Static task
static1
Behavioral task
behavioral1
Sample
a3690d5b5fe55071dded1d75c37d61196bfb880e1315b40f310d4d1251798535.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a3690d5b5fe55071dded1d75c37d61196bfb880e1315b40f310d4d1251798535.exe
Resource
win10v2004-20230220-en
General
-
Target
a3690d5b5fe55071dded1d75c37d61196bfb880e1315b40f310d4d1251798535
-
Size
290KB
-
MD5
0c8f65028d9719e286dedc53aa10aaea
-
SHA1
d7c8dd9f8c9dee608f2497845adc0ab963685e3a
-
SHA256
a3690d5b5fe55071dded1d75c37d61196bfb880e1315b40f310d4d1251798535
-
SHA512
26f257cb2c133d74007ba132c5182dc2e30972e43f30f44debb63680bb17856df4e007706913f571027f1e392439279b81b8af42b99b5b8336a0752621f22f21
-
SSDEEP
6144:291IKiKIkuqzUb3ExpQ6fTAWfDOOPEPQF:XkJzapcThfDREP
Malware Config
Signatures
Files
-
a3690d5b5fe55071dded1d75c37d61196bfb880e1315b40f310d4d1251798535.exe windows x86
b9c2c3273a311e3ac6afe2e19f3a6d6d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90ud
ord5071
ord7299
ord8730
ord4493
ord1968
ord7562
ord2782
ord2385
ord2384
ord2306
ord7590
ord5987
ord2336
ord2339
ord8780
ord4659
ord2250
ord4348
ord6712
ord6466
ord3033
ord1769
ord4899
ord406
ord5487
ord2166
ord753
ord3686
ord7954
ord943
ord2251
ord2410
ord2411
ord292
ord5779
ord6816
ord7203
ord7029
ord1408
ord1663
ord1453
ord6407
ord7569
ord2849
ord8902
ord440
ord9369
ord4734
ord2863
ord7644
ord439
ord7448
ord9378
ord2112
ord778
ord442
ord6142
ord3402
ord5945
ord5933
ord4160
ord781
ord4426
ord286
ord701
ord3377
ord302
ord6271
ord961
ord6212
ord8111
ord1133
ord5948
ord6270
ord3462
ord950
ord1641
ord1637
ord1635
ord6164
ord6121
ord9366
ord5738
ord9368
ord6537
ord2906
ord2861
ord8169
ord5747
ord1389
ord7462
ord9297
ord7868
ord5781
ord5739
ord9367
ord2209
ord3243
ord3256
ord3566
ord3548
ord3546
ord3564
ord3576
ord3553
ord3569
ord3574
ord3557
ord3559
ord3561
ord3555
ord3571
ord3551
ord1229
ord1225
ord1227
ord1223
ord1218
ord2864
ord7642
ord8868
ord2307
ord6487
ord1476
ord5062
ord3950
ord8633
ord1733
ord7015
ord5197
ord1900
ord3245
ord7593
ord6377
ord9365
ord7420
ord2701
ord7538
ord6446
ord779
ord2032
ord2716
ord4474
ord7626
ord7628
ord3337
ord5991
ord6804
ord7638
ord7603
ord8152
ord3804
ord4122
ord4320
ord6518
ord4097
ord4323
ord3807
ord3996
ord3796
ord5598
ord5599
ord5589
ord3994
ord5994
ord6707
ord6465
ord3140
ord1857
ord8287
ord5054
ord690
ord930
ord6772
ord5530
ord267
ord6158
ord5199
ord7280
ord7044
ord872
ord2942
ord3761
ord8266
ord598
ord5990
ord3389
ord935
ord1503
msvcr90d
_snprintf_s
_errno
_CrtDbgReport
strcpy
_vsnprintf_s
_vsnwprintf_s
_snwprintf_s
wcscpy_s
wcsncpy_s
strcpy_s
_time64
_mktime64
_gmtime64_s
memcmp
_wcsicmp
memmove_s
wcslen
_stricmp
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_unlock
_except_handler4_common
_CRT_RTC_INITW
_initterm_e
_initterm
_CrtSetCheckCount
_wcmdln
exit
_cexit
_XcptFilter
_exit
__wgetmainargs
_amsg_exit
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
??_V@YAXPAX@Z
_recalloc
calloc
_localtime64_s
wcsftime
setlocale
printf
__CxxFrameHandler3
tolower
_strtoi64
?_open@@YAHPBDHH@Z
_telli64
_read
_lseeki64
_close
_filelengthi64
_invalid_parameter
_CrtDbgReportW
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
memset
_resetstkoflw
memcpy_s
malloc
free
abs
wcscpy
wcscmp
realloc
wprintf
__dllonexit
kernel32
OpenEventA
SetEvent
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
lstrcmpW
GetLastError
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
FindVolumeClose
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindFirstVolumeW
GetLogicalDriveStringsW
CloseHandle
DeviceIoControl
GetVolumeInformationByHandleW
CreateFileW
GetDiskFreeSpaceW
GetFileAttributesW
GetProcAddress
LoadLibraryW
lstrlenW
OutputDebugStringA
InterlockedCompareExchange
GetSystemInfo
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
IsDebuggerPresent
RaiseException
DebugBreak
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
LoadLibraryA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetProcessHeap
GetModuleFileNameW
VirtualQuery
FreeLibrary
OutputDebugStringW
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
MulDiv
VirtualAlloc
CreateFileMappingA
UnmapViewOfFile
QueueUserWorkItem
GetCurrentThread
OpenFileMappingA
InterlockedIncrement
InterlockedDecrement
GetStartupInfoW
MapViewOfFile
Sleep
user32
InflateRect
IntersectRect
UnionRect
EqualRect
SetRect
SubtractRect
SetRectEmpty
PtInRect
CopyRect
OffsetRect
IsRectEmpty
GetSystemMetrics
GetDC
DestroyIcon
GetIconInfo
MessageBeep
gdi32
DeleteDC
CreateCompatibleDC
SelectObject
SetDIBColorTable
CreateDIBSection
DeleteObject
GetObjectW
advapi32
RevertToSelf
SetThreadToken
OpenEventLogW
ReadEventLogW
CloseEventLog
OpenThreadToken
shell32
ord165
ExtractIconExW
SHGetFileInfoW
comctl32
InitCommonControlsEx
shlwapi
PathFileExistsW
PathGetArgsW
ole32
CreateStreamOnHGlobal
OleInitialize
oleaut32
SysFreeString
OleCreatePictureIndirect
msvcp90d
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@U_Has_debug_it@01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Debug_message@std@@YAXPB_W0I@Z
??1_Container_base_secure@std@@QAE@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0_Container_base_secure@std@@QAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?length@?$char_traits@D@std@@SAIPBD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
gdiplus
GdipSaveImageToFile
GdipSaveGraphics
GdipGetDC
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipFree
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusShutdown
GdipCreateBitmapFromHICON
winmm
mciGetErrorStringW
mciSendCommandW
opengl32
glEnd
glGetString
glBegin
wglCreateContext
ws2_32
WSACleanup
WSAStartup
htons
bind
send
socket
WSAGetLastError
listen
accept
inet_ntoa
closesocket
recv
Sections
.textbss Size: - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 190KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ