Static task
static1
Behavioral task
behavioral1
Sample
Приложение2.lnk
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Приложение2.lnk
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
сканированный документ.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
сканированный документ.exe
Resource
win10v2004-20230221-en
General
-
Target
e581196f2635ba5cb25c3a1121a6ed58.bin
-
Size
327KB
-
MD5
e581196f2635ba5cb25c3a1121a6ed58
-
SHA1
b5e448b0b289fcae5c4b742b72e19531d71e897b
-
SHA256
0aad58903f0524b82a3388b1aa6302c974dfc4ac593435f2bc0f1b9eb3ced6db
-
SHA512
ec8e89521aa5e0c087d6c47474bc5710bc3092a44e1e14832d59e59a64f275163be8ed5e316b5072f48faee4018564560790cf655456c5deede364bb78e9a23c
-
SSDEEP
6144:lsHuhsGKLz6xKwAoUj8H5ZB72AmLLQ++S3hs7vpmWo0caVWBjDUYldA:l12fq1kSZh2AmL8CuvtcakhDy
Malware Config
Signatures
Files
-
e581196f2635ba5cb25c3a1121a6ed58.bin.rar
-
Приложение2.lnk.lnk
-
сканированный документ.exe.exe windows x86
a56224f8f13d3523c379cb4cbae0c709
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
WaitForMultipleObjects
CreateThread
GetCurrentThreadId
GetExitCodeThread
GetTickCount
VirtualAlloc
VirtualProtect
MultiByteToWideChar
WideCharToMultiByte
GetSystemDefaultLCID
FreeConsole
CreateIoCompletionPort
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetThreadId
GetThreadLocale
GetThreadPriority
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
IsWow64Process
K32GetPerformanceInfo
K32GetProcessMemoryInfo
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
HeapAlloc
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SleepEx
SuspendThread
SwitchToThread
SystemTimeToTzSpecificLocalTime
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
GetCommandLineA
EnterCriticalSection
WaitForSingleObject
CreateEventA
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
ReadConsoleW
ReadFile
SetFilePointerEx
GetFileSizeEx
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
HeapQueryInformation
FreeEnvironmentStringsW
GetCommandLineW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
CompareStringW
SetConsoleCtrlHandler
CreateFileW
WriteConsoleW
HeapDestroy
SetLastError
GetLastError
RaiseException
CloseHandle
SetEndOfFile
DecodePointer
GetFileType
WriteFile
GetStdHandle
HeapValidate
ExitProcess
VirtualQuery
GetSystemInfo
GetModuleHandleExW
GetModuleFileNameW
FreeLibrary
TlsFree
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualFree
user32
UnregisterClassA
IsWindow
SetWindowPos
EndDialog
GetClientRect
GetWindowRect
MessageBoxA
MapWindowPoints
DispatchMessageA
GetWindowLongA
SetWindowLongA
GetParent
CharNextW
CharNextA
CharUpperA
DialogBoxParamA
PostThreadMessageA
GetActiveWindow
TranslateMessage
GetMessageA
GetMonitorInfoA
MonitorFromWindow
GetWindow
advapi32
RegOpenKeyExA
RegDeleteKeyA
RegCloseKey
ConvertSidToStringSidW
AccessCheck
RegQueryInfoKeyA
shell32
SHGetFolderPathW
SHGetKnownFolderPath
ole32
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
oleaut32
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString
GetErrorInfo
VariantClear
VariantInit
SafeArrayDestroy
SysFreeString
Sections
.text Size: 725KB - Virtual size: 725KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 709KB - Virtual size: 725KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ