??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Static task
static1
Behavioral task
behavioral1
Sample
ec1c44bdbe348423ce5b5ad558835e2501b15b9c434336766ed22950220ad2f6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ec1c44bdbe348423ce5b5ad558835e2501b15b9c434336766ed22950220ad2f6.exe
Resource
win10v2004-20220901-en
General
-
Target
ec1c44bdbe348423ce5b5ad558835e2501b15b9c434336766ed22950220ad2f6
-
Size
1.9MB
-
MD5
94958c52c7249a806ed62121a4007e67
-
SHA1
34a9dcdaedce3b08b99a868e4a23afe54e2094ff
-
SHA256
ec1c44bdbe348423ce5b5ad558835e2501b15b9c434336766ed22950220ad2f6
-
SHA512
4c4b4db9a08286106ce591490ecc11e6bfeaed18f4a7ca3985db7c12a6a6958854b96c57bf29c58b1311709a94b2d8e68276339f7cf50a27e41c6ebe420abeaf
-
SSDEEP
49152:Mv/vBjZwn4h24ZSNVEYC/Tx0A7V4YxBHos:E84hzSNVE1/f7yQBHo
Malware Config
Signatures
Files
-
ec1c44bdbe348423ce5b5ad558835e2501b15b9c434336766ed22950220ad2f6.exe windows x86
e84e28a99997d81c49b5ba7ec0c7eb1f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htonl
recv
htons
send
ntohl
shlwapi
PathFileExistsA
PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW
libxml2
xmlNewTextChild
xmlParseMemory
xmlDocGetRootElement
xmlFreeDoc
xmlNodeAddContent
xmlNewChild
xmlFree
xmlDocDumpMemory
wininet
InternetReadFile
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
sqlite3
sqlite3_exec
sqlite3_close
sqlite3_free
sqlite3_open
kernel32
LoadLibraryW
DeleteFileW
CreateDirectoryW
GetFileAttributesW
GetModuleFileNameW
GetCurrentDirectoryW
PeekNamedPipe
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CreateEventW
GetLastError
FormatMessageW
GetLocalTime
LocalFree
DeleteFileA
FindResourceExW
FindResourceW
LoadResource
SizeofResource
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
CreateFileA
GetFileSize
CreateMutexW
InitializeCriticalSection
OpenProcess
LeaveCriticalSection
TerminateProcess
ReadFile
CreateFileW
GetFileSizeEx
EnterCriticalSection
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
DeleteCriticalSection
FindFirstFileW
SetFilePointer
WriteFile
CopyFileW
GetTimeZoneInformation
FindClose
FindNextFileW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
SetFileAttributesW
RemoveDirectoryW
GlobalFree
Sleep
GlobalAlloc
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
RaiseException
SetFileTime
DosDateTimeToFileTime
SystemTimeToFileTime
GetFileType
InterlockedDecrement
InterlockedIncrement
MulDiv
FreeResource
ExitProcess
GetModuleHandleW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
GetPrivateProfileSectionNamesW
UnhandledExceptionFilter
GetStartupInfoA
CloseHandle
DuplicateHandle
CreatePipe
GetCurrentProcess
InterlockedCompareExchange
InterlockedExchange
LockResource
SetUnhandledExceptionFilter
user32
CharUpperW
GetDC
ReleaseDC
SetWindowRgn
IsIconic
SetForegroundWindow
GetParent
GetWindowLongW
MonitorFromWindow
SetWindowLongW
SetWindowPos
MapWindowPoints
GetMonitorInfoW
MoveWindow
GetWindowTextLengthW
PtInRect
GetWindowTextW
SendMessageW
CharLowerW
GetWindowRect
IntersectRect
InvalidateRect
ClientToScreen
ScreenToClient
OffsetRect
InflateRect
SetCursor
LoadCursorW
wvsprintfW
GetKeyState
SetTimer
KillTimer
IsWindow
SetCapture
ReleaseCapture
CharNextW
SetFocus
GetFocus
CreateWindowExW
GetCursorPos
UpdateLayeredWindow
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
GetWindow
DestroyWindow
TranslateMessage
DispatchMessageW
GetMessageW
DefWindowProcW
EnableWindow
LoadImageW
CallWindowProcW
GetPropW
SetPropW
RegisterClassW
RegisterClassExW
GetClassInfoExW
SetWindowTextW
DrawIconEx
FillRect
DrawTextW
CharPrevW
SetRect
CreateCaret
HideCaret
ShowCaret
SetCaretPos
GetSysColor
InvalidateRgn
CreateAcceleratorTableW
PostQuitMessage
IsZoomed
GetClientRect
FindWindowW
ShowWindow
MessageBoxW
PostMessageW
wsprintfW
GetSystemMetrics
gdi32
CreateRoundRectRgn
SaveDC
DeleteObject
BitBlt
GetObjectA
GetDeviceCaps
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
RoundRect
CreatePenIndirect
MoveToEx
LineTo
SetBkColor
ExtTextOutW
StretchBlt
CombineRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SelectClipRgn
SetBkMode
SetTextColor
CreateSolidBrush
DeleteDC
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetStretchBltMode
GetTextMetricsW
CreateFontIndirectW
GetObjectW
GetStockObject
CreatePen
SetWindowOrgEx
Rectangle
RestoreDC
CreateDIBSection
advapi32
RegOpenKeyA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
shell32
SHGetSpecialFolderPathW
ord165
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
ole32
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CoUninitialize
OleInitialize
OleSetContainedObject
CoCreateInstance
CoInitialize
OleUninitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
msvcp90
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@QAE@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?uncaught_exception@std@@YA_NXZ
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
msvcr90
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_memicmp
__RTDynamicCast
_stricmp
_itoa
_ultoa
memset
memmove
memcpy
_wcslwr
toupper
wcstoul
wcscpy_s
_CxxThrowException
iswalnum
wcsncmp
_CIsqrt
_initterm_e
_invalid_parameter_noinfo
_wcsicmp
wcsstr
??3@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
wcsncpy
??_V@YAXPAX@Z
??2@YAPAXI@Z
sprintf
fopen
fread
fseek
fclose
_purecall
wcschr
_beginthreadex
free
malloc
strchr
wcsrchr
wcsncpy_s
fwprintf
_swprintf
fflush
_wfopen
_vswprintf
_wsplitpath
_wtoi64
setlocale
memmove_s
memcpy_s
iswspace
wcstol
isdigit
_localtime64
_wtoi
strstr
atoi
vswprintf_s
strrchr
_gmtime64
_atoi64
_mkgmtime64
rewind
strncpy
fgets
strftime
ftell
_strdup
atol
_mktime64
fprintf
_time64
calloc
_snprintf
realloc
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
__CxxFrameHandler3
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
gdiplus
GdipCloneBrush
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDeleteFont
GdipDeleteGraphics
GdipDrawString
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipAlloc
GdipFree
GdipCreateLineBrushI
GdipDeleteBrush
GdiplusStartup
GdiplusShutdown
winmm
timeEndPeriod
timeKillEvent
timeSetEvent
comctl32
_TrackMouseEvent
ord17
Exports
Exports
Sections
.text Size: 867KB - Virtual size: 866KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 870KB - Virtual size: 869KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ