Static task
static1
Behavioral task
behavioral1
Sample
c1d06c916bafb81e0c2a04c6775a733ea25d7fa2ae903e8faa692fa22588e072.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c1d06c916bafb81e0c2a04c6775a733ea25d7fa2ae903e8faa692fa22588e072.exe
Resource
win10v2004-20230220-en
General
-
Target
c1d06c916bafb81e0c2a04c6775a733ea25d7fa2ae903e8faa692fa22588e072
-
Size
2.5MB
-
MD5
c2dee533bb828a580a080633044ae255
-
SHA1
633f8331e21e619701cc5ea3780ca38528a39213
-
SHA256
c1d06c916bafb81e0c2a04c6775a733ea25d7fa2ae903e8faa692fa22588e072
-
SHA512
898517b4d731f134c49a0c886e38a7049a701deac677c5a51deaca7915c9bb69b98a58d860582cce6b533d03ea1135dba6df5b4d5f761fbfd5e756dad79714a2
-
SSDEEP
49152:xvZWmdB0e3BsL0AJondvg/sflvhP/8E2bJ3oCPGfiRgCZGcAGXZ/SU3GouSlWAmH:vZb04Bo0rdLBU3poCPuiRgCdAGvuomE8
Malware Config
Signatures
Files
-
c1d06c916bafb81e0c2a04c6775a733ea25d7fa2ae903e8faa692fa22588e072.exe windows x86
106a22bcbb238ca89702c03e7958c903
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
DeleteFileW
LocalFree
SetFileAttributesW
lstrcpyW
CreateMutexW
FindFirstFileW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
Sleep
ReadFile
WritePrivateProfileStringW
FindClose
CreateFileMappingW
FindNextFileW
ReleaseMutex
GetDriveTypeW
LeaveCriticalSection
FlushInstructionCache
SetLastError
lstrcmpiA
EnterCriticalSection
DeviceIoControl
GetCurrentThreadId
GlobalReAlloc
CreateThread
DeleteCriticalSection
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LoadLibraryExW
LCMapStringW
InitializeCriticalSectionEx
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetStdHandle
GetStartupInfoW
lstrcatW
GetSystemInfo
DecodePointer
GlobalFree
HeapSize
GetProcAddress
GetLastError
VerifyVersionInfoW
RaiseException
GlobalUnlock
lstrlenW
MultiByteToWideChar
lstrcmpW
CreateFileW
GetModuleFileNameW
MulDiv
HeapReAlloc
LoadLibraryW
GlobalAlloc
WriteFile
GetProcessHeap
GetModuleHandleW
GlobalLock
CreateDirectoryW
HeapFree
GetCurrentProcess
MoveFileExW
VerSetConditionMask
HeapAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
GetModuleHandleExW
ExitProcess
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
EncodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
SetNamedPipeHandleState
WaitNamedPipeW
PeekNamedPipe
user32
SendMessageW
MessageBoxW
CreateWindowExW
GetDesktopWindow
ReleaseDC
GetDC
wsprintfW
UnregisterClassW
LoadImageW
DialogBoxIndirectParamW
GetDlgItem
SetWindowLongW
EndDialog
SendDlgItemMessageW
ShowWindow
IsDlgButtonChecked
GetActiveWindow
CheckRadioButton
GetDlgItemTextW
SetDlgItemTextW
EnableWindow
GetDlgCtrlID
ExitWindowsEx
MapDialogRect
gdi32
SetBkColor
DeleteObject
CreateSolidBrush
EnumFontFamiliesW
CreateFontIndirectW
GetDeviceCaps
GetObjectW
SetTextColor
advapi32
RegEnumKeyExW
RegCreateKeyExW
AdjustTokenPrivileges
ControlService
RegDeleteTreeW
QueryServiceStatus
StartServiceW
LookupPrivilegeValueW
OpenServiceW
OpenSCManagerW
DeleteService
OpenProcessToken
CloseServiceHandle
CreateServiceW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyW
RegQueryValueExW
shell32
SHFileOperationW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
ord75
SHChangeNotify
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoInitializeEx
CLSIDFromString
shlwapi
PathAppendW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
comctl32
ord17
Sections
.text Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ