Static task
static1
Behavioral task
behavioral1
Sample
eceb742996e39a2a14c711345516f9a62537e456626e367ede552a2a29a798eb.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
eceb742996e39a2a14c711345516f9a62537e456626e367ede552a2a29a798eb.exe
Resource
win10v2004-20230220-en
General
-
Target
eceb742996e39a2a14c711345516f9a62537e456626e367ede552a2a29a798eb
-
Size
1.4MB
-
MD5
2b87ca629a0ff280f36f72583ab0fa14
-
SHA1
714784c141b5d24a3c06b8d06672aa175b3c9190
-
SHA256
eceb742996e39a2a14c711345516f9a62537e456626e367ede552a2a29a798eb
-
SHA512
111be0e731d6c3e54302fa9718da5a472671562e4cb65c8324d667c479b5cfd4fbdfd7fcf65ca7c8ae2669a92898d874f6c88588adc96040266dcce2f68868d6
-
SSDEEP
24576:5HVnT8NKHISZO+EoCe0UPsiiKlYezKCGaXWlRxgvpHzTiCwDyHljzRG:/UKVaTe0cs4XK1lRxlCwDyHnG
Malware Config
Signatures
Files
-
eceb742996e39a2a14c711345516f9a62537e456626e367ede552a2a29a798eb.exe windows x86
238e0e6a1a875fb5f59bef0450e23852
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
WaitForSingleObject
SleepEx
SetLastError
GetStdHandle
GetFileType
GetModuleHandleA
QueryPerformanceCounter
LoadLibraryA
FlushConsoleInputBuffer
DuplicateHandle
LeaveCriticalSection
SetEvent
CreateEventW
WaitForMultipleObjects
ResetEvent
lstrlenA
GlobalReAlloc
OutputDebugStringW
InitializeCriticalSection
FlushFileBuffers
IsDebuggerPresent
GetLocalTime
ReadFile
GetTempPathW
ResumeThread
FormatMessageA
ExpandEnvironmentStringsA
PeekNamedPipe
VerifyVersionInfoW
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
EncodePointer
GetVersionExW
UnmapViewOfFile
WTSGetActiveConsoleSessionId
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
LocalAlloc
GetCurrentProcessId
GetSystemDirectoryW
GlobalFree
GetCommandLineW
GlobalUnlock
GlobalLock
GlobalAlloc
FreeLibrary
LoadLibraryW
GetCurrentProcess
GetProcAddress
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
WritePrivateProfileStringW
GetPrivateProfileIntW
SetFilePointer
ExpandEnvironmentStringsW
GetPrivateProfileStringW
EnterCriticalSection
SetFileAttributesW
DeleteFileW
MoveFileExW
FreeResource
WriteFile
CreateFileW
CreateDirectoryW
lstrcpynW
GetFileAttributesW
GetModuleFileNameW
DeleteCriticalSection
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
Sleep
InterlockedExchange
InterlockedCompareExchange
lstrlenW
GetTickCount
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetCurrentThreadId
CloseHandle
GetLastError
CreateMutexW
GlobalMemoryStatus
user32
IsWindowVisible
GetWindowRect
EndPaint
SetCursor
ClientToScreen
WindowFromPoint
TrackMouseEvent
GetFocus
GetClassInfoExW
GetMenuState
GetSystemMenu
GetWindowTextW
GetWindowPlacement
SetWindowPlacement
PtInRect
GetActiveWindow
OffsetRect
SetWindowRgn
IsZoomed
GetDesktopWindow
GetAncestor
EnableWindow
UpdateLayeredWindow
ReleaseCapture
GetCapture
GetKeyState
MapWindowPoints
FillRect
DrawTextW
SetWindowTextW
FindWindowA
BeginPaint
InvalidateRect
IntersectRect
UnionRect
GetClientRect
RegisterWindowMessageW
RegisterClassExW
UnhookWindowsHookEx
GetClassInfoW
CallWindowProcW
PeekMessageW
SetTimer
DefWindowProcW
KillTimer
CreateWindowExW
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
SendMessageTimeoutW
SetFocus
FindWindowExW
DrawIconEx
ReleaseDC
GetDC
IsRectEmpty
ScreenToClient
GetCursorPos
SetRect
FindWindowW
SendMessageW
PostMessageW
CallNextHookEx
GetSystemMetrics
ShowWindow
UpdateWindow
SetWindowsHookExW
LoadCursorW
SystemParametersInfoW
GetParent
SetForegroundWindow
SetWindowPos
GetWindowThreadProcessId
GetForegroundWindow
GetClassNameW
GetWindow
DispatchMessageW
TranslateMessage
SetCapture
AttachThreadInput
BringWindowToTop
LockSetForegroundWindow
LoadIconW
IsWindow
DestroyWindow
PostQuitMessage
GetWindowLongW
SetWindowLongW
SetLayeredWindowAttributes
GetMessageW
advapi32
RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ImpersonateLoggedOnUser
RevertToSelf
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextW
CryptReleaseContext
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptDestroyHash
CryptHashData
CryptImportKey
CryptDestroyKey
ole32
CreateStreamOnHGlobal
OleRun
CoCreateInstance
CoInitialize
shell32
CommandLineToArgvW
ShellExecuteW
oleaut32
VariantInit
SysFreeString
GetErrorInfo
SysAllocString
VariantClear
shlwapi
PathAddBackslashW
PathFindFileNameW
StrCmpNIW
PathAppendW
gdi32
BitBlt
DeleteDC
GetObjectW
CreateDIBSection
GetObjectA
CreateFontIndirectW
GetClipBox
ExcludeClipRect
CreateCompatibleBitmap
CreateRectRgn
Rectangle
ExtCreateRegion
CombineRgn
CreateSolidBrush
SetTextColor
GetTextExtentPoint32W
CreateCompatibleDC
DeleteObject
CreatePen
SetBkMode
SelectObject
GetStockObject
msvcp120
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Winerror_map@std@@YAPBDH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_BADOFF@std@@3_JB
?_Syserror_map@std@@YAPBDH@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
msvcr120
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
__RTDynamicCast
_open
_close
_write
_read
_wstat64
_localtime64
islower
isprint
isgraph
_stat64
_gmtime64
__sys_nerr
_getpid
_fstat64
_lseeki64
strtoll
_wcsdup
calloc
_CxxThrowException
__CxxFrameHandler3
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
isalpha
_aligned_free
_aligned_malloc
??0exception@std@@QAE@ABQBDH@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
_except1
??0exception@std@@QAE@XZ
fopen_s
_snprintf_s
_snwprintf
wcslen
_ui64tow_s
_stricmp
_strdup
_wfopen_s
_beginthreadex
_getch
fputs
fprintf
signal
strstr
strrchr
_gmtime32_s
isupper
strncmp
atoi
_strnicmp
strtol
_setmode
_errno
_wfopen
_fileno
fgets
ferror
feof
isxdigit
_time32
strncpy
strerror
raise
_vsnprintf
__iob_func
strtoul
getenv
_exit
realloc
isalnum
isspace
isdigit
qsort
strcmp
memset
memcpy
strpbrk
exit
??3@YAXPAX@Z
??2@YAPAXI@Z
memmove
??_V@YAXPAX@Z
_time64
memcpy_s
memmove_s
wmemcpy_s
wcsftime
_localtime64_s
_snwprintf_s
wcsnlen
_vsnwprintf_s
wcsncpy_s
_purecall
_wtoi
free
wcschr
_wcsicmp
fputc
wcsrchr
toupper
malloc
??0exception@std@@QAE@ABV01@@Z
fwrite
_fseeki64
fflush
memchr
fclose
_vscwprintf
vswprintf_s
wcsstr
_ultow_s
sprintf
_vsnprintf_s
tolower
wcsncat_s
strncpy_s
_ftime64
sscanf
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
strchr
swprintf_s
fopen
fseek
ftell
fread
srand
wtsapi32
WTSQueryUserToken
wininet
InternetOpenW
InternetSetStatusCallbackW
InternetReadFileExA
HttpSendRequestW
HttpAddRequestHeadersW
HttpQueryInfoW
InternetCrackUrlW
InternetConnectW
InternetCloseHandle
HttpOpenRequestW
gdiplus
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdiplusStartup
GdiplusShutdown
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipGetImageGraphicsContext
GdipSetWorldTransform
GdipGraphicsClear
GdipFillRectangleI
GdipGetImageHeight
GdipDisposeImage
GdipAlloc
GdipFree
GdipDrawRectangleI
GdipDeletePen
GdipCreatePen1
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipImageSelectActiveFrame
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipMeasureString
GdipDrawString
GdipGetImageWidth
GdipSetTextRenderingHint
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawImageRectI
GdipCloneBrush
GdipDeleteBrush
GdipBitmapUnlockBits
GdipCloneBitmapAreaI
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromFileICM
GdipDrawImageRectRectI
GdipCloneImage
GdipCreateSolidFill
iphlpapi
GetAdaptersInfo
ntdll
VerSetConditionMask
msimg32
AlphaBlend
ws2_32
bind
connect
WSAGetLastError
getsockname
getpeername
gethostname
WSAIoctl
accept
listen
ntohs
recvfrom
sendto
htons
WSASetLastError
select
WSAStartup
setsockopt
ioctlsocket
send
WSACleanup
getsockopt
closesocket
freeaddrinfo
getaddrinfo
__WSAFDIsSet
socket
recv
wldap32
ord142
ord46
ord301
ord27
ord118
ord127
ord41
ord26
ord79
ord133
ord216
ord14
ord145
ord208
ord167
ord147
Sections
.text Size: 1002KB - Virtual size: 1002KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 267KB - Virtual size: 266KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 53KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ