Static task
static1
Behavioral task
behavioral1
Sample
26f89f5c4c403775d27f60d5859c46a1818d6930e582fb859d5b1527c2a89587.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
26f89f5c4c403775d27f60d5859c46a1818d6930e582fb859d5b1527c2a89587.exe
Resource
win10v2004-20230221-en
General
-
Target
26f89f5c4c403775d27f60d5859c46a1818d6930e582fb859d5b1527c2a89587
-
Size
537KB
-
MD5
f835b19ee6427df1527a0d57ca7333cc
-
SHA1
5fb725b2d1e078bfa283b7e80829c8fa97ee1229
-
SHA256
26f89f5c4c403775d27f60d5859c46a1818d6930e582fb859d5b1527c2a89587
-
SHA512
2fd3fea92fc97b6abff9a35c9327cefbfe454f7a1d7708c6e73b2782362a39428a34c0db83ac22a68d35976e7fc75c204a5bd22be9cc80fc4eec35717bdbfe0a
-
SSDEEP
6144:rE/Kn0dkWog0mX8CiS2LlCCxJ5vI7rY/GPG:/1+XniS27l+rY/GPG
Malware Config
Signatures
Files
-
26f89f5c4c403775d27f60d5859c46a1818d6930e582fb859d5b1527c2a89587.exe windows x86
e51803e0e59f598c5cbaa1ff888ad2bf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoGetActivationFactory
RoInitialize
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateStringReference
shlwapi
SHGetValueW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
SHStrDupW
StrStrW
kernel32
GetProcAddress
GetModuleHandleW
GetCurrentThreadId
GetTempPathW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetModuleFileNameW
DeleteFileW
LeaveCriticalSection
FreeLibrary
EnterCriticalSection
GetCurrentProcessId
CloseHandle
DeviceIoControl
CreateFileW
LoadLibraryW
Sleep
GetTickCount
CreateEventW
SetEvent
GetEnvironmentVariableW
RaiseException
MultiByteToWideChar
WideCharToMultiByte
GetThreadLocale
SetThreadLocale
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcess
GetPrivateProfileStringW
ReadFile
EnumSystemLocalesW
GetFileAttributesExW
InitializeCriticalSection
GetVersionExW
IsValidLocale
GetLocaleInfoW
GetStringTypeW
LoadLibraryExW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStartupInfoW
GetConsoleCP
GetConsoleMode
SetStdHandle
FindAtomW
DeleteAtom
TlsFree
GetCommandLineW
GetFileType
GetStdHandle
GetModuleHandleExW
TlsAlloc
IsProcessorFeaturePresent
IsDebuggerPresent
ReleaseMutex
AddAtomW
ExitProcess
InterlockedIncrement
RtlUnwind
DeleteCriticalSection
GetUserDefaultLCID
lstrlenA
ReadConsoleW
FlushFileBuffers
SetFilePointer
WriteConsoleW
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
LCMapStringW
CreateFileA
SystemTimeToFileTime
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SetFilePointerEx
WriteFile
GetFileSizeEx
OutputDebugStringW
FormatMessageW
SetLastError
LocalFree
GetSystemTime
CreateMutexW
TlsGetValue
WaitForSingleObject
TlsSetValue
GetAtomNameW
OpenThread
InterlockedDecrement
user32
BringWindowToTop
PostMessageW
FindWindowW
SetForegroundWindow
SystemParametersInfoW
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
EnumWindows
GetClassNameW
PostThreadMessageW
GetForegroundWindow
SendInput
MessageBoxW
IsWindow
advapi32
RegQueryValueExA
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetFolderPathW
SHCreateDirectoryExW
ShellExecuteW
ord165
ole32
PropVariantClear
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
VariantClear
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
imm32
ImmDisableIME
Sections
.text Size: 201KB - Virtual size: 201KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 55KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
cjuvv Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bogmg Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wvjfm Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rlrgt Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
verec Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hfwtj Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sxcmp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
msxhw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ffoxe Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aefrl Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ulrns Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uxlkb Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dcvchk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bahtnk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xhmpul Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vehmdm Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pliikn Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gmucrn Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gpbvxo Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bahtgp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
eosnnp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
reriuq Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
amifcr Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hdaajr Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xcftqs Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
whteat Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
snpniu Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ruoipu Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uchdvv Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mbmwew Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mdtvlw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ngkpsx Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ogamba Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wxtsja Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
knwxqb Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
opiuxc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aoppgd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kfwond Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qeknue Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ulfhdf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sxogkf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bjpdrg Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qipgah Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hdmghh Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rbhhpi Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nseaaj Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jamd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE