Static task
static1
Behavioral task
behavioral1
Sample
eb9d92d5d7e04ca0e58529fd917ad3b5b8f2912fe9b85fa81cb65c5f0249e814.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eb9d92d5d7e04ca0e58529fd917ad3b5b8f2912fe9b85fa81cb65c5f0249e814.exe
Resource
win10v2004-20220901-en
General
-
Target
eb9d92d5d7e04ca0e58529fd917ad3b5b8f2912fe9b85fa81cb65c5f0249e814
-
Size
748KB
-
MD5
c84a11ccdc909ec391d7dafff4025800
-
SHA1
94df66ea47d1d33c61c05a45c93987d5c5054692
-
SHA256
eb9d92d5d7e04ca0e58529fd917ad3b5b8f2912fe9b85fa81cb65c5f0249e814
-
SHA512
a70c2ad3851a05b747e4747b70bc49b814a2453576edaec3d0abfbd6c83a6a34dcad3de92609bbe0099956d6a3a06b02d002a47b602bc7f349d19696351f9391
-
SSDEEP
12288:E7AsgueABbtBlRhcbwbescayfNWFpZBWb9/gWSsydg1CnKrx2EbScxvhrzWpkj3D:Evl2wZvLZYb5gWSJdErx2E2cNhrqp23D
Malware Config
Signatures
Files
-
eb9d92d5d7e04ca0e58529fd917ad3b5b8f2912fe9b85fa81cb65c5f0249e814.exe windows x86
621caad6a9f788be53e575f89e9d77d7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
libelcbaseui
??0CElcStatic@@QAE@XZ
??1CElcStatic@@UAE@XZ
?SetTextColor@CElcStatic@@QAEXKH@Z
ElcSetString3
?LoadSkin@CElcBaseBar@@QAEHPB_WH@Z
?AddSeparator@CElcBaseBar@@QAEXIIH@Z
?SetBarBorder@CElcBaseBar@@QAEXI@Z
??0CElcToolBarEx@@QAE@XZ
?AddButton@CElcToolBarEx@@QAEHIIPB_W0HI@Z
??0CElcReportListCtrl@@QAE@XZ
?EnableButton@CElcToolBarEx@@QAEHIH@Z
?SetButtonText@CElcToolBarEx@@QAEHIPB_W@Z
?InsertColumn@CElcReportListCtrl@@QAEHHPB_WHHH@Z
?SetButtonImage@CElcToolBarEx@@QAEHIIPB_WW4ELC_BUTTON_ICON_TYPE@@@Z
?InsertItem@CElcReportListCtrl@@QAEHHPB_W@Z
?SetItemTextColor@CElcReportListCtrl@@QAEXHK@Z
?GetItemTextColor@CElcReportListCtrl@@QAEKH@Z
?SetItemData@CElcReportListCtrl@@QAEHHK@Z
?GetItemData@CElcReportListCtrl@@QBEKH@Z
??1CElcToolBarEx@@UAE@XZ
??1CElcReportListCtrl@@UAE@XZ
ElcGetString
libnet30
?IPAddrToString@CSocketUtils@@SAHKPA_W@Z
mfc80u
ord4238
ord1646
ord354
ord5148
ord1590
ord577
ord1899
ord5196
ord3435
ord5067
ord6271
ord4179
ord1079
ord3397
ord4716
ord4276
ord283
ord280
ord5558
ord1591
ord293
ord5956
ord5231
ord5229
ord920
ord925
ord774
ord265
ord6282
ord1146
ord5316
ord5913
ord5298
ord266
ord1178
ord3249
ord1172
ord5283
ord5657
ord1175
ord1176
ord762
ord1182
ord5101
ord2799
ord5914
ord5301
ord421
ord6293
ord5327
ord2311
ord1908
ord2260
ord1049
ord4032
ord3677
ord757
ord4008
ord5222
ord4562
ord1911
ord5562
ord2925
ord2239
ord5220
ord3824
ord3942
ord4535
ord1542
ord2832
ord6272
ord5209
ord4475
ord3795
ord4255
ord6274
ord4320
ord2054
ord2009
ord5579
ord3800
ord1007
ord5096
ord6215
ord5378
ord3826
ord5971
ord566
ord3327
ord6086
ord4119
ord4094
ord2085
ord6140
ord1274
ord5869
ord2365
ord1946
ord1661
ord3238
ord4743
ord3176
ord4026
ord1058
ord3082
ord2012
ord709
ord630
ord501
ord385
ord1894
ord6721
ord5911
ord1393
ord5210
ord1785
ord3752
ord6061
ord572
ord2977
ord4237
ord748
ord2089
ord3875
ord1641
ord1585
ord3318
ord3157
ord1781
ord1925
ord1271
ord3204
ord1772
ord1118
ord1871
ord5226
ord1647
ord1198
ord764
ord929
ord927
ord931
ord2384
ord2404
ord2388
ord2394
ord1562
ord2392
ord2390
ord2407
ord2402
ord2386
ord2409
ord2397
ord2531
ord2379
ord2725
ord2381
ord2829
ord1840
ord2399
ord4301
ord2169
ord2708
ord2856
ord2534
ord2163
ord2640
ord1765
ord1513
ord2527
ord6273
ord3712
ord3796
ord3713
ord6275
ord3703
ord6232
ord2638
ord3943
ord3635
ord5178
ord6720
ord3339
ord5908
ord1883
ord4961
ord1392
ord899
ord4256
ord6063
ord5199
ord605
ord4206
ord4729
ord1611
ord860
ord4884
ord1608
ord2651
ord776
ord4574
ord4480
ord1353
ord2011
ord3940
ord5171
ord1662
ord1955
msvcr80
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_getch
signal
fputs
strtoul
_gmtime64
isupper
strerror
_stat64i32
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
strncpy
getenv
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_errno
fgets
feof
_fileno
_setmode
fflush
fwrite
isxdigit
memchr
qsort
realloc
strcmp
vfprintf
_vsnprintf
wcsstr
strncmp
isalpha
tolower
isspace
memmove
memcpy
__CxxFrameHandler3
_vsnprintf_s
fputc
ferror
memset
_wfopen_s
fopen_s
sprintf
fclose
ftell
sprintf_s
fseek
fread
_localtime64
fopen
isdigit
_strnicmp
isalnum
_finite
strchr
malloc
modf
abort
_purecall
_snprintf
fprintf
__iob_func
sscanf
_localtime64_s
_time64
wcsftime
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
_invalid_parameter_noinfo
_waccess
wcsncpy
_recalloc
atoi
strstr
calloc
memmove_s
memcpy_s
free
_wcsicmp
_wsplitpath
_wmakepath
??0exception@std@@QAE@ABQBD@Z
_CxxThrowException
kernel32
MultiByteToWideChar
GlobalMemoryStatus
FreeLibrary
LoadLibraryA
FlushConsoleInputBuffer
GetTickCount
GetLastError
EnterCriticalSection
GetModuleFileNameW
GetPrivateProfileStringW
GetThreadLocale
GetLocaleInfoA
GetACP
LeaveCriticalSection
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
SetLastError
GetStdHandle
GetFileType
GetVersion
lstrcpynW
OutputDebugStringA
CloseHandle
CreateProcessW
SetUnhandledExceptionFilter
WriteProcessMemory
GetCurrentProcess
TerminateProcess
GetProcAddress
CreateMutexW
LoadLibraryW
VirtualProtect
GetCommandLineW
GetCurrentThreadId
CreateDirectoryW
WideCharToMultiByte
OutputDebugStringW
InitializeCriticalSection
lstrlenA
CreateThread
DeleteCriticalSection
GetVersionExA
user32
EnableWindow
GetProcessDefaultLayout
PostMessageW
FindWindowW
ModifyMenuW
LoadIconW
CreatePopupMenu
GetClientRect
MessageBoxW
SetTimer
KillTimer
EnableMenuItem
DrawIcon
GetSubMenu
GetMessagePos
DestroyIcon
GetSystemMenu
GetSystemMetrics
SendMessageW
SetForegroundWindow
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
AppendMenuW
CopyRect
GetUserObjectInformationW
IsIconic
LoadMenuW
GetCursorPos
gdi32
CreateSolidBrush
advapi32
DeregisterEventSource
RegCloseKey
RegisterEventSourceA
ReportEventA
RegCreateKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyW
shell32
Shell_NotifyIconW
SHGetSpecialFolderPathW
comctl32
InitCommonControlsEx
msvcp80
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
ws2_32
select
inet_ntoa
ioctlsocket
WSAStartup
WSAGetLastError
gethostname
WSACleanup
recv
gethostbyname
connect
getservbyname
__WSAFDIsSet
socket
htons
send
closesocket
getpeername
ntohl
inet_addr
WSASetLastError
shutdown
htonl
Sections
.text Size: 484KB - Virtual size: 482KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 176KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ