Static task
static1
Behavioral task
behavioral1
Sample
661c2487cc02e38084df4557dc4ce56d3ca916d2fb9b5883e8e016a527c08f8d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
661c2487cc02e38084df4557dc4ce56d3ca916d2fb9b5883e8e016a527c08f8d.exe
Resource
win10v2004-20221111-en
General
-
Target
661c2487cc02e38084df4557dc4ce56d3ca916d2fb9b5883e8e016a527c08f8d
-
Size
2.0MB
-
MD5
802b42d6bd2540b3ea929e9e1b1e004e
-
SHA1
9990e2f24b09c058d98ee932ef5fc77c43707e4a
-
SHA256
661c2487cc02e38084df4557dc4ce56d3ca916d2fb9b5883e8e016a527c08f8d
-
SHA512
d04c7f322adcbae9aa056f04218e20dc520f349ee20967c35342830fe3d9583efa5f5281099b579855335511a3dbf01999e148cc2550084ec67a36123b5564bf
-
SSDEEP
49152:ZYK8g8WxuzAP/pBfpqKfQjeD8V4eAABwVHKPnsWwA:ZL8AxuQjfpgeDY3wVusZA
Malware Config
Signatures
Files
-
661c2487cc02e38084df4557dc4ce56d3ca916d2fb9b5883e8e016a527c08f8d.exe windows x86
cd67d50410e1c17789467d584bfac702
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
setsockopt
WSAStartup
connect
shutdown
select
htons
recv
WSAGetLastError
WSASetLastError
send
socket
closesocket
gethostbyname
wininet
HttpQueryInfoW
InternetCloseHandle
InternetReadFile
InternetOpenUrlW
InternetOpenW
shlwapi
PathFileExistsA
PathRemoveFileSpecW
PathFileExistsW
sqlite3
sqlite3_close
sqlite3_open
sqlite3_exec
sqlite3_free
kernel32
DeleteCriticalSection
GetFullPathNameW
FindFirstFileW
PeekNamedPipe
CreateProcessW
WaitForSingleObject
WriteFile
CopyFileW
GetTimeZoneInformation
RemoveDirectoryA
CopyFileA
FindClose
GetLocalTime
MoveFileA
CreateEventW
RemoveDirectoryW
FindNextFileW
GetDiskFreeSpaceExA
DeleteFileW
DeleteFileA
SetFilePointer
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
SetFileAttributesW
CreateFileW
ReadFile
GetVersionExA
LoadLibraryA
GlobalMemoryStatus
GetStdHandle
GetVersion
GetModuleHandleA
SetLastError
InterlockedIncrement
InterlockedDecrement
MulDiv
GetFileType
SystemTimeToFileTime
DosDateTimeToFileTime
lstrlenW
ExitProcess
FreeResource
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
RaiseException
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
EnterCriticalSection
GetLastError
FlushConsoleInputBuffer
GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
TerminateProcess
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
GetFileSize
CreateFileA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentDirectoryW
GetModuleFileNameW
GetFileAttributesW
CreateDirectoryW
DuplicateHandle
CreatePipe
GetCurrentProcess
GetProcAddress
GetModuleHandleW
LockResource
SizeofResource
LoadResource
FindResourceW
FindResourceExW
CloseHandle
LoadLibraryW
FreeLibrary
GlobalAlloc
Sleep
GlobalFree
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
user32
CharPrevW
GetSysColor
GetCaretPos
InvalidateRgn
CreateAcceleratorTableW
GetUserObjectInformationW
GetProcessWindowStation
GetDesktopWindow
MessageBoxA
KillTimer
SetCursor
wvsprintfW
InflateRect
OffsetRect
SetRect
SetPropW
CallWindowProcW
GetClassInfoExW
RegisterClassW
LoadImageW
SystemParametersInfoW
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
SetWindowTextW
GetWindow
IsWindow
DrawTextW
LoadIconW
CharNextW
FillRect
GetWindowTextW
GetWindowTextLengthW
GetPropW
MessageBoxW
ShowWindow
FindWindowW
SetWindowLongW
GetWindowLongW
GetClientRect
IsZoomed
PtInRect
ReleaseCapture
PostMessageW
PostQuitMessage
ScreenToClient
ClientToScreen
InvalidateRect
GetFocus
UpdateLayeredWindow
IsRectEmpty
GetUpdateRect
EndPaint
IntersectRect
GetWindowRect
wsprintfW
CharLowerW
SendMessageW
MoveWindow
DefWindowProcW
CreateWindowExW
SetWindowPos
GetWindowRgn
RegisterClassExW
LoadCursorW
GetParent
DestroyWindow
GetSystemMetrics
BeginPaint
GetKeyState
CreateCaret
SetCaretPos
GetCaretBlinkTime
EnableWindow
SetTimer
SetWindowRgn
IsIconic
SetCapture
SetForegroundWindow
WindowFromPoint
MonitorFromWindow
GetCursorPos
MapWindowPoints
GetMonitorInfoW
GetDC
ReleaseDC
gdi32
CombineRgn
StretchBlt
SetBkColor
ExtSelectClipRgn
GetDeviceCaps
SetPixel
GetPixel
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
RoundRect
LineTo
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
SetTextColor
SetBkMode
CreateSolidBrush
GetTextMetricsW
SetWindowOrgEx
Rectangle
GetObjectW
RestoreDC
SaveDC
CreatePen
CreateFontIndirectW
GetStockObject
ExtTextOutW
CreateRoundRectRgn
BitBlt
CreateCompatibleBitmap
SetStretchBltMode
DeleteDC
CreateDIBSection
DeleteObject
SelectObject
PtInRegion
CreateCompatibleDC
CreateRectRgn
MoveToEx
CreatePenIndirect
comdlg32
GetOpenFileNameW
advapi32
CryptReleaseContext
CryptHashData
CryptGetHashParam
CryptAcquireContextW
RegQueryValueExA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegQueryValueExW
RegCloseKey
CryptDestroyHash
RegOpenKeyA
CryptCreateHash
RegOpenKeyW
shell32
ord165
Shell_NotifyIconW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
SHGetSpecialFolderPathW
ole32
CoCreateInstance
CLSIDFromProgID
OleLockRunning
CLSIDFromString
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize
msvcp90
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
?length@?$char_traits@D@std@@SAIPBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Getcat@?$collate@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?transform@?$collate@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@PBD0@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??1locale@std@@QAE@XZ
??0locale@std@@QAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?allocate@?$allocator@D@std@@QAEPADI@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Xbad@tr1@std@@YAXW4error_type@regex_constants@12@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xmem@tr1@std@@YAXXZ
msvcr90
isdigit
_localtime64
rename
_mktime64
_atoi64
__RTDynamicCast
strerror
rewind
strstr
__iob_func
strchr
fflush
_wfopen
_errno
remove
fgets
fprintf
wcstombs_s
_set_errno
fwrite
mbstowcs_s
toupper
ftell
atol
_time64
_stat64i32
_wtoi
sscanf
calloc
_strtoui64
_snprintf
strftime
setlocale
atof
realloc
strtok_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
wcsrchr
wcstol
malloc
free
wcsstr
iswspace
memcpy_s
atoi
memmove_s
wcschr
_purecall
printf
_beginthreadex
_wcsicmp
fclose
fseek
fread
fopen
feof
sprintf
??2@YAPAXI@Z
??_V@YAXPAX@Z
_invalid_parameter_noinfo
wcsncpy
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??3@YAXPAX@Z
_strdup
_memicmp
_mkdir
_itoa
memset
_recalloc
memmove
_wcslwr
wcscpy_s
wcstoul
wcsncmp
iswalnum
_wtof
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
_gmtime64
strncpy
strncmp
isspace
memchr
rand
srand
ferror
perror
memcpy
abort
_ftime64
qsort
_vsnprintf
vfprintf
raise
strcmp
tolower
_setmode
_fileno
_strnicmp
getenv
strtoul
isupper
_stricmp
isxdigit
fputs
signal
_getch
_CxxThrowException
__CxxFrameHandler3
_CIcos
_CIsin
_CIsqrt
_stat64
gdiplus
GdipLoadImageFromFile
GdipImageSelectActiveFrame
GdiplusShutdown
GdipDrawImageI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsCount
GdiplusStartup
GdipCloneImage
GdipImageGetFrameDimensionsList
GdipFree
GdipAlloc
d3d9
Direct3DCreate9
libxml2
xmlDocDumpMemory
xmlFree
xmlParseMemory
xmlStrcmp
xmlNewChild
xmlNodeAddContent
xmlNewTextChild
xmlNodeGetContent
xmlDetectCharEncoding
xmlFreeDoc
xmlDocGetRootElement
oleaut32
VariantInit
SysAllocString
SysFreeString
VariantClear
winmm
timeBeginPeriod
timeSetEvent
timeGetTime
timeGetDevCaps
timeKillEvent
timeEndPeriod
comctl32
_TrackMouseEvent
ord17
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 278KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 488KB - Virtual size: 487KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ