Static task
static1
Behavioral task
behavioral1
Sample
Soft-v39.04.exe
Resource
win7-20220812-en
General
-
Target
Soft-v39.04.exe
-
Size
2.0MB
-
MD5
4c4c72b9b8071a69d055886e52ddbb37
-
SHA1
365a9dfeb7287f2644336efa56513914c53c1d18
-
SHA256
6e5e443b0c212714077b508d6be6e0b4096f9015e0cdcc3ca38c6972b14ab1ba
-
SHA512
a849a45e8046b82bf3d06d9aa5371f4048f74ccdae40426ec90246de40cac0f48f9ce69a2287d65c0e7684f62d99a1bc6b6c9a674611fe72ac374742bb0d11a2
-
SSDEEP
24576:5b5x95TX47vrS9oRCuxH9B4G2RK1yB8azwXH17IOJBBQxpOxe9zXzxIlnrz+MhUl:539PuZUXKq8a2BQTxeluMhmCkm7Ds
Malware Config
Signatures
Files
-
Soft-v39.04.exe.exe windows x64
e3b0396a0f26842f8f564f4de5ab3a43
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetModuleHandleW
InitializeCriticalSectionEx
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
SetLastError
MoveFileExA
GetEnvironmentVariableA
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
VerSetConditionMask
VerifyVersionInfoA
GetFileSizeEx
FindFirstFileW
FindNextFileW
FindClose
RaiseException
DecodePointer
GetTempPathA
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetCurrentDirectoryW
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlPcToFileHeader
InterlockedPushEntrySList
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
Sleep
MoveFileExW
SetFileAttributesW
GetFileTime
SetFilePointerEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetExitCodeThread
user32
GetCursorPos
advapi32
CryptHashData
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
GetSecurityInfo
shell32
SHGetFolderPathW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
bcrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCreateHash
BCryptSetProperty
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptHashData
BCryptDeriveKeyPBKDF2
BCryptGenRandom
BCryptFinishHash
BCryptDestroyHash
ws2_32
WSACreateEvent
WSACloseEvent
WSAEnumNetworkEvents
getaddrinfo
ioctlsocket
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
closesocket
WSAGetLastError
send
recv
recvfrom
sendto
gethostname
ntohl
freeaddrinfo
WSAEventSelect
normaliz
IdnToAscii
wldap32
ord26
ord22
ord41
ord50
ord32
ord60
ord211
ord46
ord217
ord143
ord33
ord35
ord79
ord30
ord200
ord27
ord301
ord45
crypt32
CertFindCertificateInStore
PFXImportCertStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CryptStringToBinaryA
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CertFreeCertificateChain
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertEnumCertificatesInStore
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 329KB - Virtual size: 329KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 30KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ