Static task
static1
Behavioral task
behavioral1
Sample
fd2805fcbb98043679e0ce2ccd112134a767df7010acc24c395cffd73dbc56d6.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
fd2805fcbb98043679e0ce2ccd112134a767df7010acc24c395cffd73dbc56d6.exe
Resource
win10v2004-20230220-en
General
-
Target
fd2805fcbb98043679e0ce2ccd112134a767df7010acc24c395cffd73dbc56d6.zip
-
Size
238KB
-
MD5
62cd73a8614f203b03ecd651afa8a92a
-
SHA1
210c0783d7e39215fa8a220a3ce29d9002ca8b03
-
SHA256
b62ab456c8e312e3df5d55a936ffa3002f480b3e76ef5a930dda368433cbfe08
-
SHA512
8f67374d56813fc46fdbf73a17159dd467dcd4070c6f3475d80a6bc7bb1eb1ad3cae820875ba45d5e5cff837010da13ad94b56d5bc371fefbfb6d9ca279da45e
-
SSDEEP
6144:R5qPvmoew3MDNlQ2XmqnrYtNI1PKweuly5tqyFRs6qiv79yMt88Q+:R5qPaw3yv2KrYtNI1Sf+y5gKR5qiIMWM
Malware Config
Signatures
Files
-
fd2805fcbb98043679e0ce2ccd112134a767df7010acc24c395cffd73dbc56d6.zip.zip
Password: infected
-
fd2805fcbb98043679e0ce2ccd112134a767df7010acc24c395cffd73dbc56d6.exe.exe windows x64
Password: infected
dd210d549c468f297ccc666d6fedc16d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
ClearEventLogA
ImpersonateAnonymousToken
ImpersonateNamedPipeClient
OpenEventLogA
kernel32
CloseHandle
CreateFileA
CreatePipe
CreateProcessA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FindNextStreamW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeProcess
GetLastError
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempPathA
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
ReadFile
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetCommBreak
SetCommMask
SetEndOfFile
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeA
msvcrt
__C_specific_handler
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_onexit
_snprintf
abort
calloc
exit
fprintf
free
fwrite
malloc
memcpy
signal
strlen
strncmp
vfprintf
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 628KB - Virtual size: 628KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 1024B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE