Static task
static1
Behavioral task
behavioral1
Sample
d03855283010811f3c75c74ddb214bcdd32437c7921458738e72b019b5cdf682.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
d03855283010811f3c75c74ddb214bcdd32437c7921458738e72b019b5cdf682.exe
Resource
win10v2004-20230220-en
General
-
Target
d03855283010811f3c75c74ddb214bcdd32437c7921458738e72b019b5cdf682
-
Size
601KB
-
MD5
fd74f448b1f6baf60d9f53983ccd2c32
-
SHA1
6736f733d1282cb180ac69476bbd682a1fcb2e0e
-
SHA256
d03855283010811f3c75c74ddb214bcdd32437c7921458738e72b019b5cdf682
-
SHA512
470a1eea9b7db2d8054cdcbf36088d9ec81fc9829ad107153da708cfec95fbbc2f611214b4337d4128f90ee3f3e725ab38d1f61444d52dfe5a048ff7f7260ee4
-
SSDEEP
6144:OzLglbff0eTThVO2bPnbyTOpXcB6BqdXV2AfFP0u4i5rJBiZfBY0e+UP:OzLglb3FLFzbpcBBL4i5PeBY0eF
Malware Config
Signatures
Files
-
d03855283010811f3c75c74ddb214bcdd32437c7921458738e72b019b5cdf682.exe windows x64
cc0dfc2ac06112e293cc5ed77dec91f7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
OpenThread
Thread32First
SuspendThread
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleFileNameA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
WTSGetActiveConsoleSessionId
GetLastError
CreateMutexA
GetCommandLineA
CreateThread
GetExitCodeThread
GetCurrentProcessId
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCurrentThreadId
Module32NextW
Module32FirstW
WideCharToMultiByte
HeapFree
HeapAlloc
GetProcessHeap
ExpandEnvironmentStringsA
Process32NextW
Process32FirstW
SetEvent
ResetEvent
PulseEvent
OpenEventA
CreateEventA
LocalAlloc
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
RemoveDirectoryA
GetFileAttributesA
DeleteFileA
WritePrivateProfileStringA
MoveFileExA
ResumeThread
SetFilePointer
SetEndOfFile
ReadFile
FlushFileBuffers
GetFileTime
GetFileSize
DeviceIoControl
FreeLibrary
GetLocalTime
GetTempPathA
GetSystemInfo
GlobalMemoryStatus
GetComputerNameA
GetTickCount
QueryDosDeviceA
GetLogicalDriveStringsA
GetDriveTypeA
SetLocalTime
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MapViewOfFile
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingA
OpenFileMappingA
GetSystemDirectoryA
GetWindowsDirectoryA
CompareStringW
CreateFileW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
WriteConsoleW
SetStdHandle
GetDriveTypeW
HeapReAlloc
LoadLibraryW
SetConsoleCtrlHandler
GetLocaleInfoW
SetEnvironmentVariableA
LCMapStringW
IsValidCodePage
GetOEMCP
Thread32Next
Module32First
Sleep
Module32Next
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
VirtualFreeEx
ReadProcessMemory
FlushInstructionCache
GetPriorityClass
GetSystemTime
SystemTimeToFileTime
GetProcessTimes
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetModuleHandleA
OpenProcess
FreeResource
GetVersionExA
LoadLibraryA
GetProcAddress
GetCurrentProcess
LocalFree
CopyFileA
CloseHandle
GetACP
GetCPInfo
GetTimeZoneInformation
FatalAppExitA
GetConsoleMode
GetConsoleCP
MultiByteToWideChar
SetCurrentDirectoryW
GetCurrentDirectoryW
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
HeapSize
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
FlsAlloc
GetCurrentThread
SetLastError
GetStartupInfoW
RtlUnwindEx
RtlLookupFunctionEntry
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileExA
RaiseException
RtlPcToFileHeader
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
FlsGetValue
FlsSetValue
FlsFree
user32
RegisterClassExA
DispatchMessageA
TranslateMessage
GetMessageA
ExitWindowsEx
DestroyWindow
GetClassInfoExA
CreateWindowExA
ShowWindow
UpdateWindow
LoadCursorA
SetWindowLongPtrA
GetWindowLongPtrA
DefWindowProcA
UnregisterDeviceNotification
PostMessageA
RegisterDeviceNotificationA
advapi32
AddAccessAllowedAce
AddAccessDeniedAce
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
EqualSid
CopySid
BuildSecurityDescriptorA
InitializeSecurityDescriptor
GetLengthSid
ConvertSidToStringSidA
ConvertStringSidToSidA
BuildTrusteeWithSidA
BuildTrusteeWithNameA
LookupAccountSidA
DuplicateTokenEx
GetTokenInformation
SetTokenInformation
CreateProcessAsUserA
LookupPrivilegeValueA
AdjustTokenPrivileges
AllocateAndInitializeSid
CreateWellKnownSid
SetEntriesInAclA
SetNamedSecurityInfoA
OpenProcessToken
FreeSid
InitializeAcl
shell32
SHGetFolderPathA
SHGetFileInfoA
ole32
CoCreateGuid
psapi
EnumProcessModules
GetModuleFileNameExA
EnumProcesses
GetModuleFileNameExW
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
setupapi
CM_Get_Parent
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
CM_Get_Device_IDA
Sections
.text Size: 208KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 319KB - Virtual size: 319KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ