Static task
static1
Behavioral task
behavioral1
Sample
95666d3161470fdf70ba38a06229359a64d86a5ef73fbcde299300220bb2ae3a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
95666d3161470fdf70ba38a06229359a64d86a5ef73fbcde299300220bb2ae3a.exe
Resource
win10v2004-20230221-en
General
-
Target
95666d3161470fdf70ba38a06229359a64d86a5ef73fbcde299300220bb2ae3a
-
Size
918KB
-
MD5
549803f56b37cd521e3a857ccaa50021
-
SHA1
cdf12bcaf7fb9f1dd3bf168388e162d4c29f0864
-
SHA256
95666d3161470fdf70ba38a06229359a64d86a5ef73fbcde299300220bb2ae3a
-
SHA512
3c23a8531e313e463679dd153c35482be2a230099a549e4a74fef27c047108adb421d0231bb26ca593ade4e7325c7528645de9671db9f7b9128ca3811ec7c0fb
-
SSDEEP
12288:Q3WXQe4/bTxP9t+nf2esakBIFl09BgwUnv8T6Zur4+4GHmG9:XFBnftZFyPhUkT6Zuk+40mG9
Malware Config
Signatures
Files
-
95666d3161470fdf70ba38a06229359a64d86a5ef73fbcde299300220bb2ae3a.exe windows x86
0f7ced18f0a947d89eb39eef3e044226
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
GetSystemInfo
GetModuleHandleA
CreateThread
SetFilePointer
ReadFile
GetStartupInfoW
MulDiv
CopyFileW
OutputDebugStringW
GetPrivateProfileStringW
CreateEventW
SetEvent
GetTickCount
GlobalMemoryStatusEx
GetVersion
GetEnvironmentVariableW
GetLocalTime
SetCurrentDirectoryW
SystemTimeToFileTime
GetModuleHandleExW
LocalFree
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
VirtualQuery
QueryPerformanceCounter
GetEnvironmentStringsW
GetVersionExW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
DebugBreak
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
ExitProcess
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
TlsGetValue
GetFileSizeEx
WriteFile
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CreateFileA
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
CreateToolhelp32Snapshot
GetFileAttributesW
Process32FirstW
Process32NextW
lstrlenA
SetUnhandledExceptionFilter
GetCommandLineW
Sleep
FindNextFileW
FindFirstFileW
FindClose
GetTempPathW
GetTempFileNameW
DeleteFileW
MultiByteToWideChar
SetLastError
lstrcmpiW
InterlockedDecrement
CreateProcessW
GetCurrentThreadId
lstrlenW
WideCharToMultiByte
CreateMutexW
LoadLibraryW
InterlockedIncrement
FlushInstructionCache
FindResourceExW
FreeLibrary
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
GetCurrentProcess
TerminateProcess
InterlockedExchange
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
LoadLibraryExW
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
FreeEnvironmentStringsW
user32
ShowWindow
RegisterClassW
SetForegroundWindow
IsIconic
FindWindowW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
SetRectEmpty
wsprintfW
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
CharNextW
DestroyWindow
MessageBoxW
GetActiveWindow
CreateDialogParamW
DefWindowProcW
ScreenToClient
PostMessageW
UnregisterClassA
SetWindowLongW
GetClassInfoW
BringWindowToTop
SetActiveWindow
GetCursorPos
GetSystemMetrics
LoadImageW
KillTimer
DialogBoxParamW
OffsetRect
CopyRect
SetFocus
SetTimer
MsgWaitForMultipleObjects
PostQuitMessage
SetWindowTextW
IsWindowVisible
ReleaseDC
GetDC
MoveWindow
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
SetWindowPos
GetClientRect
SendMessageW
GetWindowLongW
EndDialog
IsWindow
GetWindowRect
GetParent
gdi32
SelectObject
EnumFontFamiliesW
DeleteObject
CreateFontW
GetDeviceCaps
DeleteDC
GetTextExtentPoint32W
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
shell32
SHGetSpecialFolderPathA
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHCreateDirectoryExW
ole32
OleInitialize
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
OleUninitialize
CoUninitialize
oleaut32
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
DispCallFunc
VariantChangeType
VarUI4FromStr
SysStringByteLen
SysAllocStringByteLen
shlwapi
PathCombineW
PathIsRelativeW
PathFileExistsW
SHGetValueW
PathFileExistsA
SHGetValueA
PathCombineA
StrCmpIW
PathAppendA
PathCanonicalizeW
PathFindFileNameW
PathFindExtensionW
StrCmpW
SHSetValueW
PathRemoveFileSpecW
PathAppendW
PathRelativePathToW
comctl32
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
crypt32
CryptBinaryToStringA
psapi
EnumProcesses
Sections
.text Size: 465KB - Virtual size: 465KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wccfw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
niftg Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tjpnn Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
iripu Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gtsjd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ssjaj Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vqxtq Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xldmw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xjfff Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ahdam Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gtsvs Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qqqqb Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wqsjik Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
liidol Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bmnwvl Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rqlrem Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
useoln Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eoghrn Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
baefao Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eosbhp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tgtvop Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hwjpuq Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xquldr Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ehtgkr Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pxcfrs Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bhtlbt Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sndtju Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
chwopu Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kpgkwv Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ogmgfw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
btbcmw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vosxtx Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tsnsba Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hdccja Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wlwhrb Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fhkdac Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ctqxhd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uxjuod Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ruouve Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qujpdf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
whrnkf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
temkrg Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nbonbh Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
knwlii Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wjdopi Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gffhaj Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hpulk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE