??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Static task
static1
Behavioral task
behavioral1
Sample
c6abc6f7d7ab62f01651824d93bc01cb69fe0c812d73408db797f6e1f7d301ea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c6abc6f7d7ab62f01651824d93bc01cb69fe0c812d73408db797f6e1f7d301ea.exe
Resource
win10v2004-20221111-en
General
-
Target
c6abc6f7d7ab62f01651824d93bc01cb69fe0c812d73408db797f6e1f7d301ea
-
Size
1.5MB
-
MD5
28c892b0844baf708e18cd23c1d315df
-
SHA1
473363e66933a8793eeadb7d361d550c8500c9d3
-
SHA256
c6abc6f7d7ab62f01651824d93bc01cb69fe0c812d73408db797f6e1f7d301ea
-
SHA512
5cd7895e5fa8fcb072e92c396d6fe9a340236325e2bce831b38f4ca8c4f41711b13575ea6f6e60ce1b915373d9a7782d86c253e37dd5aade9fb048a1dcd2b87d
-
SSDEEP
24576:Zjyd5HnpoCGkwOFvBi3iOzqGBEiw4dA/0DzApFw4WmP6h00L5olqxAU2UZCPuDZu:xynJLf37v2dkuzM5P6ioGpU2UCug
Malware Config
Signatures
Files
-
c6abc6f7d7ab62f01651824d93bc01cb69fe0c812d73408db797f6e1f7d301ea.exe windows x86
29185043ef077103259fd5161284d089
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htonl
recv
htons
send
ntohl
shlwapi
PathFileExistsA
PathFileExistsW
PathRemoveFileSpecW
libxml2
xmlFree
xmlNewTextChild
xmlDocDumpMemory
xmlDocGetRootElement
xmlFreeDoc
xmlNodeAddContent
xmlNewChild
xmlParseMemory
wininet
InternetCloseHandle
InternetOpenUrlW
HttpQueryInfoW
InternetReadFile
InternetOpenW
sqlite3
sqlite3_free
sqlite3_open
sqlite3_close
sqlite3_exec
kernel32
GlobalFree
FreeLibrary
LoadLibraryW
DeleteFileW
CreateDirectoryW
GetFileAttributesW
GetModuleFileNameW
GetCurrentDirectoryW
PeekNamedPipe
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CreateEventW
GetLastError
FormatMessageW
GetLocalTime
LocalFree
DeleteFileA
FindResourceW
LoadResource
SizeofResource
LockResource
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
GetModuleHandleW
CreateMutexW
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
Sleep
ReadFile
CreateFileW
GetFileSizeEx
EnterCriticalSection
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
DeleteCriticalSection
GetFileSize
FindFirstFileW
SetFilePointer
WriteFile
CopyFileW
GetTimeZoneInformation
FindClose
FindNextFileW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
SetFileAttributesW
CopyFileA
RemoveDirectoryW
CreateFileA
SetDllDirectoryW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
CloseHandle
DuplicateHandle
CreatePipe
GetCurrentProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
SetFileTime
DosDateTimeToFileTime
SystemTimeToFileTime
GetFileType
InterlockedDecrement
InterlockedIncrement
MulDiv
FreeResource
ExitProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GlobalAlloc
TerminateProcess
user32
CharUpperW
GetSystemMetrics
DestroyWindow
LoadCursorW
RegisterClassExW
GetWindowRgn
CreateWindowExW
DefWindowProcW
GetDC
ReleaseDC
SetWindowRgn
IsIconic
SetForegroundWindow
GetParent
GetWindowLongW
MonitorFromWindow
SetWindowLongW
MapWindowPoints
GetMonitorInfoW
MoveWindow
GetWindowTextLengthW
PtInRect
GetWindowTextW
SetWindowPos
CharLowerW
GetWindowRect
IntersectRect
InvalidateRect
ClientToScreen
ScreenToClient
OffsetRect
InflateRect
SetCursor
wvsprintfW
IsWindow
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
EnableWindow
GetWindow
LoadImageW
CallWindowProcW
GetPropW
SetPropW
RegisterClassW
GetClassInfoExW
GetKeyState
SetTimer
KillTimer
SetCapture
ReleaseCapture
CharNextW
GetFocus
GetCursorPos
UpdateLayeredWindow
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
DrawIconEx
FillRect
DrawTextW
CharPrevW
SetRect
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetSysColor
InvalidateRgn
CreateAcceleratorTableW
SetWindowTextW
PostQuitMessage
IsZoomed
GetClientRect
FindWindowW
ShowWindow
MessageBoxW
PostMessageW
SendMessageW
wsprintfW
gdi32
CreateDIBSection
PtInRegion
CreateRectRgn
DeleteObject
CreateRoundRectRgn
DeleteDC
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
GetTextMetricsW
GetDeviceCaps
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
SetBkMode
SetTextColor
RoundRect
CreatePenIndirect
MoveToEx
LineTo
CreateSolidBrush
SetBkColor
ExtTextOutW
StretchBlt
CombineRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
CreateFontIndirectW
GetObjectW
GetStockObject
CreatePen
SetWindowOrgEx
Rectangle
RestoreDC
SaveDC
GetObjectA
SelectClipRgn
BitBlt
advapi32
RegCloseKey
RegQueryValueExA
RegQueryValueExW
RegOpenKeyW
RegOpenKeyA
shell32
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetSpecialFolderPathW
ord165
ole32
CLSIDFromProgID
CLSIDFromString
OleLockRunning
OleInitialize
OleUninitialize
OleSetContainedObject
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
msvcp90
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@QAE@ABV01@@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
msvcr90
_XcptFilter
_ismbblead
exit
__RTDynamicCast
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_memicmp
_stricmp
_itoa
_ultoa
memset
memmove
memcpy
_wcslwr
toupper
wcstoul
wcscpy_s
_CxxThrowException
iswalnum
wcsncmp
_gmtime64
_CIsqrt
_exit
_wcsicmp
wcsstr
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
wcsncpy
_invalid_parameter_noinfo
??_V@YAXPAX@Z
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
fopen
fread
fseek
fclose
_purecall
wcschr
_beginthreadex
free
malloc
strchr
wcsrchr
wcsncpy_s
fwprintf
_swprintf
fflush
_wfopen
_vswprintf
_wsplitpath
_wtoi64
setlocale
memmove_s
wcstol
isdigit
_localtime64
vswprintf_s
strrchr
_wtoi
strstr
atoi
_atoi64
rewind
fgets
ftell
strncpy
_strdup
atol
_mktime64
fprintf
_time64
calloc
_snprintf
strftime
realloc
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
__CxxFrameHandler3
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
gdiplus
GdipCloneBrush
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFont
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDrawString
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateStringFormat
GdipAlloc
GdipFree
GdipCreateLineBrushI
GdipDeleteBrush
GdiplusStartup
GdiplusShutdown
winmm
timeEndPeriod
timeKillEvent
timeSetEvent
comctl32
_TrackMouseEvent
ord17
Exports
Exports
Sections
.text Size: 872KB - Virtual size: 872KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ