Static task
static1
Behavioral task
behavioral1
Sample
c236ff82588980e334d3bf0c937ac9ce8261cb9d057c050ed55df5f1295b1f09.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c236ff82588980e334d3bf0c937ac9ce8261cb9d057c050ed55df5f1295b1f09.exe
Resource
win10v2004-20230220-en
General
-
Target
c236ff82588980e334d3bf0c937ac9ce8261cb9d057c050ed55df5f1295b1f09
-
Size
865KB
-
MD5
13807d7ed4124b88278d151cc5b725f6
-
SHA1
170a8b1488ce1755064f692a2c99e402bbf59cd8
-
SHA256
c236ff82588980e334d3bf0c937ac9ce8261cb9d057c050ed55df5f1295b1f09
-
SHA512
53547a99f9da55a79ef5932fa49439bb496b2f4085559554c2f7c11354238afcfe58ae9d74f6824626b419a2ecec9629de28afc2fc83d979018fcef503a71dd0
-
SSDEEP
12288:SvDI88R3LP01SaWiV8LaiXhK0ep0qUBov:Wv8RggTTk0eSqs
Malware Config
Signatures
Files
-
c236ff82588980e334d3bf0c937ac9ce8261cb9d057c050ed55df5f1295b1f09.exe windows x64
52331c22f4912bab82fba70c0a37630a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateMutexA
GetModuleHandleA
GetLastError
LoadLibraryA
CloseHandle
GetProcAddress
GetFileSize
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetProcessHeap
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
EncodePointer
DecodePointer
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetModuleHandleW
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapAlloc
HeapSize
HeapValidate
GetSystemInfo
GetStdHandle
WriteFile
GetFileType
OutputDebugStringW
WriteConsoleW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
DeleteFileW
HeapFree
HeapReAlloc
HeapQueryInformation
RtlUnwind
user32
GetDC
gdiplus
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdipSaveImageToFile
GdipCloneImage
GdiplusShutdown
GdiplusStartup
ws2_32
send
socket
connect
inet_addr
recv
htons
WSAStartup
closesocket
gethostname
Sections
.text Size: 493KB - Virtual size: 493KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 190KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ