Static task
static1
Behavioral task
behavioral1
Sample
31f30a59d3fdc5eaa9d31217002759f8f51b9c6fb8e9e9e42aa297391256f888.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
31f30a59d3fdc5eaa9d31217002759f8f51b9c6fb8e9e9e42aa297391256f888.exe
Resource
win10v2004-20230220-en
General
-
Target
10013756274.zip
-
Size
1.6MB
-
MD5
83b31543d2ba784b9e37d5c3a03b7373
-
SHA1
6ad94cc8fc8805e36fd8892cf8a760b6cd59aa25
-
SHA256
b4acd3fad6b7eb7106a96416266cfc6eed76e9b052f1c0d88731f982b9f02d93
-
SHA512
09e2ea816005e475342b937436445bf9db5cef557201087b88b93b20686f635332117a91613f95f76f926a941b2d6de0be752cf77793a4cf8067dfb9d76b1a03
-
SSDEEP
49152:6oBKrvTDwedSWf1Vx25v67w9QcRi9xZKRQ:6oUvTDxbrsF1Qei9D
Malware Config
Signatures
Files
-
10013756274.zip.zip
Password: infected
-
31f30a59d3fdc5eaa9d31217002759f8f51b9c6fb8e9e9e42aa297391256f888.exe windows x86
00f374faba9b2b5aea1ec74c462b6565
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetFileAttributesExW
ReadFile
SetFilePointerEx
FlushFileBuffers
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapSize
RaiseException
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
CompareStringW
LCMapStringW
RtlUnwind
HeapReAlloc
AreFileApisANSI
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
ReadConsoleW
SetStdHandle
WriteConsoleW
CreateFileW
lstrlenA
LocalFree
LockResource
LoadResource
SizeofResource
FindResourceA
GetCurrentDirectoryA
SetFilePointer
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryA
InitializeCriticalSection
GetSystemInfo
Process32First
Process32Next
CreateToolhelp32Snapshot
GetProcAddress
GetModuleHandleExW
Sleep
GetProcessHeap
GetStartupInfoW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetFileType
GetStdHandle
MultiByteToWideChar
GetCurrentThreadId
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedIncrement
IsProcessorFeaturePresent
IsDebuggerPresent
GetCommandLineA
DecodePointer
EncodePointer
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
HeapFree
GetTimeZoneInformation
SetEndOfFile
CheckRemoteDebuggerPresent
GetTempPathA
CloseHandle
GetVersionExA
OutputDebugStringA
GetModuleHandleA
GetModuleFileNameA
WritePrivateProfileStringA
CreateFileMappingA
GetLastError
TerminateProcess
OpenProcess
WriteFile
GetCurrentProcess
InterlockedDecrement
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
ExitProcess
SetEnvironmentVariableA
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
shell32
ShellExecuteExA
ShellExecuteA
ole32
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
oleaut32
SysAllocString
VariantClear
SysFreeString
Sections
.text Size: 183KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ