Static task
static1
Behavioral task
behavioral1
Sample
f33474cc39ccddcf6d8d576a3eddc473.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f33474cc39ccddcf6d8d576a3eddc473.exe
Resource
win10v2004-20230220-en
General
-
Target
f33474cc39ccddcf6d8d576a3eddc473.bin
-
Size
72.3MB
-
MD5
f33474cc39ccddcf6d8d576a3eddc473
-
SHA1
47ffd5bf0e63c9c55a57af72c3c6c7fd269ae7bb
-
SHA256
c67880ee8eba90a3a99a5da8def2f4ae75de63171e2872b0494ea2462f2bcdb9
-
SHA512
1d6ff681f130616e9e5003afa84780c70cacddd28defcc7031ab3cd2b6b8e5145f05ba04f7815ea3ed8648c148f2a586ddac18708219eaa161b617f75b20f41b
-
SSDEEP
1572864:UzPoKeDg9bjChl1vIT04LpK+BSvsRQRMRE:7g93u1APL3BSvCOi
Malware Config
Signatures
Files
-
f33474cc39ccddcf6d8d576a3eddc473.bin.exe windows x64
f952f7ebaa467445c6dcb50e55bbba6b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetFileSizeEx
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
MoveFileExA
RtlLookupFunctionEntry
VerifyVersionInfoA
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
SetEvent
ResetEvent
CreateEventW
GetEnvironmentVariableA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
FormatMessageA
SetLastError
QueryFullProcessImageNameW
GetModuleHandleW
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualProtect
CreateThread
GetCurrentProcess
Sleep
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
CloseHandle
CreateFileW
RtlCaptureContext
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
MultiByteToWideChar
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
AllocConsole
QueryPerformanceCounter
VerifyVersionInfoW
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
GetTickCount
user32
FindWindowA
UpdateWindow
GetWindowLongW
AdjustWindowRectEx
PostQuitMessage
PeekMessageA
LoadCursorA
DestroyWindow
TranslateMessage
MessageBoxA
DispatchMessageA
GetCursorPos
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
ScreenToClient
SetWindowTextW
WindowFromPoint
ShowWindow
GetCapture
GetKeyState
UnregisterClassA
SetWindowLongA
ClientToScreen
IsChild
GetMonitorInfoA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetCapture
SetCursor
SetWindowLongW
GetClientRect
OpenClipboard
RegisterClassExA
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
ReleaseDC
gdi32
GetDeviceCaps
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
msvcp140
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
d3d9
Direct3DCreate9
normaliz
IdnToAscii
wldap32
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord143
ord30
ord200
ord301
ord217
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertOpenStore
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertFreeCertificateChain
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertAddCertificateContextToStore
ws2_32
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
ntohl
accept
htons
WSACleanup
getsockopt
getpeername
connect
bind
WSAStartup
WSAIoctl
WSASetLastError
socket
WSAGetLastError
send
recv
closesocket
setsockopt
getsockname
ntohs
rpcrt4
UuidCreate
UuidToStringA
RpcStringFreeA
psapi
GetModuleInformation
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
strchr
__C_specific_handler
__current_exception_context
__current_exception
strrchr
memset
__std_exception_destroy
memmove
memcpy
memcmp
memchr
_CxxThrowException
__std_exception_copy
__std_terminate
api-ms-win-crt-stdio-l1-1-0
_wfopen
_set_fmode
fputs
fopen
__p__commode
__stdio_common_vsprintf
_read
_write
ftell
_close
fread
_lseeki64
__stdio_common_vsscanf
_popen
_pclose
fgets
_open
fseek
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
__acrt_iob_func
feof
fflush
fgetc
fputc
fclose
fwrite
api-ms-win-crt-string-l1-1-0
isupper
strspn
strcspn
strcmp
_strdup
strpbrk
tolower
strncmp
strncpy
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
calloc
realloc
_set_new_mode
_callnewh
free
malloc
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
strtoll
strtol
strtod
atoi
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_initterm
_get_narrow_winmain_command_line
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
terminate
_errno
exit
system
_getpid
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
strerror
_beginthreadex
__sys_nerr
_c_exit
_exit
_initterm_e
_set_app_type
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_stat64
_fstat64
_access
_unlink
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-math-l1-1-0
acosf
sinf
ceilf
cosf
_dclass
fmodf
sqrtf
__setusermatherr
advapi32
CryptGetHashParam
AddAccessAllowedAce
GetLengthSid
GetTokenInformation
InitializeAcl
IsValidSid
SetSecurityInfo
CryptAcquireContextA
CryptReleaseContext
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptImportKey
OpenProcessToken
shell32
ShellExecuteA
Sections
.text Size: 699KB - Virtual size: 698KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 262KB - Virtual size: 262KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 71.4MB - Virtual size: 71.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ