Static task
static1
Behavioral task
behavioral1
Sample
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a.exe
Resource
win10v2004-20230220-en
General
-
Target
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a.zip
-
Size
327KB
-
MD5
2589afa8504a3eb26dcf5e246f5a6a87
-
SHA1
d216a672ce9f11f6feed678abc99e770b7a579a1
-
SHA256
9c1642f1760a370e31393e6aedaebf9b14b46e46be242f81a5520305fa9829d3
-
SHA512
71291d4897a8db9ebd30032fa06c03120a58077a1032ff620d2c110d0d0a1e6f94d75263816e9fef918dd0abd547d461567249106af64c9029bcdece15a3496f
-
SSDEEP
6144:EkL6oxIKp9+e+Hh+eY1xC6QuOiTr6u9Wx3txlF/mdaADQEZ6:t6aIevQrYTQu7gPP/+PZ6
Malware Config
Signatures
Files
-
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a.zip.zip
Password: threatbook
-
49ccddf2c0a548a0911134ac33a88ec79c4e12cb5c01bf6b1b684b224ee3d77a.exe windows x86
Password: threatbook
d7b7109d37556980217c9faa811b7d46
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
GetFileInformationByHandle
GetFileSize
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
ReleaseMutex
WaitForSingleObject
FindClose
GetLastError
CreateFileW
IsDBCSLeadByteEx
CopyFileA
FreeLibrary
LoadLibraryA
SetFileAttributesA
GetCurrentThreadId
GetProcAddress
InterlockedDecrement
SystemTimeToTzSpecificLocalTime
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateMutexA
WinExec
EncodePointer
DecodePointer
RaiseException
RtlUnwind
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
FindFirstFileExA
GetCommandLineA
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
InterlockedIncrement
IsValidCodePage
GetOEMCP
GetCPInfo
SetLastError
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetConsoleCP
GetProcessHeap
GetTimeZoneInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetStringTypeW
FlushFileBuffers
DeleteFileW
GetFileAttributesExW
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
LoadLibraryExW
LoadLibraryW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
lstrlenA
LocalFree
SetFilePointer
ReadFile
WriteFile
FileTimeToSystemTime
SystemTimeToFileTime
OutputDebugStringA
GetVersionExA
CreateFileA
GetLocalTime
CloseHandle
DeviceIoControl
WideCharToMultiByte
MultiByteToWideChar
FindNextFileA
FindFirstFileA
DeleteFileA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleFileNameA
Sleep
GetACP
InitializeCriticalSectionAndSpinCount
user32
GetDesktopWindow
GetSystemMetrics
advapi32
StartServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
ChangeServiceConfig2A
RegCreateKeyA
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
ole32
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromProgID
CoCreateGuid
oleaut32
SysFreeString
GetErrorInfo
SysAllocString
VariantClear
jsdevinfodll
jsk_operate_r
shlwapi
PathIsDirectoryA
wininet
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetReadFile
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
InternetOpenA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetSetOptionA
InternetQueryOptionA
InternetWriteFile
Sections
.text Size: 489KB - Virtual size: 488KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 118KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ