Static task
static1
Behavioral task
behavioral1
Sample
f_0012ce.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
f_0012ce.exe
Resource
win10v2004-20230220-en
General
-
Target
f_0012ce.zip
-
Size
108KB
-
MD5
fcbb7b0a4ac0845afadd541c3c38c8f2
-
SHA1
0b8820b5eea2bd4731573347ea42ac49bff4990a
-
SHA256
101a709ed0fe07c857fdb25d318631abe3088663ff9b39b58f1c03bb6989011b
-
SHA512
230f40443e55fb416d66b9e47df8b340e2037178d5506211a9e8eecc10783a70c17e37b6b4c1970cd9896d4c9388ae612de65aa22139b92ae1c3fe4bea110bba
-
SSDEEP
3072:4c4MBT1Ie8rKp3PxZbDAjtHzaVcSNykAl:4aBTKeiKpfbEWTyd
Malware Config
Signatures
Files
-
f_0012ce.zip.zip
Password: infected
-
f_0012ce.exe windows x86
751152738cad4e24e19f9acb4ca3b952
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DecodePointer
DeleteCriticalSection
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
OpenEventW
CloseHandle
SetLastError
GetFileSize
SetFilePointer
ReadFile
WriteFile
GetFullPathNameW
CreateFileW
FindResourceW
LoadResource
SizeofResource
LockResource
GetCurrentProcess
GetNativeSystemInfo
GetFileSizeEx
DeleteFileW
MoveFileExW
FormatMessageW
GetConsoleMode
RaiseException
FlushFileBuffers
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
InitializeCriticalSectionEx
GetTempFileNameW
GetTempPathW
GetModuleHandleW
LoadLibraryExW
GetLastError
VirtualProtect
LCMapStringW
GetConsoleOutputCP
GetProcAddress
HeapReAlloc
HeapSize
GetFileType
HeapAlloc
HeapFree
WriteConsoleW
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwind
EncodePointer
FreeLibrary
user32
TranslateMessage
DispatchMessageW
SetWindowLongW
GetMessageW
PostQuitMessage
wsprintfW
GetWindowTextLengthW
IsDialogMessageW
ShowWindow
GetWindowLongW
GetDlgItem
CharLowerW
MessageBoxW
GetWindowTextW
DestroyWindow
EnableWindow
SetWindowTextW
ExitWindowsEx
SendMessageW
CreateDialogParamW
advapi32
RegSetKeyValueW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegDeleteKeyValueW
RegGetValueW
ole32
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
SysFreeString
comctl32
InitCommonControlsEx
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
ntdll
RtlGetNtVersionNumbers
RtlAdjustPrivilege
RtlNtStatusToDosError
RtlInitUnicodeString
NtOpenKey
NtClose
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtRenameKey
Sections
.text Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ