Static task
static1
Behavioral task
behavioral1
Sample
EasyRP-windows2 (XVideos)/config.ini
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
EasyRP-windows2 (XVideos)/easyrp.exe
Resource
win7-20230220-en
Behavioral task
behavioral3
Sample
EasyRP-windows2 (XVideos)/large.png
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
EasyRP-windows2 (XVideos)/readme.txt
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
EasyRP-windows2 (XVideos)/small.png
Resource
win7-20230220-en
General
-
Target
EasyRP-windows2 (XVideos).zip
-
Size
87KB
-
MD5
9e5774781a7313f7d8327e8b1ef59b9e
-
SHA1
385d1f0a6cd68d856003f1167cb55607855450ee
-
SHA256
dafe2ebb023e8719ec16a1a9d2694dcc5237440a8ef070fdf0a52620adecf219
-
SHA512
0c0f522c4ffc4feaaf39d77e4a208c092adb65ad571bd5bc0d6034dde70d96b0d0b09aae2a55e2296a301deb7e6b0b6b00f1373d02cebc2627932ac73103e03b
-
SSDEEP
1536:iYk/P9MdE191JoKjnf9BwTgd/FP5+q7dWPSYNgtB5zi7iGCvm5sbWco3cXgBSx4v:s9MdKjq81ya/FoEcgH5u7iGCuybBo3cK
Malware Config
Signatures
Files
-
EasyRP-windows2 (XVideos).zip.zip
-
EasyRP-windows2 (XVideos)/config.ini
-
EasyRP-windows2 (XVideos)/easyrp.exe.exe windows x86
13250bb03cc3654a1dffc4b2988f6641
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
GetLastError
WriteFile
WaitNamedPipeW
GetCurrentProcessId
IsDebuggerPresent
ReadFile
CreateFileW
MultiByteToWideChar
lstrlenW
PeekNamedPipe
GetModuleFileNameW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
CreateEventW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW
msvcp140
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
_Xtime_get_ticks
_Thrd_sleep
??0_Lockit@std@@QAE@H@Z
??Bid@locale@std@@QAEIXZ
??1_Lockit@std@@QAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
vcruntime140
__std_terminate
_except_handler4_common
memset
memmove
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__CxxFrameHandler3
memcpy
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_exit
exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initialize_narrow_environment
_invalid_parameter_noinfo
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_configure_narrow_argv
_controlfp_s
terminate
signal
_set_app_type
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_initterm
_errno
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-stdio-l1-1-0
__p__commode
__stdio_common_vsprintf
getchar
_set_fmode
_get_stream_buffer_pointers
__stdio_common_vswprintf
__stdio_common_vfprintf
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
fclose
__acrt_iob_func
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
isspace
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-math-l1-1-0
_except1
log2
__setusermatherr
ceil
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
EasyRP-windows2 (XVideos)/large.png.png
-
EasyRP-windows2 (XVideos)/readme.txt
-
EasyRP-windows2 (XVideos)/small.png.png