Static task
static1
Behavioral task
behavioral1
Sample
86be7dffab7169e5182dc1c478919de397ea6075385d26fbafa58eef994df8b4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
86be7dffab7169e5182dc1c478919de397ea6075385d26fbafa58eef994df8b4.exe
Resource
win10v2004-20220812-en
General
-
Target
8749986125.zip
-
Size
142KB
-
MD5
f0cc9474dcb57926882a4ec94bf2c34a
-
SHA1
a3cc28b47b586abf97439fd930c37f5edf948ced
-
SHA256
edab367c6ed3ddfd5a315fd1ab8f930ffbfc6a53347957e0a74e8c7f60707c0c
-
SHA512
a452dbae3f27ecc27bcf09e61c2957f17436cf208e8fd9571c394bfd967d710272e539e02ba1d9751ab7a9a174e64455d9af7bcd236493b017f226781790e842
-
SSDEEP
3072:e4e0FhQLjBYAatTamoDDrILRjpAnWZHh2savEjt6FkZOHkw8a4tf7YJVp:ntFhkjuFQrmRjpVZB2sJocOyaEsTp
Malware Config
Signatures
Files
-
8749986125.zip.zip
Password: infected
-
86be7dffab7169e5182dc1c478919de397ea6075385d26fbafa58eef994df8b4.exe windows x86
c60b4d9c7000b1bc1dde5de5194ea962
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
CreateFileA
GetModuleHandleA
OpenProcess
GetCurrentProcessId
GetVolumeInformationA
VirtualProtectEx
GetCurrentProcess
lstrcpyA
GetLocalTime
GetLastError
lstrlenA
SetLastError
WaitForSingleObject
CreateThread
lstrcmpiA
Sleep
GetModuleFileNameW
RaiseException
InitializeCriticalSectionAndSpinCount
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
SetErrorMode
SetUnhandledExceptionFilter
GetCurrentThreadId
ExitProcess
TerminateProcess
GetModuleHandleW
InterlockedIncrement
lstrcmpiW
LocalFree
GetCommandLineW
LoadLibraryExW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetModuleHandleExW
GetTickCount
GetUserDefaultUILanguage
FindClose
FindFirstFileW
SetEndOfFile
SetStdHandle
WriteConsoleW
LoadLibraryW
VirtualQuery
lstrlenW
InterlockedDecrement
GetModuleFileNameA
CreateFileW
GetFileSize
CloseHandle
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetFileType
SetHandleCount
GetStdHandle
WriteFile
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetLocaleInfoW
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetCPInfo
LCMapStringW
GetStartupInfoW
HeapSetInformation
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
WideCharToMultiByte
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
user32
CallWindowProcW
wsprintfA
DestroyWindow
CharNextW
DefWindowProcW
wsprintfW
FindWindowW
GetWindowThreadProcessId
advapi32
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegOpenKeyExW
shell32
CommandLineToArgvW
ShellExecuteW
ole32
OleInitialize
CoTaskMemAlloc
CoTaskMemRealloc
OleUninitialize
CLSIDFromString
CoUninitialize
CoInitialize
CLSIDFromProgID
CoCreateInstance
OleRun
CoTaskMemFree
oleaut32
GetErrorInfo
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantClear
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VarUI4FromStr
shlwapi
SHSetValueA
SHDeleteKeyA
PathFileExistsW
PathRemoveFileSpecA
PathAddBackslashA
SHGetValueA
PathStripPathA
SHGetValueW
comctl32
InitCommonControlsEx
psapi
GetModuleFileNameExA
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ws2_32
WSAStartup
gethostname
WSACleanup
gethostbyname
dbghelp
MiniDumpWriteDump
wininet
HttpSendRequestA
InternetReadFile
InternetConnectA
InternetCloseHandle
InternetCreateUrlA
HttpOpenRequestA
HttpQueryInfoA
InternetCrackUrlA
InternetOpenA
libcurl
curl_global_cleanup
curl_global_init
Sections
.text Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ