Static task
static1
Behavioral task
behavioral1
Sample
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe
Resource
win7-20220812-en
General
-
Target
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c
-
Size
196KB
-
MD5
8638468be18f63e7190d6855c51e9e50
-
SHA1
508ae3e49b8c8f3d82df2a6f132863a3d995a274
-
SHA256
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c
-
SHA512
5f8017f6a188ce898316741e700f77d4a76b0895fe556862d29837c29ae83ff50ec22ce19f23305854e77796400fdca3a76d81e01ee06ee03b05c515dca21134
-
SSDEEP
6144:mY3UEJ5yEMbOR/BV7mNwrTrP9TE4qyEyIQ568:3FtR7AwrTrhZEyR7
Malware Config
Signatures
Files
-
a00304a8020ef819c0bf7123fd264634f54f994bb0e4b8ab3e348290277dbb6c.exe windows x86
a1d5d29dd20348669078166f3a0267ae
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetDiskFreeSpaceW
FindCloseChangeNotification
FindNextChangeNotification
lstrcpyA
GetCurrentThreadId
GetProfileStringW
GetCurrentDirectoryA
GetLastError
CompareStringW
CompareStringA
GetStringTypeW
GetFileTime
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
WriteFile
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetCurrentProcessId
GetVolumeInformationW
InterlockedExchange
GetTimeFormatA
GetCPInfo
SetSystemPowerState
GetStartupInfoA
GetSystemTimeAsFileTime
GetStringTypeA
GetCommandLineW
GetEnvironmentStrings
SetEnvironmentVariableA
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
UnhandledExceptionFilter
GetCurrentProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapFree
HeapAlloc
GetModuleHandleA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
user32
ValidateRect
CreateMenu
EndDeferWindowPos
ExitWindowsEx
BeginDeferWindowPos
RegisterWindowMessageW
GetPropA
MapWindowPoints
PostMessageW
DestroyWindow
SendMessageA
InvalidateRect
DestroyMenu
BeginPaint
OpenClipboard
UnregisterHotKey
gdi32
MoveToEx
LineTo
ExcludeClipRect
PatBlt
GetTextExtentPoint32A
SetPixel
StretchBlt
SelectObject
SetBkMode
ole32
CLSIDFromString
CoInitialize
ws2_32
WSASocketA
WSACreateEvent
WSAConnect
WSAGetOverlappedResult
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 486KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ