Static task
static1
Behavioral task
behavioral1
Sample
a252f7487b96159fa8e7b195dd6796052c8e33f9f3f6942065a4a49595aa2892.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
a252f7487b96159fa8e7b195dd6796052c8e33f9f3f6942065a4a49595aa2892.exe
Resource
win10v2004-20230220-en
General
-
Target
a252f7487b96159fa8e7b195dd6796052c8e33f9f3f6942065a4a49595aa2892
-
Size
968KB
-
MD5
8d3cfa9bf58d63ca64a314c1adb5f951
-
SHA1
6a7f2185f88645d79e02ddb9e30033d631b5b0e8
-
SHA256
a252f7487b96159fa8e7b195dd6796052c8e33f9f3f6942065a4a49595aa2892
-
SHA512
26172515d68b431165ff3f0bd00942622cb6de6e3eae5ed1f707918d834dad45ed72c23a8d742583a4108d137696321d900450ce9bc15ef85d709ff2fb7612b4
-
SSDEEP
12288:j1PPuokcobSOyLA9IcSlalOInnueqAnpg4Bc6U/NghaaOCTf/lPcc:jVuodob9KcSlalOInnU8BcPNiHVTHlPX
Malware Config
Signatures
Files
-
a252f7487b96159fa8e7b195dd6796052c8e33f9f3f6942065a4a49595aa2892.exe windows x86
f0a94ac7cc3f7f74f8e067fe2bcba342
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
InitializeCriticalSectionAndSpinCount
RaiseException
GetLastError
GetPrivateProfileStringA
WritePrivateProfileStringA
DecodePointer
DeleteCriticalSection
FreeLibrary
LoadLibraryW
GetProcAddress
EndUpdateResourceW
CreateFileW
GetTempPathW
BeginUpdateResourceW
UpdateResourceW
CreateProcessW
GetModuleHandleW
GetExitCodeProcess
WaitForMultipleObjects
GetCurrentProcessId
LocalFree
ResumeThread
GetCurrentProcess
TerminateThread
Sleep
OpenThread
GetExitCodeThread
GetCurrentThreadId
SuspendThread
GetFileAttributesW
GetModuleFileNameW
ExpandEnvironmentStringsW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
OpenProcess
QueryDosDeviceW
WideCharToMultiByte
GetACP
MultiByteToWideChar
FindResourceW
LoadResource
GetVersionExW
LockResource
GetSystemInfo
lstrcmpiW
GetFileSize
SetFilePointer
SetEndOfFile
SetFileTime
WriteFile
ReadFile
GetFileTime
CreateMutexW
ReleaseMutex
GetCommandLineW
GetLongPathNameW
GetFileAttributesExW
HeapAlloc
HeapFree
GetProcessHeap
ResetEvent
InterlockedExchangeAdd
lstrlenW
GetFileSizeEx
DeleteFileW
FindClose
FindNextFileW
GetLogicalDriveStringsW
GetTickCount
InterlockedExchange
SetLastError
FileTimeToSystemTime
GetFullPathNameW
GetTempFileNameW
CreateDirectoryW
GetSystemDirectoryW
CopyFileW
GetCurrentDirectoryW
SetEnvironmentVariableA
SetFileAttributesW
FormatMessageW
DeviceIoControl
GlobalMemoryStatusEx
GetEnvironmentVariableW
LoadLibraryExW
SystemTimeToTzSpecificLocalTime
LocalAlloc
FlushFileBuffers
OutputDebugStringW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
CloseHandle
DeleteTimerQueueTimer
OpenEventW
CreateEventW
CreateTimerQueueTimer
GetPrivateProfileStringW
SetEvent
WaitForSingleObject
MoveFileExW
SetStdHandle
WriteConsoleW
ReadConsoleW
FindFirstFileW
GetWindowsDirectoryW
GetFileType
GetStdHandle
GetOEMCP
IsValidCodePage
HeapSize
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EncodePointer
GetStringTypeW
IsDebuggerPresent
IsProcessorFeaturePresent
CreateThread
ExitThread
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
user32
LoadIconW
TranslateMessage
LoadCursorW
CreateWindowExW
RegisterClassW
DefWindowProcW
DispatchMessageW
PostQuitMessage
GetMessageW
gdi32
GetStockObject
advapi32
OpenServiceW
OpenSCManagerW
CloseServiceHandle
GetUserNameW
AdjustTokenPrivileges
DuplicateTokenEx
SystemFunction036
QueryServiceConfigW
shell32
SHGetSpecialFolderPathW
ord680
imagehlp
ImageEnumerateCertificates
ImageRemoveCertificate
netapi32
NetLocalGroupGetMembers
Sections
.text Size: 794KB - Virtual size: 793KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ