Static task
static1
Behavioral task
behavioral1
Sample
fd3d054f4d1015bf22407992efc6be1eb4628052382dd0e25d075017fc2966a1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fd3d054f4d1015bf22407992efc6be1eb4628052382dd0e25d075017fc2966a1.exe
Resource
win10v2004-20230221-en
General
-
Target
fd3d054f4d1015bf22407992efc6be1eb4628052382dd0e25d075017fc2966a1.exe
-
Size
118KB
-
MD5
31475141cf89f8ede2b536f95d0ac5e9
-
SHA1
34803437542595659f22e83f1eae6b138f66879f
-
SHA256
fd3d054f4d1015bf22407992efc6be1eb4628052382dd0e25d075017fc2966a1
-
SHA512
6bd73310a129e5bd04cdc4bd6a81c8d55da4f277be7cf8e70677577bc546592a80fdf24ec947083392506980671e7c250c0764db665914abb71c7a2985acfe10
-
SSDEEP
3072:zNCi2pPk0xLWGB9eY/qCxcsvkGGI57RqwO:zNn8Mw7tfvkGGI57AL
Malware Config
Signatures
Files
-
fd3d054f4d1015bf22407992efc6be1eb4628052382dd0e25d075017fc2966a1.exe.exe windows x86
d3ff663beb2af406701e3b4be6a9207a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualFree
WriteFile
VirtualAlloc
GetModuleFileNameW
GetTempPathA
CreateFileA
LockResource
LoadResource
FindResourceW
CreateProcessW
GetModuleHandleA
HeapAlloc
GetProcessHeap
LoadLibraryA
GetProcAddress
ExitProcess
GetCommandLineA
GetStartupInfoA
HeapFree
HeapReAlloc
VirtualQuery
TerminateThread
CreateThread
LoadLibraryW
GetCurrentThreadId
GetTickCount
LocalFree
FreeLibrary
WaitForSingleObject
GetCurrentProcess
ReadFile
WaitForMultipleObjects
CreatePipe
PeekNamedPipe
DuplicateHandle
SetEvent
SizeofResource
GetComputerNameW
LoadLibraryExW
FindFirstFileW
FindNextFileW
SetFilePointer
CreateFileW
GetLogicalDriveStringsW
DeleteFileW
GetFileSize
CopyFileW
GetDriveTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateMutexA
ReleaseMutex
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
lstrcpyW
WideCharToMultiByte
Sleep
lstrcpyA
lstrcatW
MultiByteToWideChar
lstrcatA
lstrcmpA
lstrlenA
ExpandEnvironmentStringsW
lstrlenW
CloseHandle
GetLastError
SetLastError
CreateEventA
lstrcmpW
GetPrivateProfileStringW
GetTempPathW
user32
ToUnicode
PostQuitMessage
GetWindowTextW
RegisterRawInputDevices
wsprintfA
wsprintfW
DefWindowProcA
GetForegroundWindow
MapVirtualKeyA
GetRawInputData
RegisterClassW
CreateWindowExW
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA
GetLastInputInfo
advapi32
OpenServiceW
RegCloseKey
OpenSCManagerW
CloseServiceHandle
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
ChangeServiceConfigW
QueryServiceConfigW
GetTokenInformation
LookupAccountSidW
FreeSid
OpenProcessToken
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
RegDeleteValueW
RegSetValueExA
RegDeleteKeyW
StartServiceW
EnumServicesStatusExW
RegCreateKeyExA
shell32
ShellExecuteExA
ord680
ShellExecuteA
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteW
urlmon
URLDownloadToFileW
ws2_32
recv
WSACleanup
closesocket
shutdown
getaddrinfo
WSAStartup
send
socket
inet_addr
WSAGetLastError
setsockopt
freeaddrinfo
htons
connect
inet_ntoa
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
shlwapi
PathFindFileNameW
StrStrA
PathFindExtensionW
PathFileExistsW
StrStrW
netapi32
NetUserAdd
NetLocalGroupAddMembers
oleaut32
VariantInit
crypt32
CryptUnprotectData
psapi
GetModuleFileNameExW
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.bss Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ