Static task
static1
Behavioral task
behavioral1
Sample
ca6449f82b25ef6e6f4e9944e14689694b90eaae5b4050ca4ad5b4f98b35484a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ca6449f82b25ef6e6f4e9944e14689694b90eaae5b4050ca4ad5b4f98b35484a.exe
Resource
win10v2004-20220901-en
General
-
Target
ca6449f82b25ef6e6f4e9944e14689694b90eaae5b4050ca4ad5b4f98b35484a
-
Size
2.5MB
-
MD5
2f9bcb1841dd3cd3b3d9e73d9f8e3083
-
SHA1
6255139526c2b3f4409698472cb844dfaf54eed2
-
SHA256
ca6449f82b25ef6e6f4e9944e14689694b90eaae5b4050ca4ad5b4f98b35484a
-
SHA512
875714c08ee0ae75ee9761183a83b157f949fa16d4674a0601bb7adcaa8fe9dfca824c3fe61f1ba693cbd75d09567c9244495e693c81f5ff092965aeee26df8a
-
SSDEEP
24576:10kCMkdksu0BR2qiLWzGjPQEgPUi4RtcG+foP7rVXlBoFiNvrftTSjh+u0m:10BWWzGjI+idVfoP7pXlBZNT1TS0G
Malware Config
Signatures
Files
-
ca6449f82b25ef6e6f4e9944e14689694b90eaae5b4050ca4ad5b4f98b35484a.exe windows x86
4b12573f790541a16cc290968d1b35bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gsio
UninitDLL
DWG_SetPasswordCallbackFunc
InitDLL
gs_U2A
CommonPenSets_SetScale
?isTTF@CDwgExport@@QAE_NXZ
?GetIsDrawingRaster@CDwgExport@@QAE_NXZ
CommonPenSets_UsePenWidth
?endProgress@CDwgExport@@UAEXPBD@Z
?progress@CDwgExport@@UAEXPBDJ@Z
?beginProgress@CDwgExport@@UAEXPBDJJ@Z
?ShellCallback@CDwgExport@@UAEXW4ShellType@@@Z
?ExportOriginalScaleRaster@CDwgExport@@UAE_NXZ
?NeedRasterOutline@CDwgExport@@UAE_NXZ
?ExportAllObject@CDwgExport@@UAE_NXZ
?SupportLineWeight@CDwgExport@@UAE_NXZ
?GetBkColor@CDwgExport@@UAEKXZ
?SetDevice2WorldMatrix@CDwgExport@@UAEXQAY03$$CBN@Z
?NeedActualCoordinate@CDwgExport@@UAE_NXZ
?SupportTTF@CDwgExport@@UAE_NXZ
?CanDrawPolyPolygon@CDwgExport@@UAE_NXZ
?CanDrawArc@CDwgExport@@UAE_NXZ
g_U2A
gs_A2U
?DeleteDrawing@CDrawing@@SAXPAV1@@Z
?CreateDrawing@CDrawing@@SAPAV1@W4CDRAWING_SERVER@@@Z
DWG_SetAuditPrintErrorCallbackFunc
DWG_SetAuditPrintSummaryCallbackFunc
DWG_SetProgressCallBackFuns
?SaveRasterImage@@YAHPAUHBITMAP__@@HPBDJ@Z
CommonPenSets_Reset
CommonPenSets_SetDPI
?SetExportNoneDb@CDwgExport@@QAEX_N@Z
?GetExportNoneDb@CDwgExport@@QAE_NXZ
?SetOpt@CDwgExport@@QAEX_N@Z
?SetColorType@CDwgExport@@QAEXH@Z
?SetDpi@CDwgExport@@QAEXH@Z
llpp
DWG_SetBackgroundColor
DWG_SetFileAboutFunc
ppll
lppp
Run
GetPageSize
llppw
releaseImage
getImageColor
?DWG_SetFindFileCallbackFunc@@YAXP6A_NPBDPAD@Z@Z
createImage
DWG_SetSearchDirectories
??1CDwgExport@@UAE@XZ
??0CDwgExport@@QAE@XZ
?SetExtendMode@CDwgExport@@UAEX_N@Z
?GetExtendMode@CDwgExport@@UAE_NXZ
?BeginEntityDraw@CDwgExport@@UAE_NPBD00K00PBN_JW4EntityMask@@@Z
?EndEntityDraw@CDwgExport@@UAEXXZ
?TextParam@CDwgExport@@UAEXPBD0NNNN@Z
?PushClipPolygon@CDwgExport@@UAEXHPAUPointStruct@@@Z
?PopClipPolygon@CDwgExport@@UAEXXZ
?Raster@CDwgExport@@UAEXNNNNHHHHPAX0J0_NK@Z
?CanDrawRaster@CDwgExport@@UAE_NXZ
gsapp
?release@Document@GsApp@@SAXPAV12@@Z
?create@Document@GsApp@@SAPAV12@XZ
iow
FileDialogUnicode
gsui
?g_printPenSet@GsUI@@3VPrintPenSet@1@A
releaseGsUI
InitLanguageDLL
ReadLanguageTextDLL
showSetRotateViewDialog
showSetPointDialog
showLayerManager
showLTypeManager
showSetViewportDialog
loadPlotStyleDialogFromRegistry
drawWaterMarkToDC
?UpdatePenSetsToGsIO@PrintPenSet@GsUI@@QAEXXZ
drawWaterMark
releasePdfInfo
createPdfInfo
beginExportObject
showSetUnitDialog
releaseWaterMarkSetting
createWaterMarkSettingFromFile
createWaterMarkSetting
?loadByParam@PrintPenSet@GsUI@@QAE_NPBD@Z
showSetPenDialog
showNeededResource
hasNeededResource
showResetPageDlg
savePlotStyleToRegistry
showPlotStyleDialog
showPdfInfoDlg
getResetPageName
getResetPageCount
getResetPageUnit
getResetPageHeight
getResetPageWidth
releaseAdvancedExportParam
createAdvancedExportParam
readLayerOptionsFromRegistry
deleteLayerOptions
runLayerOptions
?init@PrintPenSet@GsUI@@QAEXXZ
initGsUI
gspdf
encryptDocument
kernel32
GlobalFindAtomA
GlobalGetAtomNameA
LocalFree
FormatMessageA
GetModuleFileNameW
InterlockedDecrement
MoveFileA
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
GetFileSize
DuplicateHandle
GetCurrentProcess
GetVolumeInformationA
GetFullPathNameA
FindNextFileA
GetCurrentDirectoryA
GlobalFlags
LocalAlloc
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GetCPInfo
GetOEMCP
GetModuleHandleW
GetFileAttributesA
GetFileSizeEx
GetFileTime
RtlUnwind
ExitProcess
GetSystemTimeAsFileTime
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitThread
CreateThread
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetStartupInfoA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
HeapSize
GetStdHandle
InitializeCriticalSectionAndSpinCount
lstrcmpW
IsValidCodePage
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
VirtualFree
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
CompareStringW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetDriveTypeA
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
ReadFile
GlobalReAlloc
SetFilePointer
GlobalHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetProcessHeap
HeapAlloc
HeapFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetLastError
SetLastError
GetVersionExA
MultiByteToWideChar
lstrcpynA
GetSystemTime
GetTickCount
Sleep
GetTimeZoneInformation
MulDiv
FindFirstFileW
FindNextFileW
FindClose
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
lstrlenA
FreeResource
GetProcAddress
LoadLibraryA
WritePrivateProfileStringA
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetModuleFileNameA
CompareStringA
InterlockedExchange
lstrcmpA
GetLocaleInfoA
SetErrorMode
CreateDirectoryW
CreateDirectoryA
FileTimeToSystemTime
FileTimeToLocalFileTime
HeapDestroy
ResumeThread
SuspendThread
CopyFileA
FreeLibrary
HeapCreate
IsDBCSLeadByteEx
lstrcpyA
FindFirstFileA
GetTempPathA
GetTempFileNameA
DeleteFileA
GlobalSize
WriteFile
CreateFileA
GetACP
CloseHandle
SetEndOfFile
user32
SetMenu
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
GetForegroundWindow
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
IsChild
WinHelpA
RegisterWindowMessageA
DefFrameProcA
DefMDIChildProcA
BringWindowToTop
TranslateMDISysAccel
TranslateAcceleratorA
GetWindowDC
BeginPaint
EndPaint
GetMenuStringA
SetRectEmpty
InsertMenuItemA
ReuseDDElParam
UnpackDDElParam
GetTabbedTextExtentA
IsZoomed
SetParent
CharUpperA
WindowFromPoint
CharNextA
SetRect
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
UnregisterClassA
GetDCEx
LockWindowUpdate
GetNextDlgTabItem
EndDialog
GetWindowTextLengthA
GetWindowTextA
SetFocus
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
SendDlgItemMessageA
GetDlgItemTextA
GetDlgItem
CheckRadioButton
CheckDlgButton
RegisterClipboardFormatA
GetWindow
SetWindowContextHelpId
MapDialogRect
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
ShowOwnedPopups
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
IsWindowVisible
GetKeyState
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
PostQuitMessage
CheckMenuItem
CreatePopupMenu
TrackPopupMenu
wsprintfA
DestroyMenu
TrackMouseEvent
GetSysColorBrush
GetFocus
DrawFocusRect
DrawFrameControl
GetDlgCtrlID
SetWindowPos
SetDlgItemTextW
GetActiveWindow
SendMessageW
CallWindowProcA
GetCapture
InvalidateRect
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
IntersectRect
PtInRect
IsRectEmpty
GetCursorPos
IsWindow
GetDC
ReleaseDC
DestroyCursor
GetSystemMenu
CreateMenu
DrawEdge
DrawStateA
FillRect
LoadBitmapA
OffsetRect
InflateRect
CopyRect
LoadImageA
MapVirtualKeyA
GetKeyNameTextA
SetMenuItemInfoA
CopyAcceleratorTableA
GetMenuItemInfoA
DestroyIcon
SystemParametersInfoA
GetDoubleClickTime
PostThreadMessageA
ClientToScreen
DrawMenuBar
RemoveMenu
InsertMenuA
GetMenuState
GetMenuItemID
GetMenuItemCount
DeleteMenu
PeekMessageA
DispatchMessageA
KillTimer
SetTimer
MessageBoxA
GetParent
SetCapture
ModifyMenuA
GetSubMenu
ReleaseCapture
SetWindowLongA
GetSystemMetrics
LoadCursorA
SetCursor
ScreenToClient
EnableWindow
SendMessageA
RedrawWindow
UpdateWindow
GetClientRect
GetWindowRect
GetSysColor
LoadMenuA
LoadAcceleratorsA
LoadIconA
PostMessageA
SetForegroundWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetWindowPlacement
DefWindowProcA
GetMenu
IsIconic
GetWindowPlacement
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
ValidateRect
DestroyWindow
AppendMenuA
gdi32
StretchBlt
Arc
CreatePen
CreateCompatibleBitmap
CreateRectRgn
Rectangle
GetTextExtentPoint32A
EnumFontFamiliesA
CreateDIBitmap
GetStockObject
CreatePatternBrush
CreateFontIndirectA
GetObjectA
GetTextMetricsA
CreateBitmap
Ellipse
PatBlt
BitBlt
PtVisible
RectVisible
Polygon
TextOutA
ExtTextOutA
EndPage
EndDoc
DeleteDC
CloseEnhMetaFile
CreateEnhMetaFileA
CreateCompatibleDC
GetDeviceCaps
CreateSolidBrush
SetROP2
SelectObject
DeleteObject
IntersectClipRect
DeleteEnhMetaFile
SetMapMode
GetWindowExtEx
SetWindowExtEx
StartDocA
GetMapMode
GetRgnBox
GetTextColor
GetBkColor
CreateFontA
GetCharWidthA
Escape
EnumFontFamiliesExA
CreatePalette
GetDIBits
GetPaletteEntries
RealizePalette
GetSystemPaletteEntries
SelectPalette
GdiFlush
SetStretchBltMode
SetDIBColorTable
CreateDIBSection
CreateHalftonePalette
GetDIBColorTable
CreateDCA
StretchDIBits
SetBkColor
DPtoLP
SetPaletteEntries
ResizePalette
SetSystemPaletteUse
GetNearestPaletteIndex
SetBkMode
GetCurrentObject
SetTextColor
CreateBrushIndirect
CreateHatchBrush
SetPixel
GetWinMetaFileBits
LineTo
MoveToEx
PolyPolygon
SelectClipPath
EndPath
BeginPath
SaveDC
RestoreDC
GetClipBox
DeleteMetaFile
StartPage
ExcludeClipRect
SelectClipRgn
GetViewportExtEx
GetPixel
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
CreateRectRgnIndirect
SetRectRgn
CombineRgn
GetTextAlign
CloseMetaFile
SetWindowOrgEx
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
advapi32
RegEnumKeyA
RegQueryValueA
RegOpenKeyA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegDeleteValueA
shell32
SHGetPathFromIDListA
ShellExecuteA
DragAcceptFiles
ShellExecuteExA
SHGetFileInfoA
SHGetMalloc
DragFinish
SHBrowseForFolderA
DragQueryFileA
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
comctl32
InitCommonControlsEx
ImageList_Add
ImageList_Create
shlwapi
PathFindFileNameA
PathRemoveFileSpecW
PathStripToRootA
PathFindExtensionA
PathIsUNCA
oledlg
ord8
ole32
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
CoGetClassObject
CoInitializeEx
CoCreateInstance
CoUninitialize
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
StgCreateDocfileOnILockBytes
oleaut32
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysStringLen
SysAllocStringByteLen
OleCreateFontIndirect
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
SysAllocString
VariantCopy
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 283KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 787KB - Virtual size: 787KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ