Static task
static1
Behavioral task
behavioral1
Sample
55dcd78f7cac8e151a055fa15fe1586580ee736152e98fb3b8bdf5fc6cf93784.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
55dcd78f7cac8e151a055fa15fe1586580ee736152e98fb3b8bdf5fc6cf93784.exe
Resource
win10v2004-20230220-en
General
-
Target
55dcd78f7cac8e151a055fa15fe1586580ee736152e98fb3b8bdf5fc6cf93784
-
Size
2.8MB
-
MD5
42deab1b0a3635dbd995292f0928a42b
-
SHA1
e3101d7a594e343963c95c73cc16c2aa3671690f
-
SHA256
55dcd78f7cac8e151a055fa15fe1586580ee736152e98fb3b8bdf5fc6cf93784
-
SHA512
cec478a9a545e3551f604b788d7df6c29a22b9884e19a219d2b60fd76883dd65dc8cd56524bd4c1d8143abe90c435c679df3bb708acfd736275085ec975068ef
-
SSDEEP
49152:tzhGLcBKNP35i18m1eqEQ1w1uFiw+i2ZQPhQBM8Wsf2znxkn0h:tzhGQ4NP35m8NQFDQY+M
Malware Config
Signatures
Files
-
55dcd78f7cac8e151a055fa15fe1586580ee736152e98fb3b8bdf5fc6cf93784.exe windows x86
54eef1dca95cb7af61f93fd01f19f9cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
DeleteCriticalSection
CreateEventW
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
OpenFileMappingW
IsBadReadPtr
GetProcessHeap
HeapAlloc
GetNativeSystemInfo
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
GetVersionExW
LocalAlloc
LocalFree
GetCurrentProcess
GetModuleFileNameW
OutputDebugStringW
WaitForSingleObjectEx
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetLongPathNameW
GetExitCodeProcess
WriteFile
GetTempPathW
GetFileAttributesW
CopyFileW
GetLastError
DecodePointer
HeapReAlloc
HeapSize
RaiseException
InitializeCriticalSectionAndSpinCount
GetFileSize
ReadFile
MultiByteToWideChar
WideCharToMultiByte
GetPrivateProfileIntW
GlobalAlloc
GlobalFree
lstrcpyW
CreateProcessW
FindClose
GetEnvironmentVariableW
CreateDirectoryW
LoadLibraryA
FindFirstFileW
FindNextFileW
MoveFileExW
GetSystemInfo
ReleaseMutex
CreateMutexW
FileTimeToSystemTime
OutputDebugStringA
SetPriorityClass
EncodePointer
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
GetCurrentThread
GetStringTypeW
GetFileType
WriteConsoleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetConsoleCtrlHandler
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
FlushFileBuffers
SetEndOfFile
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetFullPathNameW
GetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
SystemTimeToFileTime
GetSystemTime
ReadConsoleA
VirtualAlloc
lstrlenW
VirtualFree
SetLastError
HeapFree
VirtualProtect
GetPrivateProfileStringW
WritePrivateProfileStringW
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
Process32FirstW
DeleteFileW
SetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
VerifyVersionInfoA
GetSystemDirectoryA
GetModuleHandleA
GetVolumeInformationW
SetEvent
Process32NextW
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetSystemDirectoryW
CreateFileW
RemoveDirectoryW
DeviceIoControl
VerSetConditionMask
ExpandEnvironmentStringsA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
FormatMessageA
TryEnterCriticalSection
DuplicateHandle
user32
LoadStringW
wsprintfW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
GetLastInputInfo
PostMessageW
FindWindowW
advapi32
RegCreateKeyExW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
RegQueryValueExW
RegOpenKeyW
CreateProcessAsUserW
ImpersonateLoggedOnUser
RevertToSelf
DuplicateTokenEx
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetTokenInformation
RegSetValueExW
ReportEventW
RegDeleteKeyW
LookupAccountSidW
GetTokenInformation
RegOpenKeyExW
CryptAcquireContextW
CryptReleaseContext
RegCloseKey
RegEnumKeyW
OpenProcessToken
shell32
SHGetFolderPathW
SHChangeNotify
SHGetSpecialFolderPathW
ole32
CoCreateInstance
CoUninitialize
CoInitialize
shlwapi
PathFileExistsW
SHDeleteKeyW
SHDeleteValueW
SHGetValueW
SHSetValueW
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
wininet
InternetSetOptionW
InternetOpenW
HttpQueryInfoW
InternetQueryOptionW
InternetReadFile
InternetCloseHandle
InternetOpenUrlW
wldap32
ord143
ord211
ord46
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ws2_32
WSAStartup
WSACleanup
recv
send
WSAGetLastError
__WSAFDIsSet
select
WSASetLastError
bind
closesocket
connect
getpeername
getsockname
getsockopt
ioctlsocket
gethostname
htons
ntohs
setsockopt
accept
sendto
socket
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
listen
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 549KB - Virtual size: 548KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 425KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ