Static task
static1
Behavioral task
behavioral1
Sample
e0bb5a472904ca23540b2e28bb8c21ed80e0cb1fd050246f719629bff4171d30.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e0bb5a472904ca23540b2e28bb8c21ed80e0cb1fd050246f719629bff4171d30.exe
Resource
win10v2004-20220812-en
General
-
Target
e0bb5a472904ca23540b2e28bb8c21ed80e0cb1fd050246f719629bff4171d30
-
Size
3.8MB
-
MD5
9151f3b224c5da81802465b8c32ca6ae
-
SHA1
45c35bd85d6a0d9841b4f7d694fbe8a99b9fc94e
-
SHA256
e0bb5a472904ca23540b2e28bb8c21ed80e0cb1fd050246f719629bff4171d30
-
SHA512
623bd201960eb089518e4f55998d1d35a817b95a910458e8282bb751f6b6c4b86f07b3093f4a032c832993d18546f8337e2d948d937fa8d656876cc6b8f2a20c
-
SSDEEP
98304:1EgycVNLmp3t/MxFXx8rpUEHk7zanwVDSMPNMCEnMB1GPc11USC:7hVtk3t/8keEHkSwECNMtnHG1W
Malware Config
Signatures
Files
-
e0bb5a472904ca23540b2e28bb8c21ed80e0cb1fd050246f719629bff4171d30.exe windows x86
98500f342635219674f80bdd43b4372b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteExW
SHGetSpecialFolderPathW
ord92
CommandLineToArgvW
shlwapi
PathCombineW
PathAddBackslashW
SHDeleteKeyW
SHCopyKeyW
PathAppendW
msi
ord246
ord205
ord45
ord70
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
psapi
GetModuleBaseNameW
EnumProcessModules
EnumProcesses
secur32
GetUserNameExW
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
kernel32
VirtualFree
IsProcessorFeaturePresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
GetLastError
DeleteCriticalSection
CloseHandle
CreateEventW
FindResourceW
LoadResource
GetModuleFileNameW
FindResourceExW
SizeofResource
LockResource
FreeResource
LocalFree
GetExitCodeThread
Sleep
InitializeCriticalSection
CreateMutexW
GetTempPathW
GetCommandLineW
DeleteFileW
GetLocaleInfoW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
RaiseException
lstrlenW
SetEvent
WaitForSingleObject
FlushInstructionCache
GetCurrentProcess
ResumeThread
WideCharToMultiByte
GetModuleHandleW
SetLastError
InterlockedDecrement
OpenProcess
TerminateProcess
GetCurrentProcessId
FormatMessageW
VirtualAlloc
GetLocalTime
GetVersion
GetFileAttributesW
GetExitCodeProcess
CreateProcessW
CreateFileW
HeapFree
GetProcessHeap
GetModuleFileNameA
FlushFileBuffers
ReadFile
SetFilePointer
GetConsoleMode
GetConsoleCP
WriteFile
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCurrentDirectoryA
GetFullPathNameW
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapCreate
GetStringTypeW
LoadLibraryA
LCMapStringW
LCMapStringA
RtlUnwind
GetCPInfo
GetStartupInfoW
CreateThread
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FindFirstFileW
HeapDestroy
HeapReAlloc
WriteConsoleW
SetStdHandle
GetDriveTypeA
CreateFileA
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapSize
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetStringTypeA
GetModuleHandleA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalAlloc
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetProcAddress
HeapAlloc
MultiByteToWideChar
InterlockedExchange
InterlockedCompareExchange
InterlockedIncrement
GetDriveTypeW
user32
SetRectEmpty
SetRect
CopyRect
SystemParametersInfoW
LoadStringW
GetMonitorInfoW
MonitorFromWindow
GetDlgItem
GetParent
SetActiveWindow
EnableWindow
IsWindowEnabled
InvalidateRect
GetSystemMetrics
GetWindowRect
SetWindowPos
SetWindowTextW
SendMessageW
GetWindowLongW
IsWindow
MessageBoxW
EndDialog
GetActiveWindow
RegisterWindowMessageW
KillTimer
SetTimer
PostMessageW
SetWindowLongW
DialogBoxParamW
MonitorFromPoint
FindWindowW
SendMessageTimeoutW
EnumWindows
ExitWindowsEx
wsprintfW
UpdateWindow
IsRectEmpty
UnregisterClassA
advapi32
CheckTokenMembership
CreateWellKnownSid
RegCreateKeyExW
GetTokenInformation
FreeSid
ConvertSidToStringSidW
IsValidSid
LookupAccountNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumValueW
RegOpenKeyW
LookupAccountSidW
ConvertStringSidToSidW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetUserNameW
ole32
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoInitialize
oleaut32
VariantClear
VariantInit
SysAllocString
SysFreeString
Sections
.text Size: 195KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82.6MB - Virtual size: 82.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 79KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ