Static task
static1
Behavioral task
behavioral1
Sample
pdisretarded2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
pdisretarded2.exe
Resource
win10v2004-20220812-en
General
-
Target
pdisretarded2.exe
-
Size
2.3MB
-
MD5
1e6214772cbd64d9bbf226716228560b
-
SHA1
4bc557d253e363151f6509b600f7d7c4eddfd23d
-
SHA256
e2b3c3478fc9d5e4e126e320c4a95a307ef506d43f91bc409609d11ead67048a
-
SHA512
55bc9841d61fde4cd102ccef5c114b407f59b55956557681f9c2e72160a498964f8f65021819b41c30c9d9a92336453b30aa569d25369036613e99743b1dfeb4
-
SSDEEP
49152:jweBa7AyvysXznaWWG/f7X1iVfSPMhR+3MTuKaUarxNb1:jweBGAWysXGtG3Yt9hR+3O
Malware Config
Signatures
Files
-
pdisretarded2.exe.exe windows x86
7d8d3bdd83bdd582654c3a163a792492
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
socket
bind
connect
getpeername
getsockname
closesocket
freeaddrinfo
getaddrinfo
ioctlsocket
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
setsockopt
ntohs
htons
getsockopt
WSAGetLastError
send
recv
getnameinfo
shutdown
crypt32
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
advapi32
CryptDestroyHash
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
GetTokenInformation
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
IsValidSid
OpenProcessToken
GetLengthSid
kernel32
FormatMessageW
GetFileType
WriteFile
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryW
ConvertFiberToThread
ConvertThreadToFiber
IsDebuggerPresent
FindFirstFileW
FindNextFileW
GetSystemTime
SystemTimeToFileTime
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
CreateEventW
ResetEvent
SetEvent
OutputDebugStringW
FindClose
Process32First
WriteProcessMemory
HeapFree
SetConsoleTitleA
GetCurrentProcess
InitializeCriticalSectionEx
OpenProcess
HeapSize
CreateToolhelp32Snapshot
Sleep
GetLastError
LoadLibraryA
Process32Next
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetProcAddress
VirtualAllocEx
LocalFree
DeleteCriticalSection
GetProcessHeap
CreateRemoteThread
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
SleepEx
VerSetConditionMask
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
VerifyVersionInfoA
GetTickCount
WaitForSingleObjectEx
ExpandEnvironmentStringsA
CreateFileA
GetFileSizeEx
ReadFile
GetEnvironmentVariableW
WideCharToMultiByte
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
MultiByteToWideChar
user32
FindWindowA
MessageBoxA
GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
userenv
UnloadUserProfile
rpcrt4
UuidCreate
RpcStringFreeA
UuidToStringA
urlmon
URLDownloadToFileA
bcrypt
BCryptGenRandom
vcruntime140
strstr
strrchr
__RTDynamicCast
memset
memchr
memcpy
_CxxThrowException
__std_terminate
__std_type_info_name
__current_exception
wcsstr
memmove
_except_handler4_common
__current_exception_context
strchr
_purecall
__std_exception_destroy
__std_type_info_compare
__std_exception_copy
__CxxFrameHandler3
api-ms-win-crt-runtime-l1-1-0
strerror
_c_exit
__sys_nerr
__p___argv
__p___argc
_initterm_e
_initterm
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_invalid_parameter_noinfo
exit
_register_onexit_function
_beginthreadex
system
_crt_atexit
_errno
_resetstkoflw
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_invalid_parameter_noinfo_noreturn
_controlfp_s
raise
_exit
strerror_s
signal
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
_get_stream_buffer_pointers
fgetpos
_wfopen
setvbuf
__stdio_common_vsprintf
setbuf
_fseeki64
clearerr
_setmode
_fileno
ferror
__p__commode
feof
fwrite
fgets
ftell
fgetc
fseek
fread
fflush
__stdio_common_vsscanf
fputs
_set_fmode
fopen
__acrt_iob_func
fclose
__stdio_common_vfprintf
fsetpos
ungetc
fputc
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
_set_new_mode
free
malloc
_aligned_free
_aligned_malloc
realloc
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
_gmtime64
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtod
atoi
strtoll
strtol
strtoull
strtoul
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlock_file
_lock_file
_stat64i32
_access
_fstat64i32
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-string-l1-1-0
_strdup
_stricmp
strncpy
isspace
_strnicmp
strcmp
isupper
strspn
strcspn
tolower
strncmp
strpbrk
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 495KB - Virtual size: 495KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ