Static task
static1
Behavioral task
behavioral1
Sample
7f2281d9925cb243f49e12ba8af9e506b0281ea6794d45d0ee685a97a36859b9.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7f2281d9925cb243f49e12ba8af9e506b0281ea6794d45d0ee685a97a36859b9.exe
Resource
win10v2004-20220812-en
General
-
Target
7f2281d9925cb243f49e12ba8af9e506b0281ea6794d45d0ee685a97a36859b9
-
Size
5.1MB
-
MD5
30aad4a29f16629d945ce16f0662ab98
-
SHA1
01acddaff69439fd64722cb5421eb5bee8477f39
-
SHA256
7f2281d9925cb243f49e12ba8af9e506b0281ea6794d45d0ee685a97a36859b9
-
SHA512
08ab2e51ecdf6ba51b0c8d242479ec95083ccd74859b5fc61c2945488fedcbc40f92ad5ff5c23e7a205ea1b4a5239c95651f4e72d97706da21f7215118d45a68
-
SSDEEP
98304:5PDmhZXoEhB2wr/kDlvWt6CANTvyg8sGcn0vSEO4ZSEKAvEQDWbNm:EhZ4EhkwrMDhNDNTKu0vSp6Sh/p
Malware Config
Signatures
Files
-
7f2281d9925cb243f49e12ba8af9e506b0281ea6794d45d0ee685a97a36859b9.exe windows x86
15cf0cf84e92e4e9b28d23bac889ce58
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_SYSTEM
Imports
kernel32
OpenSemaphoreW
LoadLibraryA
GetModuleFileNameW
SetProcessShutdownParameters
GetFirmwareEnvironmentVariableW
FindResourceExW
EnumResourceTypesW
EndUpdateResourceA
GetProfileStringA
WritePrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetCurrentDirectoryW
CreateDirectoryExA
DefineDosDeviceA
GetFileAttributesExW
DeleteFileW
CopyFileW
CreateSemaphoreW
GetDefaultCommConfigA
GetDefaultCommConfigW
OpenJobObjectW
QueryInformationJobObject
ReleaseActCtx
GetCalendarInfoA
GetSystemDefaultLCID
ReadConsoleInputA
FillConsoleOutputAttribute
FreeConsole
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
lstrlenA
lstrcatA
lstrcpyA
lstrcmpW
CreateMailslotW
GetNamedPipeInfo
FindClose
CancelDeviceWakeupRequest
GetFileSizeEx
UnlockFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetExitCodeProcess
HeapAlloc
VirtualAlloc
GlobalUnlock
GlobalAlloc
IsBadStringPtrA
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
GetFileType
GetStringTypeW
DecodePointer
CloseHandle
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
LCMapStringW
SetStdHandle
GetProcessHeap
RaiseException
HeapSize
HeapReAlloc
GetConsoleCP
CreateFileW
user32
MessageBoxIndirectW
MapVirtualKeyW
IsIconic
GetClassInfoExA
GetMonitorInfoW
advapi32
LockServiceDatabase
ChangeServiceConfigW
RegQueryValueExW
RegQueryValueExA
RegQueryValueA
RegOpenKeyExW
RegCreateKeyA
RegCloseKey
CreateProcessAsUserW
GetFileSecurityA
GetSecurityDescriptorControl
AddAccessDeniedAce
DeleteAce
AreAllAccessesGranted
ObjectPrivilegeAuditAlarmA
AccessCheckAndAuditAlarmW
ClearEventLogW
RegisterServiceCtrlHandlerA
Sections
.text Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5.0MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 32.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jeya Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zulobo Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ