??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Static task
static1
Behavioral task
behavioral1
Sample
a3ba10e718329c846d8f33cb60b1c70d862ff92f4c0821e5fbf4afc6e96036d9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a3ba10e718329c846d8f33cb60b1c70d862ff92f4c0821e5fbf4afc6e96036d9.exe
Resource
win10v2004-20220812-en
General
-
Target
a3ba10e718329c846d8f33cb60b1c70d862ff92f4c0821e5fbf4afc6e96036d9
-
Size
2.3MB
-
MD5
0cbf4fe35392a961ff5b9edea9eb5f1d
-
SHA1
7f0f9512f74eddd4dd58e54423804a76949759c2
-
SHA256
a3ba10e718329c846d8f33cb60b1c70d862ff92f4c0821e5fbf4afc6e96036d9
-
SHA512
d703bf3309e1e9a29334b7fa996a0be7e05d32dea3b22473d209a798654ae0345515d6bdd06aadab4037b6ed2201aa89c1d3c4755a43e2a79024c0a326b371ea
-
SSDEEP
49152:10CIm8qp7fmP5zCxZL/sU4VE3F45P6ioGOU2sCueJ0:9fjY5zAUPo4R36QCu
Malware Config
Signatures
Files
-
a3ba10e718329c846d8f33cb60b1c70d862ff92f4c0821e5fbf4afc6e96036d9.exe windows x86
96ae31caf93704ee88eae868ae7222d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSASetLastError
WSAGetLastError
select
shutdown
setsockopt
connect
WSAStartup
htons
recv
htonl
send
socket
closesocket
gethostbyname
wininet
InternetCloseHandle
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetReadFile
sqlite3
sqlite3_free
sqlite3_exec
sqlite3_open
sqlite3_close
kernel32
GetProcAddress
GetModuleHandleW
CreateFileA
GetFileSize
CreateMutexW
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
TerminateProcess
ReadFile
CreateFileW
GetFileSizeEx
EnterCriticalSection
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
DeleteCriticalSection
GetFullPathNameW
FindFirstFileW
WriteFile
CopyFileW
GetTimeZoneInformation
RemoveDirectoryA
CopyFileA
FindClose
RemoveDirectoryW
FindNextFileW
GetDiskFreeSpaceExA
SetFilePointer
GetDriveTypeW
GetLogicalDriveStringsW
GetLocalTime
SetFileAttributesW
ExitProcess
SetLastError
GetCurrentThreadId
GetModuleHandleA
GetVersion
DeleteFileA
GetStdHandle
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
LoadLibraryA
GetVersionExA
FlushConsoleInputBuffer
FormatMessageW
CreateEventW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
PeekNamedPipe
GetCurrentDirectoryW
GetModuleFileNameW
GetFileAttributesW
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
SystemTimeToFileTime
DosDateTimeToFileTime
InterlockedDecrement
InterlockedIncrement
MulDiv
FreeResource
GetFileType
LocalFree
DeleteFileW
LoadLibraryW
FreeLibrary
GetCurrentProcess
CreatePipe
DuplicateHandle
CloseHandle
GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileSectionW
GlobalAlloc
LockResource
GetLastError
MultiByteToWideChar
SizeofResource
WideCharToMultiByte
LoadResource
FindResourceW
Sleep
CreateThread
GlobalFree
GetDiskFreeSpaceExW
user32
GetUserObjectInformationW
CharUpperW
DestroyWindow
LoadCursorW
RegisterClassExW
GetWindowRgn
CreateWindowExW
DefWindowProcW
wsprintfW
PostMessageW
GetProcessWindowStation
ShowWindow
FindWindowW
GetDC
ReleaseDC
GetClientRect
IsZoomed
GetDesktopWindow
ScreenToClient
CreateAcceleratorTableW
InvalidateRgn
SetWindowTextW
GetSysColor
SetCaretPos
HideCaret
ShowCaret
CreateCaret
CharPrevW
SetRect
DrawTextW
FillRect
DrawIconEx
CharNextW
ReleaseCapture
KillTimer
SetTimer
SetWindowRgn
IsIconic
MessageBoxA
PostQuitMessage
GetSystemMetrics
MessageBoxW
GetFocus
UpdateLayeredWindow
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
GetKeyState
GetPropW
SetPropW
CallWindowProcW
GetClassInfoExW
RegisterClassW
LoadImageW
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
SetCapture
SetForegroundWindow
GetParent
WindowFromPoint
GetWindowLongW
MonitorFromWindow
SetWindowLongW
GetCursorPos
MapWindowPoints
GetMonitorInfoW
MoveWindow
GetWindowTextLengthW
PtInRect
GetWindowTextW
SendMessageW
SetWindowPos
CharLowerW
GetWindowRect
IntersectRect
InvalidateRect
ClientToScreen
OffsetRect
InflateRect
wvsprintfW
SetCursor
IsWindow
GetWindow
EnableWindow
gdi32
ExtTextOutW
SetBkColor
StretchBlt
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
LineTo
RoundRect
SetBkMode
SetTextColor
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
CreateSolidBrush
GetDeviceCaps
GetObjectA
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
BitBlt
DeleteDC
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
CreatePenIndirect
MoveToEx
GetObjectW
GetStockObject
CreateFontIndirectW
CreatePen
SaveDC
RestoreDC
Rectangle
SetWindowOrgEx
GetTextMetricsW
SelectClipRgn
GetClipBox
DeleteObject
advapi32
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyA
RegCloseKey
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ord165
ShellExecuteW
ole32
CLSIDFromString
OleLockRunning
CoUninitialize
OleInitialize
OleUninitialize
CoInitialize
CoCreateInstance
CLSIDFromProgID
OleSetContainedObject
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
msvcp90
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
msvcr90
iswalnum
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
__CxxFrameHandler3
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
__RTDynamicCast
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_strdup
_memicmp
_mkdir
_itoa
_ultoa
_CxxThrowException
_CIsqrt
wcsncmp
_wcsicmp
wcsstr
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
wcsncpy
_invalid_parameter_noinfo
??_V@YAXPAX@Z
??3@YAXPAX@Z
??2@YAPAXI@Z
sprintf
feof
fopen
fread
fseek
fclose
memmove_s
strstr
atoi
_purecall
wcschr
_beginthreadex
free
malloc
strchr
wcsrchr
wcsncpy_s
fwprintf
_swprintf
fflush
_wfopen
_vswprintf
_wsplitpath
_wtoi64
setlocale
wcstol
isdigit
_localtime64
vswprintf_s
strrchr
_wtoi
rename
_mktime64
_atoi64
_stat64
strerror
rewind
__iob_func
_errno
remove
fgets
printf
fprintf
wcstombs_s
_set_errno
fwrite
mbstowcs_s
toupper
ftell
atol
_time64
_stat64i32
_gmtime64
_mkgmtime64
strncpy
strftime
sscanf
strncmp
isspace
realloc
memchr
rand
srand
ferror
perror
calloc
_strtoui64
_snprintf
atof
strtok_s
memcpy
memset
memmove
abort
_ftime64
qsort
_vsnprintf
vfprintf
_exit
raise
strcmp
tolower
_setmode
_fileno
getenv
_strnicmp
strtoul
isupper
_stricmp
isxdigit
fputs
signal
_getch
_wcslwr
wcscpy_s
wcstoul
winmm
timeSetEvent
timeKillEvent
timeEndPeriod
comctl32
ord17
_TrackMouseEvent
gdiplus
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdiplusStartup
GdiplusShutdown
GdipDeleteFont
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetTextRenderingHint
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipCreateLineBrushI
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCloneBrush
GdipDrawString
GdipSetStringFormatAlign
shlwapi
PathFileExistsW
PathFileExistsA
PathIsDirectoryW
PathRemoveFileSpecW
libxml2
xmlNodeGetContent
xmlNewTextChild
xmlParseMemory
xmlDocDumpMemory
xmlDocGetRootElement
xmlFree
xmlStrcmp
xmlNewChild
xmlFreeDoc
xmlNodeAddContent
xmlDetectCharEncoding
Exports
Exports
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 428KB - Virtual size: 428KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ