Static task
static1
Behavioral task
behavioral1
Sample
0CBF2FE8AF22400E10D8715DEA4C550D6AFB75E3096B4.exe
Resource
win7-20221111-en
General
-
Target
0CBF2FE8AF22400E10D8715DEA4C550D6AFB75E3096B4.exe
-
Size
831KB
-
MD5
4571fb11c79d58c069499b08fcc9fbd3
-
SHA1
5ccbbf01bd8eb3617cb3820eb037458c1be0d3e8
-
SHA256
0cbf2fe8af22400e10d8715dea4c550d6afb75e3096b435db76eda0815719c98
-
SHA512
f4cac02fc8ec567c11911b478f4381bdac0d07fdf20ab92a0b4207a9e73c375bbb8a1f982b3d4ea82d7c73e73f5b28e9c5f4b44e18ffd2828b3bd66a0953507d
-
SSDEEP
24576:090ArGKlAbM+7tsBdP6BumiLWG+n3MQIayV88M8Rh9Ct:FgeB3ER88hhUt
Malware Config
Signatures
Files
-
0CBF2FE8AF22400E10D8715DEA4C550D6AFB75E3096B4.exe.exe windows x86
38ea6f39f66a13952d0df81911d291fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
GetFileSize
WriteFile
WideCharToMultiByte
ReadFile
CreateFileW
MultiByteToWideChar
CloseHandle
OpenProcess
TerminateProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
LoadLibraryW
lstrcpyW
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
RemoveDirectoryA
HeapCreate
HeapValidate
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
GetCurrentProcess
IsWow64Process
GlobalAlloc
GlobalFree
FileTimeToSystemTime
GetLocalTime
GetFileInformationByHandle
WriteConsoleW
SetEnvironmentVariableW
SetStdHandle
SetEnvironmentVariableA
CompareStringW
GetCurrentProcessId
DeleteFileW
FindNextFileW
lstrcatW
GetModuleFileNameA
LocalAlloc
FindClose
Sleep
CopyFileA
SetCurrentDirectoryA
CreateDirectoryA
lstrcmpW
GetFileAttributesW
lstrlenA
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
GetFileAttributesA
FindFirstFileW
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
ExitProcess
GetFileType
GetStdHandle
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetLastError
GetModuleHandleW
TlsFree
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InterlockedExchange
ExitThread
CreateThread
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
user32
CharToOemW
GetDesktopWindow
EnumDisplayDevicesW
ReleaseDC
gdi32
StretchBlt
GetDIBits
CreateDCW
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
GetDeviceCaps
advapi32
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteA
ShellExecuteW
ole32
CoUninitialize
CoCreateInstance
psapi
GetModuleFileNameExW
EnumProcessModules
GetModuleBaseNameW
crypt32
CryptUnprotectData
wininet
HttpAddRequestHeadersW
HttpQueryInfoW
HttpOpenRequestW
InternetOpenW
HttpSendRequestW
InternetOpenUrlW
InternetSetFilePointer
InternetCloseHandle
InternetReadFile
InternetConnectW
InternetSetOptionW
shlwapi
PathMatchSpecW
Sections
.text Size: 719KB - Virtual size: 719KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ