Static task
static1
Behavioral task
behavioral1
Sample
d87a200a26d07a64272e93fb3ae8f8d9e4d34bdfedb0cf7c685a6c97912e967f_payload.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d87a200a26d07a64272e93fb3ae8f8d9e4d34bdfedb0cf7c685a6c97912e967f_payload.exe
Resource
win10v2004-20221111-en
General
-
Target
d87a200a26d07a64272e93fb3ae8f8d9e4d34bdfedb0cf7c685a6c97912e967f_payload.bin
-
Size
244KB
-
MD5
df6c13edd8b1bde231ce5d53eaa6a67e
-
SHA1
da241fee02b2c665859d959ead4ba2f5054c9681
-
SHA256
251cb6c1b04d7ec54d9c81c68ae02851b0ebde0177c15315452245087f4f6616
-
SHA512
abfee3642d00911f357cfd2918f5e2ebde077d494b0e50f8ef2d0de74cb43687e0c500820bffe9f129b1e87983fbab476f84e2454e7af3f731d05f3ee4a7c3fe
-
SSDEEP
3072:Cs5HQeq/vgLewZUFYdmJ4s6pue54LzAeEpdB5awLiKHu5Bzf5sD/qQgVSges7nDo:m4UYkys+OLzAXdBUJBTSges7nDT
Malware Config
Signatures
Files
-
d87a200a26d07a64272e93fb3ae8f8d9e4d34bdfedb0cf7c685a6c97912e967f_payload.bin.exe windows x86
c2fb1c9c80219ccd23a8e9e47f82a58a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
CloseHandle
GetConsoleCP
GetEnvironmentStringsW
LoadLibraryExW
GetModuleFileNameW
WriteFile
FreeEnvironmentStringsW
RtlUnwind
GetStringTypeW
LCMapStringW
OutputDebugStringW
HeapSize
HeapReAlloc
GetProcessHeap
SetFilePointerEx
WriteConsoleW
FlushFileBuffers
GetCurrentProcess
GetVersion
GetCommandLineW
GetModuleHandleW
LoadLibraryW
GetStdHandle
GetFileType
LocalFree
LocalAlloc
CreateFileW
GetProcAddress
SetStdHandle
EncodePointer
DecodePointer
GetLastError
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
user32
IsDialogMessageW
LoadIconW
OffsetRect
GetSysColor
ChildWindowFromPoint
MessageBoxW
GetWindowRect
InvalidateRect
GetSystemMetrics
GetDlgItemTextW
SetDlgItemTextW
DialogBoxParamW
CreateDialogParamW
MoveWindow
RegisterClassExW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SendMessageW
ShowWindow
gdi32
GetObjectW
SetTextColor
SetBkMode
SelectObject
GetStockObject
CreateFontIndirectW
EndPage
StartPage
EndDoc
StartDocW
GetDeviceCaps
SetMapMode
comdlg32
PrintDlgW
advapi32
LsaOpenPolicy
LsaClose
RegDeleteValueW
LogonUserW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegCreateKeyW
RegCloseKey
LsaStorePrivateData
shell32
CommandLineToArgvW
ShellExecuteW
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 124KB - Virtual size: 123KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE