Static task
static1
Behavioral task
behavioral1
Sample
fe09c13a72a72d281a776f3e677cde1e2f6af98dfc41c6be9ab80e434faaf0be.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fe09c13a72a72d281a776f3e677cde1e2f6af98dfc41c6be9ab80e434faaf0be.exe
Resource
win10v2004-20230221-en
General
-
Target
fe09c13a72a72d281a776f3e677cde1e2f6af98dfc41c6be9ab80e434faaf0be
-
Size
963KB
-
MD5
5baebeb48e9023cc9aeb02cb23e60a0c
-
SHA1
99f6a25403e50b6cc3127edd4c286cd78ce46482
-
SHA256
fe09c13a72a72d281a776f3e677cde1e2f6af98dfc41c6be9ab80e434faaf0be
-
SHA512
0fd82c4182a13b2030be7798ed93484fe95db647c46da4445850087343bfc68d868d692f6ba133244912941000aa395b5c0784d6eb72312c8054b06721329609
-
SSDEEP
12288:Pc8JY1l0NlQVVJdp9AYjMaVGmQQCMpOuC7d41KCAu8/gCeFujMgD6gFlaAl1fswQ:Pc8J+0QVVV/jMIE+vy/5YgO0re5vW
Malware Config
Signatures
Files
-
fe09c13a72a72d281a776f3e677cde1e2f6af98dfc41c6be9ab80e434faaf0be.exe windows x86
d8ef215753e89ae3702d63c28952ea46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceA
WideCharToMultiByte
lstrlenA
GetLastError
FindClose
FindFirstFileA
CloseHandle
UnmapViewOfFile
CreateFileA
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
GetCurrentProcess
GetModuleHandleA
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
OpenProcess
SetFilePointer
ReadFile
SystemTimeToFileTime
lstrcatA
GetFileInformationByHandle
GetDriveTypeA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MultiByteToWideChar
GetModuleFileNameA
WriteFile
SetFileTime
GetCurrentDirectoryA
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
lstrcpyA
LoadResource
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
SetEnvironmentVariableA
CompareStringW
GetProcessHeap
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
IsValidCodePage
GetACP
InitializeCriticalSectionAndSpinCount
GetStdHandle
GetConsoleMode
GetConsoleCP
HeapSize
CreateThread
ExitThread
HeapReAlloc
LockResource
SizeofResource
VirtualAlloc
GetStartupInfoA
GetCommandLineA
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
ExitProcess
Sleep
GetVersionExA
lstrcmpW
SetLastError
CompareStringA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetCurrentThreadId
LocalFree
FormatMessageA
lstrcmpA
InterlockedExchange
GetLocaleInfoA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
WaitForSingleObject
GetCurrentProcessId
WritePrivateProfileStringA
GetModuleFileNameW
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GlobalFlags
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GetCPInfo
GetOEMCP
GetModuleHandleW
FileTimeToSystemTime
FlushFileBuffers
SetEndOfFile
GetFullPathNameA
SetErrorMode
FileTimeToLocalFileTime
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
user32
SetMenuItemBitmaps
GetWindow
GetSystemMetrics
GetWindowPlacement
GetMenu
CallWindowProcA
DefWindowProcA
GetDlgCtrlID
CopyRect
AdjustWindowRectEx
GetSysColor
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
MessageBoxA
GetMenuItemCount
GetMenuItemID
GetSubMenu
IsWindowVisible
SetForegroundWindow
SetMenu
GetKeyState
MapWindowPoints
PeekMessageA
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
GetDlgItem
DispatchMessageA
GetLastActivePopup
GetForegroundWindow
GetWindowTextA
IsWindow
RemovePropA
GetPropA
SetPropA
GetMenuCheckMarkDimensions
GetClassLongA
CallNextHookEx
SetWindowsHookExA
GetCapture
WinHelpA
RegisterWindowMessageA
SetWindowTextA
ShowWindow
IsWindowEnabled
PostQuitMessage
ValidateRect
GetActiveWindow
TranslateMessage
GetMessageA
SetCursor
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetSysColorBrush
DestroyMenu
UnregisterClassA
ClientToScreen
LoadBitmapA
LoadIconA
wsprintfA
PtInRect
PostMessageA
IsIconic
GetWindowRect
GetClientRect
GetDC
ReleaseDC
SystemParametersInfoA
SetWindowLongA
GetWindowLongA
SetWindowPos
GetCursorPos
GetParent
LoadCursorA
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetWindowThreadProcessId
SendMessageA
FindWindowA
FindWindowExA
EnableWindow
GetClassNameA
gdi32
OffsetViewportOrgEx
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetMapMode
DeleteObject
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
GetDeviceCaps
GetStockObject
SetViewportExtEx
ScaleViewportExtEx
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
CreateBitmap
shell32
ShellExecuteA
oleaut32
VariantClear
VariantChangeType
VariantInit
comctl32
InitCommonControlsEx
shlwapi
PathFindExtensionA
PathFindFileNameA
gdiplus
GdiplusStartup
GdiplusShutdown
wldap32
ord30
ord200
ord211
ord22
ord32
ord35
ord26
ord33
ord301
ord27
ord41
ord46
ord50
ord60
ord79
ord143
ws2_32
ntohl
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
bind
htons
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
gethostname
htonl
ntohs
crypt32
CertFreeCertificateContext
oleacc
CreateStdAccessibleObject
LresultFromObject
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegCreateKeyExA
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegSetValueExA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
Sections
.text Size: 411KB - Virtual size: 411KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 403KB - Virtual size: 404KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ