Static task
static1
Behavioral task
behavioral1
Sample
01f1f034655e77cfeb500cce1155454c435e4ba2d9eca96077028110f4916014.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
01f1f034655e77cfeb500cce1155454c435e4ba2d9eca96077028110f4916014.exe
Resource
win10v2004-20221111-en
General
-
Target
01f1f034655e77cfeb500cce1155454c435e4ba2d9eca96077028110f4916014
-
Size
535KB
-
MD5
50a8c7e3ad59b08289aa476bef94aab2
-
SHA1
3802284ec4d2a5a986302ba3f31ede8369abec87
-
SHA256
01f1f034655e77cfeb500cce1155454c435e4ba2d9eca96077028110f4916014
-
SHA512
4eac7c8196f7fd9470d99b24a06e467ba511d147b123d57d1902f818f15cb0931e9ecbd7785e14daad3891ab25a6b701da57996034942e1cfc2d06138af53610
-
SSDEEP
12288:X0KDVWkO/A1+58M/sE8vNDdngUrXv6m9O6yjixstZisaBXRRA+yWb4N5U2:EKD0F/45KixsPna++BbAe2
Malware Config
Signatures
Files
-
01f1f034655e77cfeb500cce1155454c435e4ba2d9eca96077028110f4916014.exe windows x86
09d3dd421e5bdb1879791063d763049e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
getpeername
WSAStartup
getsockopt
closesocket
gethostname
getaddrinfo
freeaddrinfo
ioctlsocket
listen
accept
recvfrom
sendto
send
select
__WSAFDIsSet
WSACleanup
WSAIoctl
connect
WSAGetLastError
htons
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
kernel32
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetModuleHandleW
GetCommandLineW
InterlockedCompareExchange
InterlockedExchange
Sleep
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
RaiseException
GetLastError
HeapSize
DecodePointer
DeleteCriticalSection
CloseHandle
GetProcAddress
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
GetCurrentProcessId
WaitForSingleObject
FindFirstFileA
FindClose
LoadLibraryW
FreeLibrary
InterlockedDecrement
InterlockedIncrement
DuplicateHandle
EnterCriticalSection
LeaveCriticalSection
SetEvent
CreateEventW
WaitForMultipleObjects
MultiByteToWideChar
WideCharToMultiByte
GetFileAttributesW
GetTempPathW
SetFileAttributesW
DeleteFileW
MoveFileExW
TerminateProcess
lstrcpynW
CreateDirectoryW
WritePrivateProfileStringW
GetSystemDirectoryW
VerSetConditionMask
SleepEx
VerifyVersionInfoW
InitializeCriticalSection
SetLastError
GetTickCount
PeekNamedPipe
ReadFile
GetStdHandle
GetFileType
ExpandEnvironmentStringsA
FormatMessageA
IsDebuggerPresent
OutputDebugStringW
WriteFile
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleCP
SetEndOfFile
GetConsoleMode
ReadConsoleW
FlushFileBuffers
IsValidCodePage
GetACP
GetOEMCP
SetStdHandle
FindFirstFileExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
WriteConsoleW
GetCurrentDirectoryW
CreateFileW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
RtlUnwind
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFilePointerEx
IsProcessorFeaturePresent
SetEnvironmentVariableA
GetFullPathNameW
LoadLibraryExW
ExitThread
GetCurrentThreadId
CreateThread
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetStringTypeW
EncodePointer
advapi32
RegCloseKey
AdjustTokenPrivileges
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueW
ole32
CoInitializeEx
CoUninitialize
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
CommandLineToArgvW
shlwapi
StrCmpNIW
PathAddBackslashW
PathAppendW
iphlpapi
GetAdaptersInfo
wldap32
ord127
ord41
ord26
ord79
ord216
ord14
ord145
ord208
ord133
ord142
ord46
ord301
ord167
ord27
ord147
ord118
psapi
GetModuleFileNameExW
GetProcessImageFileNameW
Sections
.text Size: 370KB - Virtual size: 369KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ