Static task
static1
Behavioral task
behavioral1
Sample
2d9985f7adc9b82f3701518854a6a2d62723e14c36ea07b60703b870ea418cd4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2d9985f7adc9b82f3701518854a6a2d62723e14c36ea07b60703b870ea418cd4.exe
Resource
win10v2004-20230220-en
General
-
Target
2d9985f7adc9b82f3701518854a6a2d62723e14c36ea07b60703b870ea418cd4
-
Size
805KB
-
MD5
5239bb15d403d4861bf48845151566cd
-
SHA1
e2abac18eecfaf8d6b149c172bb0a9ba95615c34
-
SHA256
2d9985f7adc9b82f3701518854a6a2d62723e14c36ea07b60703b870ea418cd4
-
SHA512
c9580e9ffbbac6f85c1df8556d13902f4e3666e39c4a20e0c2ed380359d98da72918f72d2fef344ee44bbd729198247223ea620b32950524dfb9f0c52229c75c
-
SSDEEP
24576:0iR7pCEw/qIpA7VwtcLg7Z/W8rl0x5sKDY:0ifCE+v27VwOLgTAs
Malware Config
Signatures
Files
-
2d9985f7adc9b82f3701518854a6a2d62723e14c36ea07b60703b870ea418cd4.exe windows x86
e13661d79abc57ece74dde2cd23e00cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLongPathNameW
GetModuleFileNameW
GetTempPathW
FindClose
GetSystemDirectoryW
lstrcpyW
GetTempFileNameW
Process32First
TerminateProcess
Process32Next
ReadFile
HeapFree
WriteFile
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
CreateFileW
GetCurrentThreadId
HeapSize
MultiByteToWideChar
GetLastError
HeapReAlloc
RaiseException
LoadLibraryW
HeapAlloc
DecodePointer
GetProcAddress
SetFilePointerEx
DeleteCriticalSection
GetProcessHeap
CreateProcessW
FreeLibrary
WideCharToMultiByte
GetNativeSystemInfo
GetCommandLineW
OutputDebugStringA
Sleep
OutputDebugStringW
WritePrivateProfileStringW
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateFileA
GetFileSize
GetCurrentProcessId
WriteProcessMemory
VirtualProtect
VirtualAllocEx
CreateRemoteThread
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
CreateDirectoryW
SetFileTime
SetFilePointer
GetFileAttributesW
SystemTimeToFileTime
Process32FirstW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualAlloc
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
GetCurrentProcess
LocalFree
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
ReadConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
FreeLibraryAndExitThread
ExitThread
CreateThread
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
LoadLibraryA
GetModuleHandleA
lstrlenW
CloseHandle
GetCurrentDirectoryW
GetVersionExW
DeviceIoControl
InterlockedCompareExchange
InterlockedExchange
SetEndOfFile
DeleteFileW
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
GetTickCount
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
GetExitCodeThread
GetCurrentThread
SwitchToThread
DuplicateHandle
TryEnterCriticalSection
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
user32
wsprintfW
advapi32
OpenProcessToken
RegOpenKeyExA
RegQueryValueExA
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
shell32
ord165
SHGetSpecialFolderPathA
CommandLineToArgvW
SHGetSpecialFolderPathW
oleaut32
VariantClear
libcrypto-3
SHA256_Update
SHA256_Final
SHA256_Init
shlwapi
StrStrIA
PathRemoveFileSpecW
PathCombineW
SHGetValueA
PathFileExistsW
PathFileExistsA
PathRemoveExtensionW
PathCombineA
PathAppendW
psapi
GetModuleFileNameExW
netapi32
Netbios
NetWkstaGetInfo
wininet
HttpQueryInfoA
HttpSendRequestW
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestW
HttpOpenRequestA
InternetReadFile
InternetConnectW
InternetConnectA
InternetCloseHandle
InternetOpenW
HttpQueryInfoW
ws2_32
inet_addr
recv
send
setsockopt
socket
gethostbyname
closesocket
htons
connect
winhttp
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpSetTimeouts
WinHttpSetOption
WinHttpSendRequest
Sections
.text Size: 595KB - Virtual size: 595KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ