Static task
static1
Behavioral task
behavioral1
Sample
2895148b9e295b0762ab6158910c9868553516033be858499e5f850bd7fb6837.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2895148b9e295b0762ab6158910c9868553516033be858499e5f850bd7fb6837.exe
Resource
win10v2004-20230220-en
General
-
Target
2895148b9e295b0762ab6158910c9868553516033be858499e5f850bd7fb6837
-
Size
3.0MB
-
MD5
30895a68bc31ac1711a097286fed75e5
-
SHA1
592d09883e69794e15ae1624a94cc0937aa9cafb
-
SHA256
2895148b9e295b0762ab6158910c9868553516033be858499e5f850bd7fb6837
-
SHA512
a9b60b3d5c486a596fb95ad839de4440146811f5b5ad5c4368fd77a0c0da078fc47192e33468ca1e0a038b6c1618691c3f0d1144dfe5a96b9bcbab3348def3b0
-
SSDEEP
49152:LLpxwyqxziMdAnohVuWGVCqdI3lvkxTsUxx9G7Nr3cPe4pVK0qjnDPf:npxwyQldLhVu+qu3lMxTsUg7Nr36pVK9
Malware Config
Signatures
Files
-
2895148b9e295b0762ab6158910c9868553516033be858499e5f850bd7fb6837.exe windows x86
0843f1c645930e0424b87ee97af2810e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
OleLockRunning
CoCreateInstance
CoUninitialize
CLSIDFromString
CoTaskMemFree
CLSIDFromProgID
CreateStreamOnHGlobal
CoInitialize
shell32
SHCreateDirectoryExW
SHGetPathFromIDListW
SHCreateItemFromParsingName
ShellExecuteA
SHBrowseForFolderW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation
shlwapi
SHCreateStreamOnFileEx
PathFileExistsW
kernel32
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryW
FreeLibrary
VerifyVersionInfoW
QueryPerformanceCounter
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
FlushConsoleInputBuffer
GetCurrentThreadId
GetModuleHandleA
GetCurrentProcessId
LoadLibraryA
GlobalMemoryStatus
GetSystemTime
HeapFree
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
ReadConsoleInputW
SetConsoleMode
GetFileAttributesExW
SetStdHandle
GetFullPathNameW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FlushFileBuffers
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
SetFilePointerEx
GetModuleHandleExW
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
GetFileSizeEx
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
EnterCriticalSection
CreateTimerQueue
SetEndOfFile
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToDosDateTime
VirtualFree
VirtualAlloc
GetProcessAffinityMask
GetSystemInfo
LocalFileTimeToFileTime
GetVersionExW
FindNextFileW
FindFirstFileW
FindClose
SetFileAttributesW
MoveFileExW
GetFileAttributesW
LocalFree
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
GlobalLock
GlobalUnlock
GlobalAlloc
InitializeCriticalSectionAndSpinCount
GetLocalTime
SystemTimeToFileTime
DosDateTimeToFileTime
GetCurrentProcess
DuplicateHandle
WriteFile
SetFileTime
GetFileType
MulDiv
GetFileSize
CreateFileW
FreeResource
ExitProcess
GetACP
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetTickCount
GetCurrentDirectoryW
MoveFileW
CreateProcessA
WinExec
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
CloseHandle
HeapReAlloc
LockResource
CreateFileA
GetLastError
Sleep
SizeofResource
GetModuleFileNameA
ReadFile
CreateDirectoryW
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
GetTempPathW
GetModuleFileNameW
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
LeaveCriticalSection
HeapSize
InitializeCriticalSectionEx
SetFilePointer
SetEvent
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
GetStringTypeW
GetCurrentThread
SwitchToThread
TryEnterCriticalSection
FormatMessageW
SignalObjectAndWait
lstrlenW
LoadLibraryExW
user32
TranslateMessage
DispatchMessageW
SendMessageW
PostQuitMessage
GetMessageW
MessageBoxW
CharUpperW
wsprintfW
PostMessageW
CreateWindowExW
IsWindow
DestroyWindow
SetWindowPos
IsWindowVisible
IsIconic
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
IntersectRect
UnionRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
wvsprintfW
SetCursor
OffsetRect
LoadCursorW
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
ShowWindow
EnableWindow
SetPropW
GetPropW
MonitorFromWindow
GetMonitorInfoW
IsZoomed
SetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
CreateAcceleratorTableW
MoveWindow
CharPrevExA
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetGUIThreadInfo
InvalidateRgn
gdi32
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectW
CreatePen
CreatePatternBrush
GetObjectA
GetDeviceCaps
GdiFlush
ExtTextOutW
TextOutW
MoveToEx
CreateDIBSection
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
RoundRect
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
SelectObject
SaveDC
RestoreDC
Rectangle
GetStockObject
DeleteObject
DeleteDC
BitBlt
advapi32
CryptDecrypt
RegCreateKeyExW
RegCloseKey
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
RegSetValueExW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantCopy
SysAllocStringLen
VariantClear
gdiplus
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipSetPixelOffsetMode
GdipSetSmoothingMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCreateLineBrushI
GdipDeleteBrush
GdipCloneBrush
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipGetFamily
GdiplusShutdown
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdiplusStartup
GdipFree
GdipImageGetFrameDimensionsCount
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipAlloc
imagehlp
MakeSureDirectoryPathExists
comctl32
ord17
_TrackMouseEvent
InitCommonControlsEx
imm32
ImmReleaseContext
ImmSetCompositionFontW
ImmSetCompositionWindow
ImmGetContext
crypt32
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
ws2_32
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
recv
socket
WSAGetLastError
send
closesocket
shutdown
gethostbyname
getservbyname
WSASetLastError
WSAIoctl
gethostname
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
wldap32
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301
ord145
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 506KB - Virtual size: 505KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 60KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 400KB - Virtual size: 399KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 107KB - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ