Static task
static1
Behavioral task
behavioral1
Sample
cdc5ef579c7855edecab577bbf5c9f6ca590dabf1dbf6d5213a2ef731d4c2781.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cdc5ef579c7855edecab577bbf5c9f6ca590dabf1dbf6d5213a2ef731d4c2781.exe
Resource
win10v2004-20230221-en
General
-
Target
cdc5ef579c7855edecab577bbf5c9f6ca590dabf1dbf6d5213a2ef731d4c2781
-
Size
1.6MB
-
MD5
2a746d9ece29267fe59581ad693a4998
-
SHA1
74eb8fed5db000cf6d7ceee9254ee80ce675ba20
-
SHA256
cdc5ef579c7855edecab577bbf5c9f6ca590dabf1dbf6d5213a2ef731d4c2781
-
SHA512
ab25022d614eb8c8d4ab65ff59fb6a82a357394d9c129b9566238d55fda660ff4310028dcf4c01b4d9087edc73ffbb5a9860746b9405c5e050c0a8c51c7f9290
-
SSDEEP
24576:gh5Yj/fG47em32XbBs84+4QVb8hmCvogt65np44vvLt1mb:O2jXGvsWB2+j8ECrmp1Q
Malware Config
Signatures
Files
-
cdc5ef579c7855edecab577bbf5c9f6ca590dabf1dbf6d5213a2ef731d4c2781.exe windows x86
10a526f398751334cff3c342c1754690
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostname
gethostbyname
inet_ntoa
WSAAsyncSelect
socket
recv
listen
htons
bind
accept
freeaddrinfo
getaddrinfo
WSASocketW
WSASend
WSARecv
WSAGetLastError
WSASetLastError
setsockopt
WSAStartup
select
getsockopt
ioctlsocket
connect
closesocket
WSACleanup
send
curllib
curl_easy_getinfo
curl_easy_cleanup
curl_easy_perform
curl_easy_setopt
curl_formadd
curl_easy_init
curl_slist_append
curl_global_cleanup
curl_formfree
curl_global_init
libeay32
ord2660
ord501
ord57
ord95
ord67
ord87
ord52
ord109
ord78
ord3823
ord477
ord479
ord3040
ord3033
ord3106
ord3024
ord2720
ord2644
ord323
ord256
ord961
ord2656
ord266
ord3067
ord276
ord2894
ord255
mfc140
ord4656
ord4655
ord1693
ord1696
ord8146
ord1650
ord1178
ord12503
ord6563
ord3258
ord5960
ord9089
ord4216
ord14238
ord5861
ord2387
ord2383
ord4807
ord8322
ord12826
ord5898
ord1529
ord1526
ord300
ord305
ord316
ord3005
ord5095
ord266
ord265
ord2165
ord2986
ord1044
ord310
ord1661
ord6104
ord8679
ord13681
ord3298
ord3295
ord10207
ord8173
ord2759
ord1472
ord14699
ord10237
ord10239
ord10238
ord10236
ord10240
ord5631
ord11671
ord11672
ord9096
ord12032
ord3830
ord11881
ord14502
ord8922
ord12163
ord14328
ord10950
ord9213
ord3259
ord13798
ord12205
ord12201
ord1717
ord1739
ord1765
ord1751
ord1772
ord4920
ord4987
ord6195
ord14334
ord4932
ord4950
ord4944
ord4938
ord4997
ord4981
ord4926
ord5003
ord4958
ord4896
ord4911
ord4972
ord4493
ord5769
ord9647
ord4485
ord3050
ord8717
ord8718
ord8442
ord822
ord1351
ord14361
ord2241
ord10202
ord5742
ord4084
ord1109
ord1131
ord12162
ord12194
ord8180
ord12182
ord5894
ord3844
ord6831
ord993
ord6323
ord14582
ord6324
ord14583
ord6322
ord14581
ord7964
ord12474
ord14380
ord11927
ord11928
ord2027
ord7905
ord12888
ord4082
ord4143
ord9353
ord14507
ord7886
ord14509
ord12484
ord12485
ord2484
ord10330
ord5336
ord8285
ord4580
ord12806
ord12869
ord10383
ord12190
ord8347
ord1468
ord7618
ord8429
ord2200
ord1692
ord890
ord1389
ord6581
ord3924
ord4869
ord2524
ord14291
ord4218
ord8705
ord3689
ord14054
ord7783
ord14149
ord3825
ord6505
ord3159
ord3396
ord3395
ord458
ord10421
ord11343
ord10963
ord8997
ord12115
ord9167
ord2758
ord13677
ord14510
ord7887
ord14508
ord6848
ord11663
ord13628
ord5911
ord2680
ord12067
ord3933
ord3289
ord3363
ord3364
ord12111
ord1000
ord7407
ord5228
ord5528
ord5739
ord9305
ord5504
ord5231
ord5390
ord5210
ord7687
ord7688
ord7677
ord5388
ord8182
ord9166
ord1507
ord1509
ord6193
ord12074
ord10986
ord7459
ord6523
ord2210
ord5826
ord8026
ord6947
ord2407
kernel32
LoadLibraryA
FreeLibrary
GetSystemTime
OpenProcess
CreateProcessA
TerminateProcess
GetStdHandle
VerifyVersionInfoA
WaitForMultipleObjects
TlsSetValue
TlsGetValue
TerminateThread
QueueUserAPC
SetWaitableTimer
CreateEventW
SleepEx
WaitForSingleObject
GetQueuedCompletionStatus
CreateIoCompletionPort
SetLastError
VerSetConditionMask
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
SetEvent
GetProcAddress
CloseHandle
GetTickCount
GetModuleHandleA
CreateEventA
TlsFree
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
PostQueuedCompletionStatus
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
WideCharToMultiByte
WriteConsoleInputA
GenerateConsoleCtrlEvent
FreeConsole
SetConsoleCtrlHandler
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
SetPriorityClass
Sleep
GetVersionExA
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrlenA
lstrlenW
LCMapStringW
MoveFileExW
CopyFileW
CreateDirectoryExW
GetWindowsDirectoryW
DeviceIoControl
SetFileTime
CopyFileA
SetFileAttributesW
RemoveDirectoryW
GetFileTime
GetFileInformationByHandle
GetFileAttributesExW
GetDiskFreeSpaceExW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetEnvironmentVariableW
SystemTimeToFileTime
CreateWaitableTimerA
GetLogicalProcessorInformation
GetSystemInfo
ResumeThread
OpenEventA
WaitForMultipleObjectsEx
ReleaseSemaphore
LocalFree
OutputDebugStringW
lstrcpyW
VirtualProtect
VirtualFree
CreateThread
VirtualAlloc
VirtualQuery
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
VirtualQueryEx
AreFileApisANSI
ReadFile
SetFilePointer
WriteFile
SetEndOfFile
FlushFileBuffers
GetFileSize
UnlockFile
LockFile
LockFileEx
CreateFileA
CreateFileW
GetTempPathA
GetTempPathW
GetFileAttributesA
DeleteFileA
GetFileAttributesW
DeleteFileW
GetFullPathNameA
GetFullPathNameW
LoadLibraryW
FormatMessageA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedIncrement
InitializeCriticalSection
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
SetFilePointerEx
GetCurrentThreadId
MultiByteToWideChar
user32
LoadIconW
LoadIconA
GetCursorPos
GetClientRect
SetForegroundWindow
DrawIcon
GetSubMenu
LoadMenuW
GetSystemMetrics
KillTimer
SetTimer
EnableWindow
UnregisterClassA
SendMessageA
PostMessageA
IsIconic
gdi32
DeleteDC
shell32
Shell_NotifyIconA
ole32
CoCreateGuid
oleaut32
SysFreeString
msvcp140
?good@ios_base@std@@QBE_NXZ
??7ios_base@std@@QBE_NXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?eof@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Syserror_map@std@@YAPBDH@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?id@?$ctype@D@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
gdiplus
GdiplusShutdown
vcruntime140
__CxxFrameHandler3
__std_terminate
memmove
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memcpy
memset
_purecall
__RTDynamicCast
memchr
__std_type_info_compare
strchr
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
strerror
_controlfp_s
exit
system
_beginthreadex
_register_thread_local_exe_atexit_callback
_c_exit
signal
_exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_errno
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
terminate
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fopen
_set_fmode
__p__commode
_get_stream_buffer_pointers
fclose
fread
_sopen_dispatch
_write
_lseek
_filelength
_close
fputc
fgets
__stdio_common_vsprintf_s
ungetc
__stdio_common_vsscanf
__stdio_common_vsprintf
fflush
fgetpos
fsetpos
fgetc
_fseeki64
fwrite
setvbuf
api-ms-win-crt-filesystem-l1-1-0
remove
_unlock_file
_lock_file
api-ms-win-crt-heap-l1-1-0
realloc
free
_recalloc
malloc
_set_new_mode
api-ms-win-crt-time-l1-1-0
strftime
_time64
_localtime64
_localtime32
_gmtime64
_localtime64_s
api-ms-win-crt-convert-l1-1-0
atoi
atof
api-ms-win-crt-string-l1-1-0
strpbrk
isalpha
isdigit
strncmp
api-ms-win-crt-math-l1-1-0
_ftol
_except1
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_setmbcp
_configthreadlocale
Sections
.text Size: 613KB - Virtual size: 612KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 442KB - Virtual size: 449KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 451KB - Virtual size: 450KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ