Static task
static1
Behavioral task
behavioral1
Sample
7eae43508954847501111bdd8cd5159fc0030be4ce316a9b6105c726774c3ce1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7eae43508954847501111bdd8cd5159fc0030be4ce316a9b6105c726774c3ce1.exe
Resource
win10v2004-20220812-en
General
-
Target
7eae43508954847501111bdd8cd5159fc0030be4ce316a9b6105c726774c3ce1
-
Size
528KB
-
MD5
43c109389fd714e718e18bc5cac0707d
-
SHA1
095ec08d4c2fd022ae6e3786f527748327014693
-
SHA256
7eae43508954847501111bdd8cd5159fc0030be4ce316a9b6105c726774c3ce1
-
SHA512
5ebc2195595a7228ed92c03a6b1fb3d41472ecd801d70a7c0560ba355305e9dadef342d40eec77e2681996d01e2454fdbb72934203478f7ff583541792fa133a
-
SSDEEP
12288:zfnuodGfkXcvyzfQWEaS1MsbXjJPxt9Oa/M9IBmhTH2XDagqfANi3D:zqkP64WBM2TNq4i3D
Malware Config
Signatures
Files
-
7eae43508954847501111bdd8cd5159fc0030be4ce316a9b6105c726774c3ce1.exe windows x86
b7655b5b09d3f877f65b0b9028f73e58
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getpeername
WSAStartup
getsockopt
gethostname
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
sendto
send
select
__WSAFDIsSet
WSACleanup
WSAIoctl
connect
WSAGetLastError
htons
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket
kernel32
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetModuleHandleW
FindFirstFileA
FindClose
GetCommandLineW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
RaiseException
GetLastError
HeapSize
DecodePointer
DeleteCriticalSection
CloseHandle
GetProcAddress
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetCurrentProcessId
WaitForSingleObject
InterlockedDecrement
InterlockedIncrement
DuplicateHandle
EnterCriticalSection
LeaveCriticalSection
SetEvent
CreateEventW
WaitForMultipleObjects
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
GetTempPathW
SetFileAttributesW
WriteFile
MoveFileExW
LoadLibraryW
TerminateProcess
lstrcpynW
CreateDirectoryW
GetSystemDirectoryW
VerSetConditionMask
SleepEx
VerifyVersionInfoW
InitializeCriticalSection
SetLastError
Sleep
GetTickCount
PeekNamedPipe
FreeLibrary
ReadFile
GetStdHandle
GetFileType
ExpandEnvironmentStringsA
FormatMessageA
IsDebuggerPresent
OutputDebugStringW
GetConsoleMode
ReadConsoleW
GetConsoleCP
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
SetEndOfFile
GetACP
GetOEMCP
FlushFileBuffers
SetStdHandle
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
WriteConsoleW
CreateFileW
GetCurrentDirectoryW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFilePointerEx
SetEnvironmentVariableA
DeleteFileW
IsProcessorFeaturePresent
GetFullPathNameW
LoadLibraryExW
ExitThread
GetCurrentThreadId
CreateThread
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetStringTypeW
EncodePointer
advapi32
AdjustTokenPrivileges
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueW
ole32
CoUninitialize
CoInitializeEx
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
CommandLineToArgvW
shlwapi
StrCmpNIW
PathAddBackslashW
PathAppendW
iphlpapi
GetAdaptersInfo
wldap32
ord127
ord41
ord26
ord79
ord216
ord14
ord145
ord208
ord167
ord133
ord142
ord46
ord147
ord301
ord27
ord118
psapi
GetProcessImageFileNameW
GetModuleFileNameExW
Sections
.text Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ