Static task
static1
Behavioral task
behavioral1
Sample
65a5d046a74c558023c0b18dd5e56f011e9973e69e7a1fa5ac17963a3bb858f1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
65a5d046a74c558023c0b18dd5e56f011e9973e69e7a1fa5ac17963a3bb858f1.exe
Resource
win10v2004-20230220-en
General
-
Target
65a5d046a74c558023c0b18dd5e56f011e9973e69e7a1fa5ac17963a3bb858f1
-
Size
240KB
-
MD5
ddc5a5f1e56cba5cd0d4c41116ede7bb
-
SHA1
d166b10c63537d533a93b25744c44557e1ad725d
-
SHA256
65a5d046a74c558023c0b18dd5e56f011e9973e69e7a1fa5ac17963a3bb858f1
-
SHA512
c6c61550d945e041480eec0ff412ba34dfe80dea9ba3442e2befee7e5099f8a6317978f6b54ce40515f07dc773726c2aa41ebc481c7e5d43222fe92efa899cad
-
SSDEEP
6144:F86kObXKZavLRgdm5B96xA2BHOBO2o7wp8:2KK0vFim5jkH9OcR
Malware Config
Signatures
Files
-
65a5d046a74c558023c0b18dd5e56f011e9973e69e7a1fa5ac17963a3bb858f1.exe windows x86
85799f3bc0dc7b42ad34750c298dad2f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
timeGetTime
stlport_x5.5.2
??6?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?empty@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBE_NXZ
?append@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@ABV12@II@Z
?clear@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEXXZ
?push_back@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEXD@Z
?clear@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEXXZ
?push_back@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEX_W@Z
?put@?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV12@D@Z
??1?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@XZ
?_M_put_nowiden@?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEXPBD@Z
?_M_put_widen@?$basic_ostream@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QAEXPBD@Z
??0?$allocator@_W@stlp_std@@QAE@XZ
??0?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@PB_WABV?$allocator@_W@1@@Z
??1?$allocator@_W@stlp_std@@QAE@XZ
?c_str@?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QBEPB_WXZ
??1?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@XZ
??Y?$basic_string@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEAAV01@PB_W@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@PBDABV?$allocator@D@1@@Z
?width@ios_base@stlp_std@@QAE_J_J@Z
??0?$basic_ofstream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAE@PBDH@Z
?is_open@?$basic_ofstream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAE_NXZ
??_D?$basic_ofstream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEXXZ
?flush@?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV12@XZ
??6?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV01@H@Z
??6?$basic_ostream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEAAV01@I@Z
?close@?$basic_ofstream@DV?$char_traits@D@stlp_std@@@stlp_std@@QAEXXZ
?assign@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@PBD@Z
??0?$basic_stringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAE@H@Z
??6?$basic_ostream@_WV?$char_traits@_W@stlp_std@@@stlp_std@@QAEAAV01@H@Z
??_D?$basic_stringstream@_WV?$char_traits@_W@stlp_std@@V?$allocator@_W@2@@stlp_std@@QAEXXZ
??Y?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@PBD@Z
?get_allocator@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBE?AV?$allocator@D@2@XZ
?size@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBEIXZ
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@U_String_reserve_t@priv@1@IABV?$allocator@D@1@@Z
?append@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@ABV01@@Z
??4?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@ABV01@@Z
?c_str@?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QBEPBDXZ
??0?$allocator@D@stlp_std@@QAE@XZ
??0?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAE@ABV?$allocator@D@1@@Z
??1?$allocator@D@stlp_std@@QAE@XZ
??4?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@PBD@Z
??Y?$basic_string@DV?$char_traits@D@stlp_std@@V?$allocator@D@2@@stlp_std@@QAEAAV01@D@Z
msvcr90
tolower
sscanf
memmove
strstr
strtoul
strchr
_iob
fopen
fread
strrchr
__CxxFrameHandler3
_findfirst32
_snprintf
strlen
_findclose
_findnext32
_access
printf
sprintf
memset
_time32
_localtime32_s
_vsnprintf
_purecall
memcpy
wcscmp
sprintf_s
strncpy
isxdigit
free
wcslen
atoi
fclose
fwrite
fopen_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
fseek
_strtoi64
strncmp
fgets
qsort
fputs
isdigit
strtol
fputc
_errno
isspace
memchr
fflush
getenv
strerror
_sys_nerr
isalnum
isalpha
_beginthreadex
_stat32i64
_gmtime32
_strdup
realloc
calloc
_mkdir
_stricmp
malloc
kernel32
WaitForSingleObject
CloseHandle
FormatMessageA
ExpandEnvironmentStringsA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetSystemDirectoryA
SetLastError
SleepEx
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
FreeLibrary
LoadLibraryA
GetCurrentProcess
SetPriorityClass
GetLastError
Sleep
CreateThread
GetStartupInfoA
user32
EndPaint
BeginPaint
DefWindowProcA
DestroyWindow
DialogBoxParamA
EndDialog
DispatchMessageW
TranslateMessage
PostQuitMessage
PeekMessageW
MessageBoxA
ShowWindow
UpdateWindow
RegisterClassExA
LoadCursorA
LoadIconA
GetMessageW
CreateWindowExA
gdi32
DeleteObject
vfsdllproj
?ShutdownVFS@VFS@@YAXXZ
?InitVFS@VFS@@YAHPBD@Z
ws2_32
recv
send
getsockname
ntohs
bind
htons
getsockopt
setsockopt
connect
socket
inet_addr
WSAGetLastError
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
__WSAFDIsSet
select
ioctlsocket
WSAStartup
WSACleanup
gethostbyname
closesocket
Sections
.text Size: 135KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ