Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20220901-en
General
-
Target
sample.bin
-
Size
964KB
-
MD5
91cd3d353a5185a0a7d422523e4b476f
-
SHA1
d2357f4c68997389635a3fdbb2e7e624c72d4fa7
-
SHA256
9300638e2195eb1275dfe9eac562a6c40ac9b145c1badccc372493c8ca56d6f8
-
SHA512
20f5376ba89e8c6e15da1aba44e6cf321bbd55cce1644442977ed0c241de5b5894548e531904e337ff803ec518dac6c17e652aef64e599a24d46dffffbe5f449
-
SSDEEP
24576:9J9JPpyJxKpjsvMRUALriox0xUm8IKqUx3O9tQxmhTQ2CbO0Eah0UPBRB1wclc56:jA2+SGox0P8IKq+LoYbO070mRB1wuItw
Malware Config
Files
-
sample.bin.exe windows x86
887929f732fa6d73ec023747a471870f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSAGetLastError
WSASetLastError
WSAStartup
select
WSARecvFrom
htonl
bind
WSAIoctl
WSASend
shutdown
WSASocketW
socket
WSARecv
ioctlsocket
FreeAddrInfoW
GetAddrInfoW
closesocket
getsockopt
setsockopt
htons
kernel32
HeapReAlloc
HeapFree
ExitProcess
CompareStringW
HeapAlloc
GetFileSizeEx
GetModuleHandleExW
ExitThread
GetStdHandle
SetConsoleMode
GetConsoleMode
CloseHandle
FreeConsole
GetConsoleWindow
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
VirtualFree
VirtualAlloc
LocalAlloc
GetLastError
LocalFree
SetConsoleCtrlHandler
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
PostQueuedCompletionStatus
Sleep
SetErrorMode
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
MultiByteToWideChar
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
CreateDirectoryW
ReadFile
SetLastError
WriteFile
DeviceIoControl
RemoveDirectoryW
GetFinalPathNameByHandleW
SetFileTime
ReOpenFile
CreateHardLinkW
GetFileAttributesW
GetFileInformationByHandle
SetFilePointerEx
MoveFileExW
CreateSymbolicLinkW
FlushFileBuffers
GetLongPathNameW
GetShortPathNameW
GetCurrentDirectoryW
ReadDirectoryChangesW
GetFileType
SleepConditionVariableCS
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
CancelIo
SetHandleInformation
SetFileCompletionNotificationModes
GetModuleFileNameW
SetEnvironmentVariableW
QueryPerformanceFrequency
GetCurrentProcessId
QueryPerformanceCounter
FormatMessageA
DebugBreak
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
GetModuleHandleA
LoadLibraryA
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
SetFileAttributesW
GetFileAttributesExW
GetConsoleCP
SetStdHandle
GetCommandLineW
GetCommandLineA
RaiseException
GetTimeZoneInformation
HeapSize
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
DecodePointer
CopyFileW
GetCurrentThreadId
GetNativeSystemInfo
InitializeCriticalSectionAndSpinCount
CreateEventW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateThread
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
RtlUnwind
user32
TranslateMessage
ShowWindow
DispatchMessageA
MapVirtualKeyW
GetMessageA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
Sections
.text Size: 834KB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 4.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ