Static task
static1
Behavioral task
behavioral1
Sample
3a25a7e1c3edcbc23b6aad1492a7fa65cf082d1addf7058e4ea54ba447daebec.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3a25a7e1c3edcbc23b6aad1492a7fa65cf082d1addf7058e4ea54ba447daebec.exe
Resource
win10v2004-20221111-en
General
-
Target
3a25a7e1c3edcbc23b6aad1492a7fa65cf082d1addf7058e4ea54ba447daebec
-
Size
858KB
-
MD5
4305056882c5a8f1ddb39e2b12b5b368
-
SHA1
703a3e3897fb71ede96ce24dcefa631303ee3491
-
SHA256
3a25a7e1c3edcbc23b6aad1492a7fa65cf082d1addf7058e4ea54ba447daebec
-
SHA512
0882980a6c1e64c28363f1f76b09ad36a19f050a915c4ed78758b46b75ee96fe161fbb340e5b5decfc86db2a651b1c4cb3a1d37ce34979d328ed0fb8eba5e862
-
SSDEEP
12288:SGqKg1dGoDba5zWqpxGV7XiMR42Kg/aslrGHYe:ScKfDba5zWqpQVd42l/a86H7
Malware Config
Signatures
Files
-
3a25a7e1c3edcbc23b6aad1492a7fa65cf082d1addf7058e4ea54ba447daebec.exe windows x64
a0c7c98f60c2115a339f4eccd8a77a6a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ntdll
_stricmp
_wcsicmp
atoi
NtDelayExecution
RtlSetHeapInformation
_wcsupr
LdrSetMUICacheType
NtTerminateProcess
RtlUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
isspace
RtlUnicodeStringToAnsiString
RtlAllocateHeap
RtlFreeAnsiString
RtlNormalizeProcessParams
NtOpenFile
NtQueryInformationFile
NtFsControlFile
NtClose
NtDeviceIoControlFile
NtQueryVolumeInformationFile
NtCreateFile
NtReadFile
RtlRaiseStatus
NtWriteFile
RtlInitUnicodeString
memmove
NtSetThreadExecutionState
RtlRandomEx
_vsnprintf
_vsnwprintf
RtlMultiByteToUnicodeN
RtlOemToUnicodeN
RtlUnicodeToMultiByteN
RtlUnicodeToOemN
_wcslwr
wcschr
NtDisplayString
swprintf_s
NtCreateEvent
NtWaitForMultipleObjects
isprint
RtlDosPathNameToNtPathName_U
RtlFreeUnicodeString
NtOpenProcessToken
NtAdjustPrivilegesToken
NtShutdownSystem
NtQuerySystemTime
NtQuerySystemInformation
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
RtlExpandEnvironmentStrings_U
NtSetInformationFile
RtlValidRelativeSecurityDescriptor
RtlTimeToTimeFields
RtlSizeHeap
RtlFreeHeap
wcsncmp
RtlFindMessage
RtlInitAnsiStringEx
RtlAnsiStringToUnicodeString
RtlFormatMessage
qsort
NtQueryPerformanceCounter
RtlQueryRegistryValues
RtlWriteRegistryValue
NtSetVolumeInformationFile
RtlDecompressBuffer
DbgPrint
RtlComputeCrc32
RtlUpcaseUnicodeString
RtlSystemTimeToLocalTime
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlLengthSid
RtlCopySid
RtlAddAce
RtlCreateAcl
RtlQueryInformationAcl
RtlCreateSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlNewSecurityObject
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
RtlAddAccessAllowedAce
VerSetConditionMask
RtlVerifyVersionInfo
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlInitializeBitMap
RtlSetBits
RtlLookupElementGenericTable
RtlClearBits
RtlFindSetBits
RtlDeleteElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlNumberOfSetBits
DbgPrintEx
memcpy
memset
__C_specific_handler
memcmp
__chkstk
Sections
.text Size: 606KB - Virtual size: 606KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ