowProcW
GetDC
ReleaseDC
SetWindowRgn
IsIconic
SetCapture
SetForegroundWindow
GetParent
WindowFromPoint
GetWindowLongW
MonitorFromWindow
SetWindowLongW
GetCursorPos
MapWindowPoints
GetMonitorInfoW
MoveWindow
GetWindowTextLengthW
PtInRect
GetWindowTextW
SetWindowPos
CharLowerW
GetWindowRect
IntersectRect
InvalidateRect
ClientToScreen
OffsetRect
InflateRect
wvsprintfW
SetCursor
IsWindow
GetWindow
EnableWindow
GetMessageW
SetFocus
TranslateMessage
DispatchMessageW
LoadImageW
RegisterClassW
GetClassInfoExW
CallWindowProcW
SetPropW
GetPropW
GetKeyState
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
UpdateLayeredWindow
GetFocus
SetTimer
KillTimer
ReleaseCapture
CharNextW
DrawIconEx
FillRect
DrawTextW
SetRect
CharPrevW
CreateCaret
ShowCaret
HideCaret
SetCaretPos
GetSysColor
SetWindowTextW
InvalidateRgn
CreateAcceleratorTableW
ScreenToClient
PostQuitMessage
IsZoomed
GetClientRect
FindWindowW
ShowWindow
MessageBoxW
PostMessageW
SendMessageW
wsprintfW
gdi32
CreateDIBSection
PtInRegion
CreateRectRgn
DeleteObject
CreateRoundRectRgn
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
GetObjectW
GetDeviceCaps
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetTextColor
SetBkMode
RoundRect
LineTo
MoveToEx
CreatePenIndirect
CreateSolidBrush
ExtTextOutW
SetBkColor
StretchBlt
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetStockObject
CreateFontIndirectW
CreatePen
SaveDC
RestoreDC
Rectangle
SetWindowOrgEx
GetTextMetricsW
GetObjectA
SelectClipRgn
GetClipBox
DeleteDC
advapi32
RegDeleteKeyA
RegOpenKeyW
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegOpenKeyA
shell32
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetSpecialFolderPathW
ord165
ole32
OleLockRunning
CLSIDFromString
CLSIDFromProgID
OleInitialize
OleUninitialize
OleSetContainedObject
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
msvcp90
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@QAE@ABV01@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
msvcr90
_cexit
_exit
__RTDynamicCast
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_memicmp
_stricmp
_itoa
_ultoa
memmove
_wcslwr
wcscpy_s
toupper
wcstoul
wcsncmp
iswalnum
_gmtime64
memset
memcpy
_CxxThrowException
_CIsqrt
__getmainargs
_wcsicmp
wcsstr
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
wcsncpy
_invalid_parameter_noinfo
??_V@YAXPAX@Z
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
fopen
fread
fseek
fclose
memmove_s
strstr
atoi
memcpy_s
_purecall
wcschr
_beginthreadex
free
malloc
strchr
wcsrchr
wcsncpy_s
fwprintf
_swprintf
fflush
_wfopen
_vswprintf
_wsplitpath
_wtoi64
setlocale
iswspace
wcstol
isdigit
_localtime64
vswprintf_s
strrchr
_wtoi
_atoi64
rewind
fgets
ftell
_strdup
atol
_mktime64
fprintf
_time64
calloc
_snprintf
strftime
realloc
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
__CxxFrameHandler3
?terminate@@YAXXZ
_amsg_exit
gdiplus
GdiplusStartup
GdipDrawString
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipCloneBrush
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateLineBrushI
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdiplusShutdown
winmm
timeKillEvent
timeEndPeriod
timeSetEvent
comctl32
ord17
_TrackMouseEvent
Exports
Exports
Sections
.text Size: 876KB - Virtual size: 876KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 370KB - Virtual size: 369KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ