Static task
static1
Behavioral task
behavioral1
Sample
45d41a2b5dd2b6a32aaef8647029c161aa9d31252a68902db2537cc04481df95.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
45d41a2b5dd2b6a32aaef8647029c161aa9d31252a68902db2537cc04481df95.exe
Resource
win10v2004-20221111-en
General
-
Target
45d41a2b5dd2b6a32aaef8647029c161aa9d31252a68902db2537cc04481df95
-
Size
3.1MB
-
MD5
e85ac86977e74ebb7548461e09dcaa34
-
SHA1
4f5906246efbc3058047fa2fcb02741984a734d2
-
SHA256
45d41a2b5dd2b6a32aaef8647029c161aa9d31252a68902db2537cc04481df95
-
SHA512
5b28966201fe6733f1122a749330767f50dcdcb60d79a20079f1ad42f0bd00a7fe0340aef6993db0f9101d396442a223f8dbccdc72035595d8860e38e995347f
-
SSDEEP
49152:5zu7EijzaOPbt8UwGNhNmMr7zgglMMpLVMzwtt2LJ/4+XN76tHUbHpz+GGRF:pvijGOPpAafjpLV9qvGOQH
Malware Config
Signatures
Files
-
45d41a2b5dd2b6a32aaef8647029c161aa9d31252a68902db2537cc04481df95.exe windows x64
030e4561d6a8613f533fb21140ba4f7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Thread32First
Thread32Next
CreateDirectoryA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSizeEx
RemoveDirectoryA
SetEndOfFile
SetFilePointer
WriteFile
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetProcessTimes
SwitchToThread
GetTickCount
MapViewOfFileEx
UnmapViewOfFile
GetProcAddress
LocalFree
FormatMessageA
CreateSemaphoreA
CreateFileMappingA
OpenProcess
GetSystemTimeAsFileTime
FormatMessageW
WideCharToMultiByte
FindFirstFileW
FindNextFileW
GetModuleHandleW
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FlushFileBuffers
GetFileAttributesW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
RemoveDirectoryW
SetFilePointerEx
SetFileTime
DeviceIoControl
GetWindowsDirectoryW
CreateDirectoryExW
AreFileApisANSI
MultiByteToWideChar
FreeLibrary
LoadLibraryA
GetEnvironmentVariableA
SetCurrentDirectoryA
GetFileAttributesA
GetFullPathNameA
GetSystemTime
FileTimeToSystemTime
GetTimeZoneInformation
GetExitCodeProcess
CreateProcessA
GetStdHandle
GetConsoleMode
ExitThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
DeleteFileA
GetProfileStringA
ReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileType
CreateToolhelp32Snapshot
SystemTimeToTzSpecificLocalTime
GetCPInfo
CreateThread
FreeLibraryAndExitThread
RaiseException
GetConsoleCP
InitializeCriticalSectionAndSpinCount
TlsSetValue
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
GetStringTypeW
HeapReAlloc
HeapSize
IsValidCodePage
GetOEMCP
ReadConsoleW
GetModuleFileNameW
WriteConsoleW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
LocalAlloc
MapViewOfFile
OpenFileMappingA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
SetEvent
ResetEvent
CreateEventA
OpenEventA
WaitForMultipleObjects
ProcessIdToSessionId
IsBadWritePtr
OpenSemaphoreA
FlushInstructionCache
GetVersion
LockFile
UnlockFile
IsBadStringPtrA
IsBadStringPtrW
GetDriveTypeA
GetLogicalDrives
GetOverlappedResult
CreateEventW
EnumSystemFirmwareTables
GetSystemFirmwareTable
OpenMutexA
GetCommandLineA
FindFirstFileExW
RtlUnwind
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlPcToFileHeader
InitializeSListHead
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
DecodePointer
EncodePointer
WaitForSingleObjectEx
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
TlsFree
TlsGetValue
TlsAlloc
OpenThread
CloseHandle
GlobalFree
GlobalAlloc
GetTickCount64
Process32Next
Process32First
Sleep
RtlAddFunctionTable
GetModuleHandleExA
IsBadReadPtr
GetComputerNameA
GetNativeSystemInfo
GetSystemWindowsDirectoryA
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemInfo
SetLastError
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
VirtualProtect
GetVersionExA
SetPriorityClass
SetThreadPriority
GetCurrentThread
TerminateProcess
HeapFree
GetCurrentDirectoryA
SetConsoleCtrlHandler
GetACP
SystemTimeToFileTime
GetLocalTime
GetTempPathA
GetDiskFreeSpaceA
GetUserDefaultUILanguage
GetExitCodeThread
GetCurrentThreadId
DuplicateHandle
SetThreadContext
GetStartupInfoW
GetCurrentProcessId
GetCurrentProcess
GetProcessHeap
HeapAlloc
PeekNamedPipe
HeapCreate
GetCommandLineW
user32
LoadStringA
wsprintfA
DrawMenuBar
AppendMenuA
DispatchMessageA
MessageBoxW
MessageBoxA
CharLowerBuffA
CharUpperBuffA
GetSystemMenu
TranslateMessage
PeekMessageA
CallMsgFilterA
EnumDisplayDevicesA
shell32
ShellExecuteExA
advapi32
RegEnumValueA
SetSecurityDescriptorDacl
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
QueryServiceStatusEx
StartServiceA
QueryServiceStatus
QueryServiceConfigA
OpenServiceA
OpenSCManagerA
CloseServiceHandle
RegFlushKey
RegDeleteKeyA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA
GetUserNameA
InitializeSecurityDescriptor
psapi
GetModuleFileNameExA
powrprof
PowerReadFriendlyName
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
ws2_32
gethostbyname
gethostbyaddr
sendto
recvfrom
inet_addr
bind
getpeername
WSAGetLastError
socket
shutdown
gethostname
send
select
recv
getsockopt
ioctlsocket
connect
closesocket
accept
__WSAFDIsSet
inet_ntoa
htons
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
setsockopt
winhttp
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCloseHandle
WinHttpGetDefaultProxyConfiguration
crypt32
CertGetNameStringW
CertGetNameStringA
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CryptQueryObject
wintrust
WinVerifyTrust
Sections
__wibu00 Size: 44KB - Virtual size: 44KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
__wibu01 Size: 452KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu02 Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu03 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu04 Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu05 Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu06 Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
__wibu07 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
__wibu08 Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu09 Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu0a Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu0b Size: 105KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu0c Size: 209KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE