Static task
static1
Behavioral task
behavioral1
Sample
D254D20193D80BA43C0469BF405FB9551F175F0883C01.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
D254D20193D80BA43C0469BF405FB9551F175F0883C01.exe
Resource
win10v2004-20230220-en
General
-
Target
D254D20193D80BA43C0469BF405FB9551F175F0883C01.exe
-
Size
239KB
-
MD5
ea0cca09e6a5760ead0988bdeed8cec7
-
SHA1
8d9202f77eff94f48cc2ebaae661109e5130b478
-
SHA256
d254d20193d80ba43c0469bf405fb9551f175f0883c01d43de3952363d81d97b
-
SHA512
75f71bfbb8e1cfc15fff2f2e64148467d8bfee740557c88b3418b0b2003285259f7f4e45df466e516d9c5cb2d64385d0c9b990979861c12ee2289887e58776f6
-
SSDEEP
6144:6cu/Rkm6HCu+8BIqrTxI3AWoG+5Sbh9fJRbLRl0ky5e58S1:hu/RMfImNTvGfFVJRbae58S1
Malware Config
Signatures
Files
-
D254D20193D80BA43C0469BF405FB9551F175F0883C01.exe.exe windows x86
edce1e4f666df37647680dff64999cde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetSystemFirmwareTable
GetPrivateProfileStructW
CreateRemoteThreadEx
GetCPInfoExW
SetSystemTimeAdjustment
ReadFile
InitializeSRWLock
QueryDosDeviceW
TryEnterCriticalSection
SetFileIoOverlappedRange
SetConsoleHistoryInfo
SetConsoleCtrlHandler
GetConsoleAliasExesLengthW
AddVectoredContinueHandler
EnumTimeFormatsW
GetVolumeInformationW
GetLogicalDrives
WriteProfileStringW
QueryThreadpoolStackInformation
QueryInformationJobObject
FindFirstVolumeMountPointW
GetCurrentProcessorNumberEx
GetOEMCP
StartThreadpoolIo
EnumTimeFormatsEx
SetThreadLocale
CompareFileTime
InitOnceBeginInitialize
FindFirstFileW
SearchPathW
InitOnceExecuteOnce
GetProcessShutdownParameters
CreateThreadpool
SetHandleInformation
HeapCreate
FindFirstFileExW
NeedCurrentDirectoryForExePathW
SetEventWhenCallbackReturns
LoadModule
CompareStringW
VirtualProtect
GetConsoleScreenBufferInfo
SetConsoleDisplayMode
CreateDirectoryTransactedW
HeapFree
SetPriorityClass
SetDefaultDllDirectories
FindFirstFileNameW
AddDllDirectory
EnterCriticalSection
GetCommandLineW
GetSystemTimeAdjustment
GetHandleInformation
QueryProtectedPolicy
FindNLSString
SetConsoleScreenBufferSize
SetProcessAffinityMask
GetThreadErrorMode
GetProcessDEPPolicy
EnumCalendarInfoW
ReleaseSemaphore
EnumResourceTypesW
Wow64DisableWow64FsRedirection
lstrcpynW
DeleteTimerQueue
CreatePrivateNamespaceW
UnregisterWait
GetConsoleCursorInfo
GetStringTypeExW
SetFileBandwidthReservation
VirtualAlloc
AssignProcessToJobObject
GetFinalPathNameByHandleW
WakeAllConditionVariable
DisassociateCurrentThreadFromCallback
AddSecureMemoryCacheCallback
WakeConditionVariable
ReOpenFile
WaitForMultipleObjects
SetEnvironmentVariableW
SetProcessShutdownParameters
GetGeoInfoW
AddScopedPolicyIDAce
SetConsoleWindowInfo
GetNumaProcessorNodeEx
GetUserDefaultLocaleName
GetNumaNodeNumberFromHandle
CreateJobObjectW
GetProductInfo
GetConsoleFontSize
DnsHostnameToComputerNameW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
CreatePipe
Wow64GetThreadContext
SetErrorMode
InitializeConditionVariable
GetProcessMitigationPolicy
TryAcquireSRWLockShared
EnumUILanguagesW
GetNumaAvailableMemoryNode
OpenFileById
SetEndOfFile
FindFirstFileTransactedW
EnumResourceNamesW
UnlockFileEx
CreateMutexW
TrySubmitThreadpoolCallback
GetPrivateProfileSectionW
WaitForThreadpoolTimerCallbacks
FindClose
LocalAlloc
GetFileAttributesW
UnregisterBadMemoryNotification
SetComputerNameExW
GetFileAttributesTransactedW
MapViewOfFileExNuma
DebugActiveProcessStop
lstrcmpA
GetVersionExW
ReleaseMutex
WriteTapemark
UnregisterApplicationRecoveryCallback
CancelThreadpoolIo
GetCommTimeouts
GetSystemDirectoryW
IsBadCodePtr
QueryMemoryResourceNotification
GetUILanguageInfo
ContinueDebugEvent
HeapValidate
IsProcessInJob
GetACP
DisconnectNamedPipe
RtlCaptureStackBackTrace
LCIDToLocaleName
OpenProcess
CloseThreadpoolWait
PostQueuedCompletionStatus
GetVolumeNameForVolumeMountPointW
QueueUserWorkItem
CloseThreadpoolCleanupGroup
CreateEventW
SetFileAttributesTransactedW
ConvertThreadToFiberEx
CloseThreadpoolCleanupGroupMembers
ResolveLocaleName
GetFileInformationByHandle
SetTapeParameters
QueryThreadProfiling
FormatMessageW
CancelSynchronousIo
GetTimeZoneInformation
ReadThreadProfilingData
SetConsoleScreenBufferInfoEx
GetDevicePowerState
LCMapStringEx
MoveFileWithProgressW
FlsSetValue
GetLastError
EnumSystemLocalesEx
SetUserGeoID
GetCalendarInfoW
EscapeCommFunction
GetConsoleAliasesLengthW
TzSpecificLocalTimeToSystemTime
ReleaseSRWLockExclusive
SetCriticalSectionSpinCount
AddResourceAttributeAce
SetFileInformationByHandle
OutputDebugStringW
GetMaximumProcessorGroupCount
WaitCommEvent
ReadConsoleInputW
GlobalSize
GetThreadUILanguage
GetUserDefaultLCID
GetLogicalProcessorInformation
GetNumaNodeProcessorMask
GetNamedPipeHandleStateW
GetCurrentThread
ReadConsoleOutputW
GetActiveProcessorGroupCount
GetNumaProximityNodeEx
EnumDateFormatsExEx
LoadLibraryA
lstrcatW
GetTapeParameters
SetWaitableTimerEx
CreateThreadpoolWait
PulseEvent
ReclaimVirtualMemory
QueryPerformanceFrequency
GlobalFlags
CreateHardLinkTransactedW
DeleteFileW
OpenSemaphoreW
InterlockedPushListSListEx
HeapReAlloc
WriteConsoleOutputAttribute
CreateThreadpoolCleanupGroup
AllocateUserPhysicalPagesNuma
CompareStringEx
EnumResourceLanguagesW
FindNLSStringEx
CreateSymbolicLinkTransactedW
WriteProfileSectionW
BindIoCompletionCallback
SetProcessWorkingSetSizeEx
GetThreadIOPendingFlag
ResetEvent
IsDBCSLeadByte
DeleteProcThreadAttributeList
DiscardVirtualMemory
HeapAlloc
Wow64SuspendThread
GetCurrencyFormatW
FileTimeToLocalFileTime
QueueUserAPC
FatalAppExitW
GetLocalTime
GetMemoryErrorHandlingCapabilities
GetNLSVersionEx
FillConsoleOutputAttribute
GetProcessPreferredUILanguages
UpdateResourceW
GetCurrentConsoleFontEx
CloseThreadpoolIo
SetThreadIdealProcessor
GetNamedPipeClientSessionId
GetThreadContext
ReadDirectoryChangesW
FlushConsoleInputBuffer
InitAtomTable
SetCurrentDirectoryW
PeekConsoleInputW
SetThreadPriorityBoost
VirtualLock
SetProcessDEPPolicy
Beep
GetProcAddress
UnregisterApplicationRestart
SetFilePointerEx
UnregisterWaitEx
DebugActiveProcess
GetProcessorSystemCycleTime
SetFileApisToOEM
ReplaceFileW
AcquireSRWLockShared
SetThreadStackGuarantee
DeleteCriticalSection
ExitProcess
LCMapStringW
ReadProcessMemory
GetComputerNameW
FindVolumeClose
EnumSystemLocalesW
GetProcessHeap
GetNumberOfConsoleInputEvents
GetModuleHandleW
CreateSemaphoreW
TransactNamedPipe
CopyFileW
SetThreadpoolStackInformation
CreateSymbolicLinkW
GetConsoleWindow
SetCommBreak
lstrcpyW
WinExec
CreateRemoteThread
RemoveVectoredContinueHandler
LocaleNameToLCID
VerifyVersionInfoW
SystemTimeToTzSpecificLocalTime
SetConsoleOutputCP
ConvertFiberToThread
GetSystemTimeAsFileTime
TerminateJobObject
Wow64GetThreadSelectorEntry
GetThreadGroupAffinity
GlobalMemoryStatus
GetFirmwareType
DeleteVolumeMountPointW
ReleaseSemaphoreWhenCallbackReturns
CopyFileExW
CreateWaitableTimerExW
SetConsoleCursorPosition
SetThreadPreferredUILanguages
SetThreadContext
FindNextVolumeW
SetFileValidData
lstrcmpiW
BackupSeek
FreeLibraryWhenCallbackReturns
FindNextStreamW
GetTickCount
GetEnvironmentStringsW
GlobalUnlock
SetCommState
SetDllDirectoryW
ConvertThreadToFiber
lstrcmpW
GetDllDirectoryW
GetStringTypeA
GetProcessHandleCount
LocalUnlock
IsWow64Process
CheckNameLegalDOS8Dot3W
GlobalReAlloc
LoadLibraryExW
DebugBreakProcess
GenerateConsoleCtrlEvent
GetConsoleSelectionInfo
DebugSetProcessKillOnExit
ReadConsoleOutputAttribute
WriteConsoleOutputCharacterW
CreateTimerQueue
WriteConsoleW
CloseHandle
CreateFileW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetModuleHandleExW
FindNextFileW
IsValidCodePage
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
HeapSize
DecodePointer
ole32
CoMarshalHresult
MonikerCommonPrefixWith
OleUninitialize
CoGetClassObject
CoGetObject
RevokeDragDrop
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 146KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ