Static task
static1
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win10-20230220-en
General
-
Target
explorer.exe
-
Size
398KB
-
MD5
cdf5e5ea0296cf8b73f2bf7669679444
-
SHA1
6d3ab3d53a05be038af30b8280823b2e63a04d2c
-
SHA256
d2f52b8fe041b0136e4ca0cf0424ab8576e503ecfbf4d2532b734811251e3c1f
-
SHA512
65589e4c648a345b87ef35d193281d13d46bc3d726d0207b479229b39e078e95ed00ea385affe645fb3fffe0a75f3f9e4fc060d6764c6be102f752c52adc0949
-
SSDEEP
12288:mxtLjY1sLYoQueC4vWIgTV7Oqno1DhOpyKw:0FhLYoQuezgTV7ZnlyD
Malware Config
Signatures
Files
-
explorer.exe.exe windows x64
88d87d77b9f43a520a2c129468e2eee5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
winhttp
WinHttpOpen
WinHttpDetectAutoProxyConfigUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
kernel32
Sleep
GetLastError
CloseHandle
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetCurrentDirectoryW
CreateFileW
IsProcessorFeaturePresent
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
InitializeCriticalSectionEx
CreatePipe
OutputDebugStringA
AreFileApisANSI
GetFileInformationByHandleEx
LocalFree
FormatMessageA
GetLocaleInfoEx
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
VerSetConditionMask
FreeLibrary
GetProcAddress
LoadLibraryA
ReadFile
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
VerifyVersionInfoA
GetTickCount64
SetLastError
SleepEx
WaitForSingleObjectEx
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetCurrentDirectoryW
ole32
CoCreateGuid
msvcp140
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
ws2_32
ntohl
getaddrinfo
freeaddrinfo
accept
socket
recvfrom
htonl
gethostname
sendto
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
WSAStartup
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSACleanup
WSAGetLastError
listen
advapi32
CryptAcquireContextA
CryptGenRandom
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext
wldap32
ord79
ord35
ord33
ord32
ord30
ord301
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord200
normaliz
IdnToAscii
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
strchr
memcpy
__current_exception_context
memmove
__std_terminate
__std_exception_copy
__std_exception_destroy
__current_exception
__C_specific_handler
memchr
strstr
memcmp
memset
strrchr
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_initterm_e
_getpid
strerror
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
__sys_nerr
_initterm
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_set_app_type
_errno
__p___argc
_invalid_parameter_noinfo_noreturn
terminate
_exit
exit
_seh_filter_exe
_cexit
api-ms-win-crt-heap-l1-1-0
_recalloc
free
_callnewh
calloc
realloc
malloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
strtoll
atoi
strtol
api-ms-win-crt-stdio-l1-1-0
fflush
fclose
fgetc
fwrite
__stdio_common_vsprintf
fgetpos
setvbuf
ungetc
fsetpos
fread
_fseeki64
__stdio_common_vfwprintf
fputc
_lseeki64
_close
_get_stream_buffer_pointers
_set_fmode
__p__commode
_read
_write
__acrt_iob_func
fgets
fopen
fputs
fseek
_open
__stdio_common_vsscanf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_fstat64
_stat64
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
_stricmp
strncpy
isalpha
isxdigit
strpbrk
isdigit
strncmp
isspace
isalnum
_strdup
isgraph
tolower
_strnicmp
isupper
islower
isprint
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1000B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ