Static task
static1
Behavioral task
behavioral1
Sample
0de1edbdca9dd58d429785ab0230ab6f3f9da9d790e24bf9a2d60a938fef8485.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0de1edbdca9dd58d429785ab0230ab6f3f9da9d790e24bf9a2d60a938fef8485.dll
Resource
win10v2004-20230220-en
General
-
Target
94a0fae9208ecd7dee98aa76da0c3c6b.bin
-
Size
4.0MB
-
MD5
b410458b542d7e7e67288174d1d7c49a
-
SHA1
5acbe655f26c9151ec89c059111f0b50afd6120b
-
SHA256
f5da130b22834d5959dc4de4b9976b861c6ad2f03669b73acc50c842a3a529af
-
SHA512
e8b06bde5ed13563ff8b5003b0dd97593e95201f8d375498cdab9d23b1aac6d0670bd802217b8507db9a42c63c8499a1ca00a41f97ecb96922bbf27de31fb3dd
-
SSDEEP
98304:hpa/h0PEi3axkY5AyswbVvAVN+4q6WeWNccV5XgPzID:hIJ08svYuBVI4nGHVxgPz8
Malware Config
Signatures
Files
-
94a0fae9208ecd7dee98aa76da0c3c6b.bin.zip
Password: infected
-
0de1edbdca9dd58d429785ab0230ab6f3f9da9d790e24bf9a2d60a938fef8485.bin.dll windows x86
Password: infected
d3ae3073349bdd6d1f70657734211656
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
closesocket
getaddrinfo
WSAStartup
send
socket
connect
recv
freeaddrinfo
WSAGetLastError
kernel32
FormatMessageA
LocalFree
InitializeSListHead
CreateDirectoryA
VirtualProtect
GetEnvironmentVariableA
GetTickCount
FindFirstFileA
FindNextFileA
FindClose
GetWindowsDirectoryA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
QueryPerformanceCounter
FreeConsole
CreateThread
Beep
AllocConsole
GetCurrentProcess
GetModuleHandleA
K32GetModuleInformation
EnterCriticalSection
GetModuleFileNameA
SetUnhandledExceptionFilter
FindFirstFileExW
FindNextFileW
AreFileApisANSI
CloseHandle
LeaveCriticalSection
GetLastError
FreeLibrary
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
IsProcessorFeaturePresent
IsDebuggerPresent
LoadLibraryExA
FlushInstructionCache
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
ResetEvent
TerminateProcess
user32
OpenClipboard
ReleaseCapture
SetCapture
GetCapture
GetCursorPos
SetCursorPos
EmptyClipboard
SetCursor
GetForegroundWindow
CallWindowProcA
IsChild
ClientToScreen
ScreenToClient
LoadCursorA
GetAsyncKeyState
GetClipboardData
CloseClipboard
GetClientRect
GetKeyState
SetClipboardData
shell32
ShellExecuteA
SHGetFolderPathA
msvcp140
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?fail@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?bad@ios_base@std@@QBE_NXZ
_Xtime_get_ticks
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
d3dx9_43
D3DXCreateTextureFromFileA
D3DXCreateTextureFromFileInMemoryEx
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
xinput1_4
ord2
ord4
vcruntime140
__std_exception_copy
strchr
_purecall
strstr
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
__current_exception_context
__std_exception_destroy
_setjmp3
memchr
memmove
longjmp
strrchr
memcpy
memcmp
memset
__current_exception
__CxxFrameHandler3
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
realloc
free
api-ms-win-crt-math-l1-1-0
ceil
_dsign
_libm_sse2_pow_precise
copysignf
fmaxf
llround
ldexp
_dclass
_fdclass
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
frexp
floor
_CIatan2
_CIfmod
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_sin_precise
_libm_sse2_atan_precise
api-ms-win-crt-runtime-l1-1-0
strerror
abort
_initterm_e
_initterm
_cexit
_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_errno
system
_register_onexit_function
exit
terminate
_crt_atexit
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
fgets
tmpfile
_popen
_pclose
_ftelli64
clearerr
__stdio_common_vsscanf
fopen
fsetpos
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fputc
feof
fflush
ferror
fclose
freopen
getc
fgetc
fseek
__acrt_iob_func
ftell
__stdio_common_vfprintf
fwrite
fgetpos
setvbuf
tmpnam
ungetc
_wfopen
fread
_fseeki64
_get_stream_buffer_pointers
api-ms-win-crt-string-l1-1-0
isblank
isgraph
isdigit
toupper
isalpha
isalnum
strspn
strcoll
isspace
strpbrk
strncpy
isupper
strncmp
islower
isxdigit
ispunct
strcpy_s
iscntrl
tolower
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
strtod
strtoll
atof
atoi
strtol
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
rename
remove
_lock_file
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_codepage_func
localeconv
api-ms-win-crt-time-l1-1-0
_difftime64
_mktime64
strftime
_localtime64
_time64
_gmtime64
clock
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 463KB - Virtual size: 462KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.6MB - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ