Static task
static1
Behavioral task
behavioral1
Sample
22c86258a91379f6985cb3e54134136bcb9cce472810097af06005fd34a3cea1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
22c86258a91379f6985cb3e54134136bcb9cce472810097af06005fd34a3cea1.exe
Resource
win10v2004-20230220-en
General
-
Target
22c86258a91379f6985cb3e54134136bcb9cce472810097af06005fd34a3cea1
-
Size
886KB
-
MD5
a0c54f8886a35a3e9262f138d7c3c05f
-
SHA1
dfc1d246cc69b1189b43c04cb06d24f3fe1fefb4
-
SHA256
22c86258a91379f6985cb3e54134136bcb9cce472810097af06005fd34a3cea1
-
SHA512
fca80edf7a048e0fd5141c9b5e34148a7bc13de23b7a27f2585e94a8c56f5e88b3b678635ae96643eecc0228347ec46493ea689a90b3b41b182a58c891714ef1
-
SSDEEP
12288:hoM7lMp3wytKnRCh6/vQhgOfOPs4pTfrn3PbV3B8ooaUStACqt5V9/c9msV:nI3wytsCh6/vKgE4pjT/NB7qlrsV
Malware Config
Signatures
Files
-
22c86258a91379f6985cb3e54134136bcb9cce472810097af06005fd34a3cea1.exe windows x86
9d06cdfc24d2ef716a897f96337fb88d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90u
ord3015
ord3018
ord4322
ord2501
ord2490
ord665
ord406
ord6095
ord3622
ord525
ord4410
ord4541
ord6780
ord1047
ord1688
ord6013
ord5938
ord2676
ord4967
ord4043
ord589
ord794
ord4211
ord1098
ord6482
ord1220
ord2447
ord3670
ord4905
ord3115
ord6018
ord5663
ord5680
ord4996
ord4347
ord5676
ord5674
ord2087
ord4213
ord5830
ord6741
ord5548
ord1048
ord4179
ord6035
ord2206
ord2251
ord4747
ord6803
ord4173
ord6801
ord4423
ord4448
ord4519
ord2479
ord1329
ord2904
ord4815
ord5078
ord4516
ord1486
ord1144
ord3515
ord3220
ord1607
ord2695
ord582
ord784
ord3500
ord814
ord6686
ord580
ord782
ord405
ord664
ord3360
ord2209
ord3361
ord3338
ord3953
ord1145
ord443
ord695
ord901
ord5915
ord4473
ord3566
ord376
ord5387
ord277
ord3630
ord3589
ord5767
ord1243
ord6811
ord5778
ord6822
ord1325
ord6169
ord2810
ord2469
ord2263
ord436
ord1063
ord1088
ord613
ord337
ord6065
ord1533
ord3488
ord333
ord790
ord586
ord611
ord3489
ord4652
ord1665
ord3768
ord4442
ord6659
ord4405
ord1318
ord2327
ord316
ord601
ord899
ord1315
ord938
ord1603
ord2478
ord5979
ord4518
ord285
ord289
ord288
ord6164
ord1599
ord809
ord935
ord936
ord2702
ord5851
ord2326
ord2694
ord1143
ord2084
ord266
ord265
ord6063
ord6060
ord4579
ord6569
ord6101
ord5974
ord6040
ord5863
ord5850
ord6418
ord6174
ord3513
ord5322
ord6547
ord6183
ord6311
ord2597
ord6577
ord1108
ord744
ord524
ord4044
ord2470
ord6574
ord6566
ord6572
ord6372
ord6091
ord2758
ord6513
ord5893
ord3856
ord757
ord553
ord6187
ord2901
ord4741
ord6275
ord6579
ord4000
ord1938
ord778
ord595
ord3674
ord3688
ord3922
ord4351
ord1255
ord799
ord1137
ord1254
ord1272
ord5939
ord5867
ord4494
ord4490
ord6699
ord6693
ord6691
ord933
ord3235
ord4056
ord1176
ord1553
ord6171
ord290
ord4131
ord3637
ord6094
ord4512
ord2282
ord3577
ord2130
ord587
ord792
ord686
ord585
ord788
ord1723
ord4451
ord3149
ord6172
ord2596
ord3231
ord1357
ord1166
ord2146
ord3741
ord3933
ord797
ord3654
ord4681
ord3286
ord5664
ord4660
ord1493
ord6411
ord3355
ord1719
ord2283
ord639
ord374
ord286
ord5632
ord4631
ord5167
ord5324
ord2208
ord1810
ord1809
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord3743
ord5154
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord1792
ord1791
ord1727
ord5650
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord6666
ord6687
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4682
ord811
ord6604
ord4702
ord5653
ord3217
ord2069
ord4543
ord2139
ord4774
ord1675
ord5008
ord4527
ord2593
ord6096
ord1354
ord1353
ord2097
ord2592
ord3486
ord614
ord338
ord3773
ord6529
ord1250
ord1248
ord296
ord600
ord813
ord280
ord3794
ord3537
ord1183
ord2537
ord2106
ord3543
ord367
ord636
ord801
msvcr90
__CxxFrameHandler3
memcpy
__RTDynamicCast
memset
_CxxThrowException
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_beginthreadex
wcstoul
rand
wcsstr
wcscpy_s
printf
_vsnwprintf_s
fclose
fflush
fwprintf_s
_wfopen_s
_swprintf
_ultow_s
ceil
_localtime64_s
_wtof
exit
_msize
_purecall
vswprintf_s
_set_errno
_get_errno
_wtol
_time64
_wtoi64
realloc
_gcvt_s
_fpclass
_HUGE
iswspace
_ui64toa_s
_i64toa_s
isspace
_itoa_s
wcsncmp
wcstod
wcstol
_wcstoui64
_wcstoi64
strtol
wcsnlen
_scwprintf
_ultoa_s
strncmp
_strlwr_s
_itow_s
towupper
wcsncpy_s
swprintf_s
wcschr
_wtoi
_wcsicmp
memmove_s
?what@exception@std@@UBEPBDXZ
calloc
_recalloc
_resetstkoflw
malloc
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
free
??0exception@std@@QAE@XZ
memcpy_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
kernel32
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
ResetEvent
SetEvent
ResumeThread
CreateEventW
GetCPInfo
lstrcmpiW
MulDiv
lstrcpyW
lstrcatW
LoadLibraryExW
WinExec
GetWindowsDirectoryW
DeleteFileW
InterlockedDecrement
GetVersion
GetComputerNameW
GetSystemInfo
FindNextFileW
SetCurrentDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
SetPriorityClass
GetPriorityClass
GetModuleFileNameW
GetCommandLineW
CreateMutexW
GetCurrentProcess
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
FindClose
FindFirstFileW
WritePrivateProfileStringW
GetPrivateProfileIntW
CreateThread
CloseHandle
FreeLibrary
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
SetLastError
LoadLibraryW
SizeofResource
LoadResource
FindResourceW
GetProcAddress
GetModuleHandleW
HeapReAlloc
ExpandEnvironmentStringsW
HeapFree
GetProcessHeap
HeapAlloc
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
FormatMessageW
GetLastError
GetVersionExW
HeapDestroy
HeapSize
lstrlenW
InterlockedExchange
LeaveCriticalSection
LocalFree
EnterCriticalSection
user32
DrawStateW
GetActiveWindow
GetNextDlgTabItem
IsMenu
GetSysColorBrush
CreateMenu
GetDesktopWindow
DrawIconEx
DrawEdge
GetDlgCtrlID
IsWindowEnabled
ChildWindowFromPoint
WindowFromPoint
GetClassNameW
SystemParametersInfoW
DestroyIcon
CreateIconIndirect
GetIconInfo
CopyIcon
GetMessagePos
TrackMouseEvent
MessageBeep
DestroyCursor
DefWindowProcW
TrackPopupMenu
SetMenuDefaultItem
RegisterWindowMessageW
GetWindowLongW
MessageBoxW
CallWindowProcW
UpdateWindow
GetWindowTextW
ExitWindowsEx
EqualRect
CallNextHookEx
UnhookWindowsHookEx
SetForegroundWindow
GetForegroundWindow
SetWindowPos
IsIconic
SetWindowsHookExW
LoadIconW
GetClassInfoW
FindWindowW
AppendMenuW
CreatePopupMenu
IsWindowVisible
SetWindowLongW
GetMenuItemInfoW
UnionRect
GetMenuBarInfo
LoadMenuW
GetSubMenu
CheckMenuItem
EnableMenuItem
ModifyMenuW
GetMenuState
GetMenuItemID
GetMenuItemCount
DrawIcon
GetSystemMetrics
OffsetRect
FrameRect
LoadImageW
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
LockWindowUpdate
SetWindowRgn
IsWindow
ClientToScreen
IsRectEmpty
GetCursorPos
FillRect
InflateRect
CopyRect
GetSysColor
GetWindowRect
SetRect
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetKeyState
GetParent
SetCapture
LoadBitmapW
ReleaseCapture
InvalidateRect
DrawFocusRect
EnableWindow
LoadCursorW
SetCursor
SetTimer
PtInRect
ScreenToClient
KillTimer
PostMessageW
SetRectEmpty
ReleaseDC
GetDC
GetClientRect
SendMessageW
gdi32
RoundRect
SetTextColor
CreateRectRgn
GetStockObject
MoveToEx
LineTo
SetBkColor
GetTextMetricsW
SetTextJustification
SelectClipRgn
OffsetRgn
CreatePolygonRgn
Rectangle
Ellipse
PatBlt
CreateBitmap
GetBkColor
DPtoLP
GetViewportExtEx
FrameRgn
BeginPath
FillRgn
SetBkMode
EndPath
PathToRegion
GetDeviceCaps
StretchBlt
SetBrushOrgEx
CreatePatternBrush
CreateRoundRectRgn
CreatePen
CreateSolidBrush
GetBkMode
GetCurrentObject
CombineRgn
GetDIBColorTable
GetTextExtentPoint32W
CreateFontW
SetPixel
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetPixel
GetMapMode
LPtoDP
CreateFontIndirectW
CreateCompatibleBitmap
GetObjectW
SetDIBColorTable
SelectObject
DeleteObject
CreateDIBSection
BitBlt
CreateCompatibleDC
DeleteDC
msimg32
TransparentBlt
GradientFill
AlphaBlend
advapi32
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryValueW
GetUserNameW
StartServiceW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegSetValueExW
shell32
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
Shell_NotifyIconW
comctl32
ImageList_GetImageCount
ord17
InitCommonControlsEx
ImageList_GetIcon
_TrackMouseEvent
shlwapi
PathFindFileNameW
PathFileExistsW
PathIsURLW
StrFormatByteSizeW
PathIsDirectoryW
ole32
CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SysAllocStringLen
VariantClear
VariantInit
OleLoadPicture
SystemTimeToVariantTime
VariantTimeToSystemTime
urlmon
URLDownloadToFileW
gdiplus
GdipFillPath
GdipDrawPath
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromDC
GdipDrawEllipseI
GdipFillEllipseI
GdipSetSmoothingMode
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDeletePen
GdipCreatePen1
GdipCreateFromHDC
GdipAddPathLineI
GdipAddPathArcI
GdipClonePath
GdipDeletePath
GdipCreatePath
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromFile
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDrawString
msvcp90
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
languages
ord4
ord9
ord8
ws2_32
WSASetEvent
WSACreateEvent
WSARecv
WSAGetOverlappedResult
WSASend
WSAResetEvent
WSAEnumNetworkEvents
WSAConnect
WSAGetLastError
WSASocketW
WSACloseEvent
closesocket
WSACleanup
WSAStartup
getaddrinfo
freeaddrinfo
WSASetLastError
WSAEventSelect
boottime
ord2
GetSetupTime
ord1
ord5
lockdll
ord22
_GoLike@8
ord21
ord10
ord7
ord23
_GoHomePage@8
_GoFaq@8
ord6
ord1
ord3
ord9
ord2
crashreport
ord1
checkupdate
ord3
ord5
ord1
ord2
appmetrics
ord3
ord8
ord7
restorecenter
CreateBackupFile
IsEnableBackupModule
ShowRestoreCenter
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
settings
IsRegDeepClean
GetScheduleStringByAutoUpdate
IsLogoffOrShutdownEraseTracks
GetScheduleStringByAuto1Click
IsAuto1Click
SetAuto1Click
IsMinToTary
IsAutoUpdateSchedule
Settings
IsShowQuicklaunchBarTips
IsEnableHelpPlan
IsSkipUAC
SetLogoffOrShutdownEraseTracks
SetAutoUpdateSchedule
SetRegDeepClean
Auto1ClickChangeSchedule
IsShowTrayTips
AutoUpdateChangeSchedule
trackseraser
ShowTracksEraserCheck
config
ord5
ord19
ord1
ord12
ord10
ord20
ord7
ord9
Sections
.text Size: 597KB - Virtual size: 596KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 143KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ