Static task
static1
Behavioral task
behavioral1
Sample
7c3f6f7cc4798c7b02a64ddddec338fb8569121005f34a39269cda7cc74d5749.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
7c3f6f7cc4798c7b02a64ddddec338fb8569121005f34a39269cda7cc74d5749.exe
Resource
win10v2004-20230220-en
General
-
Target
7c3f6f7cc4798c7b02a64ddddec338fb8569121005f34a39269cda7cc74d5749
-
Size
1.6MB
-
MD5
e5b8c2154587315e31e3d9e0d1251a26
-
SHA1
69928d909583009ef75fecdef82fb214e4076a88
-
SHA256
7c3f6f7cc4798c7b02a64ddddec338fb8569121005f34a39269cda7cc74d5749
-
SHA512
e0653b0574e0d4edb13e5ec57cf65c8ff084a442d8381ca71473a2e1a1ae3f95488ce7463c2f7e10fafb349de11ab17fb3cfa754ab73b369ef0f037c0a2fbae3
-
SSDEEP
24576:LZJfdVRtENVvqBO0UXR+d2hSdwbJvU33y+AH8Apc/vvlyzAswP9T:FJfdHlxd2hkMc33yThpwvvzswp
Malware Config
Signatures
Files
-
7c3f6f7cc4798c7b02a64ddddec338fb8569121005f34a39269cda7cc74d5749.exe windows x86
c35498fb25e7bc7d99f79f777a3916fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileTime
GetUserDefaultLangID
GetFileSizeEx
FlushInstructionCache
GetThreadLocale
SetThreadLocale
GetShortPathNameW
GetLocalTime
GetCommandLineW
GetModuleHandleExW
ResetEvent
OpenMutexW
WaitForMultipleObjects
GlobalReAlloc
lstrcmpW
lstrcpyW
lstrcpynW
GetCurrentThread
GetProcessId
SetCurrentDirectoryW
FindFirstFileW
RemoveDirectoryW
FindNextFileW
FindClose
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetFileAttributesW
WriteFile
SetFilePointer
GetStartupInfoW
LocalAlloc
SuspendThread
SetThreadContext
GetThreadContext
ResumeThread
VirtualQuery
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
FlushFileBuffers
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
CreateDirectoryW
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
GetACP
GetModuleFileNameA
HeapCreate
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
CreateThread
ExitThread
ExitProcess
IsDebuggerPresent
UnhandledExceptionFilter
TlsFree
TlsAlloc
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
TlsSetValue
OutputDebugStringW
TlsGetValue
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
DeleteFileW
DeviceIoControl
SetFileAttributesW
OpenProcess
GetTickCount
GetExitCodeProcess
CreateProcessW
GetSystemInfo
ReadFile
InterlockedExchange
GlobalUnlock
GlobalLock
SetEvent
CreateEventW
lstrlenA
WaitForSingleObject
SetLastError
CloseHandle
CreateFileW
GetCurrentProcessId
WideCharToMultiByte
GetPrivateProfileIntW
GetVersion
GetEnvironmentVariableW
GetSystemDirectoryW
GetSystemWindowsDirectoryW
SetErrorMode
VirtualProtect
GetModuleHandleA
SetUnhandledExceptionFilter
CreateMutexW
TerminateProcess
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
MultiByteToWideChar
GetLastError
lstrcmpiW
GetModuleHandleW
GetCurrentThreadId
GetCurrentProcess
FreeLibrary
SizeofResource
Sleep
InterlockedCompareExchange
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetVersionExW
lstrlenW
RaiseException
FreeResource
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsW
GetModuleFileNameW
GetProcAddress
GetWindowsDirectoryW
MulDiv
FindResourceExW
FindResourceW
LoadResource
LockResource
GetUserDefaultLCID
user32
GetClassNameW
GetDoubleClickTime
AttachThreadInput
ReleaseDC
UnregisterClassA
GetDC
LoadImageW
GetSystemMetrics
DefWindowProcW
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DestroyWindow
FindWindowW
LoadCursorW
LoadIconW
SetLayeredWindowAttributes
GetAsyncKeyState
DialogBoxIndirectParamW
DestroyAcceleratorTable
InvalidateRgn
ClientToScreen
CreateAcceleratorTableW
GetSysColor
SetFocus
GetFocus
IsChild
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
DestroyIcon
UpdateLayeredWindow
FindWindowExW
SetCursor
DrawIconEx
GetActiveWindow
MessageBoxW
CreateWindowExW
GetClassInfoExW
EnumChildWindows
IsRectEmpty
GetDlgCtrlID
GetShellWindow
CopyRect
GetForegroundWindow
RegisterClassExW
EndDialog
TrackMouseEvent
EqualRect
RedrawWindow
wsprintfW
MoveWindow
MonitorFromWindow
GetMonitorInfoW
WaitForInputIdle
PrintWindow
RegisterWindowMessageW
SendMessageTimeoutW
GetWindowDC
IsWindowVisible
GetWindowThreadProcessId
GetWindow
GetDesktopWindow
SystemParametersInfoW
IsWindow
CallWindowProcW
GetDlgItem
BringWindowToTop
PostQuitMessage
SetActiveWindow
SetForegroundWindow
ShowWindow
SetTimer
ScreenToClient
BeginPaint
EndPaint
GetCursorPos
WindowFromPoint
KillTimer
GetWindowLongW
GetWindowRect
MapWindowPoints
SetWindowPos
SetWindowLongW
GetCapture
SetCapture
ReleaseCapture
PostMessageW
InvalidateRect
OffsetRect
GetParent
SendMessageW
UpdateWindow
GetClientRect
GetClassLongW
FillRect
IntersectRect
DrawTextW
PtInRect
SetRectEmpty
gdi32
BitBlt
CreateDCW
GetDIBits
SetStretchBltMode
StretchBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
GetObjectW
GetStockObject
EnumFontFamiliesExW
CreateFontIndirectW
DeleteEnhMetaFile
PlayEnhMetaFile
GetEnhMetaFileHeader
SetEnhMetaFileBits
GetDeviceCaps
TextOutW
GetTextColor
SetBkMode
GetTextExtentPoint32W
GetClipBox
ExcludeClipRect
SetViewportOrgEx
OffsetViewportOrgEx
IntersectClipRect
SaveDC
RestoreDC
SetBkColor
ExtTextOutW
SetDIBits
SetDIBColorTable
CreateDIBSection
DeleteDC
CreateSolidBrush
SetTextColor
advapi32
RegQueryValueExA
RegCloseKey
FreeSid
EqualSid
IsValidSid
AllocateAndInitializeSid
GetTokenInformation
DuplicateTokenEx
SaferCloseLevel
CreateProcessAsUserW
SaferComputeTokenFromLevel
SaferCreateLevel
OpenProcessToken
RevertToSelf
ImpersonateLoggedOnUser
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
SHAppBarMessage
SHCreateDirectoryExW
SHGetFolderPathW
SHFileOperationW
ole32
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
OleUninitialize
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoInitializeEx
CoInitializeSecurity
oleaut32
VariantCopy
SafeArrayCopy
SafeArrayGetVartype
SafeArrayGetUBound
SafeArrayGetLBound
OleCreateFontIndirect
DispCallFunc
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantInit
LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
VarBstrCmp
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
VarUI4FromStr
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
shlwapi
PathAppendW
PathFileExistsW
SHGetValueW
StrStrW
StrStrIW
PathCombineW
SHDeleteValueW
PathIsRelativeW
PathCanonicalizeW
StrCmpIW
PathIsDirectoryW
PathIsRootW
PathFindFileNameW
PathRemoveArgsW
PathUnquoteSpacesW
SHQueryValueExW
SHSetValueW
PathRemoveFileSpecW
comctl32
InitCommonControlsEx
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
imm32
ImmDisableIME
rpcrt4
NdrClientCall2
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
Sections
.text Size: 889KB - Virtual size: 889KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 29KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 192KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
chkuv Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
jrxlf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ecaem Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gmgft Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kuldc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nsqsj Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hpulp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tsngw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uqiwe Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
snsql Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wlkns Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mwcja Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rsqbhk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xobtnk Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bhfoul Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tsbmdm Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tvxhkn Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ecobqn Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uctvxo Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ppbtgp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mslnnp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nujiuq Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nuxecr Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ffoxjr Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ujusqs Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
onndat Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hfkniu Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xjiipu Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ekbcvv Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wxewew Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sqnulw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
btbosx Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
usslba Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
efkria Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ctqxqb Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sbatxc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fahpgd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bqqnnd Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bccmue Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dmugdf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gmgfkf Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
slidrg Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
txhfah Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npgfhh Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
rlrgpi Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
xjrxxj Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
erec Size: 4KB - Virtual size: 4KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE