Static task
static1
Behavioral task
behavioral1
Sample
977083fc01e2982258eac0a13e56cd697d9f6941f5a365e9d02d544fc3e15000.exe
Resource
win10-20220812-en
General
-
Target
977083fc01e2982258eac0a13e56cd697d9f6941f5a365e9d02d544fc3e15000.zip
-
Size
249KB
-
MD5
13ce14b9a06766ba5ff60fa0193551f1
-
SHA1
fabe8a0878062ca2bcb6bd6716a7bd76d7c8ee29
-
SHA256
8d9017a160d462c785f248a52c253684825a7fc69c74cd2be73d4753025340cd
-
SHA512
533e487f541a5a4a3e7336d853508dc054a750cf535d93ebddb6fbac82e67932295d84cf09d9883e8fb7f3b0e130b87cee8970f38094658027e521bcf6d02e70
-
SSDEEP
6144:x278+iuKSlA1ef3mhKYwjNYl1wqygSM1PGhjUb7S83afCyT7VquATjxR:xp+VHlAM3mCCFyi197afCyT7dA3j
Malware Config
Signatures
Files
-
977083fc01e2982258eac0a13e56cd697d9f6941f5a365e9d02d544fc3e15000.zip.zip
Password: infected
-
977083fc01e2982258eac0a13e56cd697d9f6941f5a365e9d02d544fc3e15000.exe.exe windows x86
Password: infected
f6ebbc99dee0ebb360681d57876ef849
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
GetLastError
lstrcatW
DeleteFileW
RaiseException
LoadLibraryW
SetVolumeMountPointW
ExitProcess
FindVolumeClose
CopyFileW
GetConsoleWindow
GetVolumePathNamesForVolumeNameW
lstrcpyW
FindNextVolumeW
lstrcmpiW
OpenMutexW
GetModuleHandleA
lstrcmpW
GetDriveTypeW
IsDebuggerPresent
OpenProcess
ReadConsoleW
ReadFile
SetEndOfFile
DecodePointer
WriteConsoleW
HeapReAlloc
ReleaseMutex
WaitForSingleObject
CreateMutexA
lstrlenA
GetSystemDefaultUILanguage
lstrlenW
FindFirstVolumeW
GetLocalTime
MapViewOfFile
CreateFileMappingW
CloseHandle
LoadLibraryA
GetModuleFileNameW
HeapSize
SetFilePointerEx
CreateFileW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTickCount
VirtualProtect
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThread
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
GetStartupInfoW
CreateTimerQueue
SetEvent
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
MultiByteToWideChar
HeapAlloc
HeapFree
ExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
CompareStringW
LCMapStringW
GetFileType
GetExitCodeProcess
CreateProcessA
CreateProcessW
GetFileAttributesExW
GetProcessHeap
user32
ShowWindow
SystemParametersInfoW
wvsprintfW
wsprintfA
wsprintfW
advapi32
OpenServiceA
EnumDependentServicesA
CloseServiceHandle
OpenSCManagerA
ControlService
QueryServiceStatusEx
CryptGenKey
CryptDestroyKey
RegCloseKey
RegCreateKeyExW
CryptExportKey
RegSetValueExW
shell32
SHEmptyRecycleBinW
ShellExecuteW
SHChangeNotify
shlwapi
PathRemoveExtensionW
iphlpapi
GetIpNetTable
netapi32
NetShareEnum
NetApiBufferFree
userenv
RefreshPolicyEx
ws2_32
closesocket
WSACleanup
inet_ntoa
freeaddrinfo
recv
connect
socket
send
WSAStartup
getaddrinfo
Sections
.text Size: 250KB - Virtual size: 250KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 86KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 253KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ