Static task
static1
Behavioral task
behavioral1
Sample
0311ee1452a19b97e626d24751375652.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
0311ee1452a19b97e626d24751375652.exe
Resource
win10v2004-20220901-en
General
-
Target
0311ee1452a19b97e626d24751375652.bin
-
Size
231KB
-
MD5
0311ee1452a19b97e626d24751375652
-
SHA1
0cdba249932f0acc76c48f30f852efd340bc2888
-
SHA256
2effae66a1056df5861ff029219936126df4af02e2033e82a869126e043ebdd7
-
SHA512
3bf0b1a266556cc422f2d348b577793ff2e26fc0b248d6035f5f1397fc1eb05313d8a2931c1e5851059bdd9567c514feb0f200927eb89fc9397815769a602854
-
SSDEEP
6144:9GtKBM4Ai4MWld6TAZ4anmU93u7BG0dKw65yQW8hyYmFrF:jTAi4tlcTAZ4anmU9eOqt9F
Malware Config
Signatures
Files
-
0311ee1452a19b97e626d24751375652.bin.exe windows x86
a37ff327f8d48e8a4d2f757e1b6e70bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
secur32
AcquireCredentialsHandleW
QuerySecurityContextToken
AcceptSecurityContext
kernel32
CloseHandle
ReadFile
lstrcpyA
WaitForSingleObject
Sleep
CreateProcessW
ReleaseMutex
GetLastError
GetModuleFileNameW
CreateMutexW
lstrcatW
GetStartupInfoW
CreatePipe
ExitProcess
GetCurrentProcess
CreateThread
GetProcessHeap
HeapAlloc
WriteConsoleW
LoadLibraryW
lstrlenW
CreateTimerQueue
SetFilePointerEx
SetStdHandle
GetStringTypeW
LCMapStringW
HeapReAlloc
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
DuplicateHandle
VirtualProtect
VirtualFree
VirtualAlloc
GetVersionExW
GetModuleHandleA
FreeLibraryAndExitThread
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetCommandLineW
RaiseException
RtlUnwind
DeleteCriticalSection
CreateFileW
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetModuleHandleW
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetStdHandle
WriteFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TerminateProcess
GetTickCount
CreateSemaphoreW
HeapSize
GetCurrentThread
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
GetConsoleCP
GetConsoleMode
FreeLibrary
LoadLibraryExW
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
GetThreadTimes
advapi32
CreateProcessWithTokenW
DuplicateTokenEx
PrivilegeCheck
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
LookupAccountSidW
CopySid
GetLengthSid
GetTokenInformation
CreateProcessAsUserW
ole32
CoTaskMemAlloc
CLSIDFromString
StgCreateDocfileOnILockBytes
CoGetInstanceFromIStorage
CoInitialize
CreateILockBytesOnHGlobal
ws2_32
listen
bind
freeaddrinfo
setsockopt
shutdown
recv
send
__WSAFDIsSet
connect
WSAGetLastError
socket
WSACleanup
getaddrinfo
WSAStartup
accept
select
inet_addr
htons
closesocket
Sections
.text Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ