Static task
static1
Behavioral task
behavioral1
Sample
3b6445cf6f8e9e70cb0fff35d723fec8203375d67cbd67c9a672cddc02a7ff99.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3b6445cf6f8e9e70cb0fff35d723fec8203375d67cbd67c9a672cddc02a7ff99.exe
Resource
win10v2004-20230221-en
General
-
Target
3b6445cf6f8e9e70cb0fff35d723fec8203375d67cbd67c9a672cddc02a7ff99
-
Size
175KB
-
MD5
1a5c0d04f0dd0871b3d4e0e52cad3948
-
SHA1
d18bf957dac7fa5947e1e058cae4f9172792fa1b
-
SHA256
3b6445cf6f8e9e70cb0fff35d723fec8203375d67cbd67c9a672cddc02a7ff99
-
SHA512
6054caba446fde2c1493b42774e327d9cb71cf71046458c996a45c6d7f40b789df6bd48acab7b6ebc8bd876eb36ff581ec7e5011edf839560c08123c4b0676de
-
SSDEEP
3072:r28x1nYpeeCw3XQi9APMEuNvdU8XmCCMgZbCz18N2gmYQhfrTb3yFETJoWyNpkw:r28xJhDwGMTEnMgCh8N0Nf+F4fwp9
Malware Config
Signatures
Files
-
3b6445cf6f8e9e70cb0fff35d723fec8203375d67cbd67c9a672cddc02a7ff99.exe windows x86
c133a8177ac4e2546a27eef9fd39828e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
GetUserNameA
GetCurrentHwProfileA
RegCloseKey
RegCreateKeyExW
RegSetValueExW
user32
GetSystemMetrics
TranslateMessage
DispatchMessageW
DefWindowProcW
RegisterClassW
GetMessageW
SystemParametersInfoA
DestroyWindow
CreateWindowExW
UnregisterClassW
ws2_32
WSACleanup
WSAStartup
gethostbyname
crypt32
CryptBinaryToStringA
wininet
InternetReadFile
InternetGetConnectedState
shell32
ShellExecuteA
SHCreateDirectoryExW
SHCreateDirectoryExA
kernel32
HeapReAlloc
HeapSize
ReadConsoleW
FlushFileBuffers
GetProcessHeap
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
WriteConsoleW
SetEndOfFile
GetACP
IsValidCodePage
FindFirstFileExW
CloseHandle
WaitForMultipleObjects
CreateThread
MultiByteToWideChar
WideCharToMultiByte
CreateFileA
GetFileSize
ReadFile
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
DeleteFileA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDrives
GetVolumeInformationA
Sleep
GlobalMemoryStatusEx
GetSystemInfo
GetVersion
GetLogicalDriveStringsA
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
LoadLibraryA
GetComputerNameA
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetDriveTypeW
GetWindowsDirectoryW
DeleteFileW
CreateFileW
WriteFile
TerminateProcess
OpenProcess
QueryFullProcessImageNameW
GetVolumeInformationW
GetModuleHandleW
CopyFileW
GetFileTime
CreateProcessA
GetModuleFileNameA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
MoveFileExW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
CompareStringW
LCMapStringW
DecodePointer
Sections
.text Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ