Static task
static1
Behavioral task
behavioral1
Sample
c7854958265d9a45f89ce7e712f6acf5d8b33b8b657937f4944c952896b5f4fe.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c7854958265d9a45f89ce7e712f6acf5d8b33b8b657937f4944c952896b5f4fe.exe
Resource
win10v2004-20221111-en
General
-
Target
c7854958265d9a45f89ce7e712f6acf5d8b33b8b657937f4944c952896b5f4fe
-
Size
516KB
-
MD5
c5eaa9a1d39706fa4143f1e08c118943
-
SHA1
de14c81fe9bb084da7fb389677da3028c402657b
-
SHA256
c7854958265d9a45f89ce7e712f6acf5d8b33b8b657937f4944c952896b5f4fe
-
SHA512
4c7ce84f0cc2c66d97a3c9d626d9104f0bb02bdcba2a80d999b02550fea8841ba4cd3552b9b05969a0a817e521975db5064be43fe7fbcd5c5a7cb919a02ec40b
-
SSDEEP
12288:7XfSxWWRpH0XA0DdfXYX80o9jQBVaGOVREmHSYHh8nGBg4ASdhqEiNhvD:7vSVKzkU9HNBguduVD
Malware Config
Signatures
Files
-
c7854958265d9a45f89ce7e712f6acf5d8b33b8b657937f4944c952896b5f4fe.exe windows x86
8d7db3e2ab0a83c5e8ad86bcd238cacf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getpeername
WSAStartup
getsockopt
gethostname
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
sendto
send
select
__WSAFDIsSet
WSACleanup
WSAIoctl
connect
WSAGetLastError
htons
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket
kernel32
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetModuleHandleW
FindFirstFileA
FindClose
GetCommandLineW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
RaiseException
GetLastError
HeapSize
DecodePointer
DeleteCriticalSection
CloseHandle
GetProcAddress
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetCurrentProcessId
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
DuplicateHandle
EnterCriticalSection
LeaveCriticalSection
SetEvent
CreateEventW
WaitForMultipleObjects
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
GetTempPathW
SetFileAttributesW
WriteFile
MoveFileExW
LoadLibraryW
TerminateProcess
lstrcpynW
CreateDirectoryW
GetSystemDirectoryW
VerSetConditionMask
SleepEx
VerifyVersionInfoW
InitializeCriticalSection
SetLastError
Sleep
GetTickCount
PeekNamedPipe
FreeLibrary
ReadFile
GetStdHandle
GetFileType
ExpandEnvironmentStringsA
FormatMessageA
IsDebuggerPresent
OutputDebugStringW
GetConsoleMode
ReadConsoleW
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
SetEndOfFile
GetOEMCP
FlushFileBuffers
SetStdHandle
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
WriteConsoleW
CreateFileW
GetCurrentDirectoryW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
SetEnvironmentVariableA
DeleteFileW
SetFilePointerEx
IsProcessorFeaturePresent
GetFullPathNameW
GetTimeZoneInformation
GetSystemTimeAsFileTime
LoadLibraryExW
ExitThread
GetCurrentThreadId
CreateThread
GetStringTypeW
EncodePointer
advapi32
AdjustTokenPrivileges
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
RegCloseKey
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueW
ole32
CoUninitialize
CoInitializeEx
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
ShellExecuteExW
shlwapi
StrCmpNIW
StrToIntExW
PathAddBackslashW
PathAppendW
iphlpapi
GetAdaptersInfo
wldap32
ord127
ord41
ord26
ord79
ord216
ord14
ord145
ord208
ord167
ord147
ord133
ord142
ord27
ord46
ord301
ord118
psapi
GetProcessImageFileNameW
GetModuleFileNameExW
Sections
.text Size: 352KB - Virtual size: 352KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ