Static task
static1
Behavioral task
behavioral1
Sample
347cfaad8ae1de196aa294667c1bdce4c0c2a2b37a622205ccbeb540f7775bd3.exe
Resource
win7-20231023-en
General
-
Target
347cfaad8ae1de196aa294667c1bdce4c0c2a2b37a622205ccbeb540f7775bd3
-
Size
4.1MB
-
MD5
108d193da5a3284aebc9f60d7575be5e
-
SHA1
ed68d3f2081242758f33e64854d13cd0718f8d77
-
SHA256
347cfaad8ae1de196aa294667c1bdce4c0c2a2b37a622205ccbeb540f7775bd3
-
SHA512
8bb99d42a15de1ac0a41d1a744e0a89ebe73aa67100dc438dc1530cf0f5d9df8d6a56c19b8742a726483f9e043a80a4e721670339b0736d153813a30a1c555cb
-
SSDEEP
98304:LuGAlANMcllLqyuNpx7g24LQzG3UkZN73bLr+uivAO:LuLl9KlLqvpVg24Lf3vZ9bLr+LP
Malware Config
Signatures
Files
-
347cfaad8ae1de196aa294667c1bdce4c0c2a2b37a622205ccbeb540f7775bd3.exe windows:5 windows x86
cf6c67a92b992938826c4e4ca9230c19
Code Sign
85:b0:6d:d8:70:ae:e3:3a:33:57:33:50:80:b0:b6:cbCertificate
IssuerCN=522910322628070b250c52200b542f1a57031b422732351e332f4620190820022d0b,POSTALCODE=10815,ST=0b1c1115005f5c4e010b00101c041100031a0d10104b111d+ST=0b1c1115494a5c18101602500b53081d121c021c1b120f07110e12511d161a5003091c030c1053460e4113160e181d130101060d401252070f0f08001312055b0c0b0a070bNot Before11-11-2023 03:00Not After10-11-2024 03:00SubjectCN=522910322628070b250c52200b542f1a57031b422732351e332f4620190820022d0b,POSTALCODE=10815,ST=0b1c1115005f5c4e010b00101c041100031a0d10104b111d+ST=0b1c1115494a5c18101602500b53081d121c021c1b120f07110e12511d161a5003091c030c1053460e4113160e181d130101060d401252070f0f08001312055b0c0b0a070be7:42:20:6b:41:3d:bc:7f:61:90:3c:45:b9:aa:13:f3:63:11:50:68:99:6d:b2:74:bc:4e:3f:cf:13:cf:f8:63Signer
Actual PE Digeste7:42:20:6b:41:3d:bc:7f:61:90:3c:45:b9:aa:13:f3:63:11:50:68:99:6d:b2:74:bc:4e:3f:cf:13:cf:f8:63Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleInputW
EnumDateFormatsExW
GetLocaleInfoA
GetDriveTypeW
_llseek
WriteConsoleOutputCharacterA
BuildCommDCBAndTimeoutsA
WriteConsoleOutputW
HeapAlloc
DeleteVolumeMountPointA
InterlockedIncrement
VerSetConditionMask
OpenJobObjectA
GetCommState
GetConsoleAliasA
InterlockedDecrement
GetCurrentProcess
GetSystemWindowsDirectoryW
QueryDosDeviceA
HeapFree
GetEnvironmentStringsW
WriteConsoleInputA
AddConsoleAliasW
CreateHardLinkA
SleepEx
GetFileAttributesExA
_lclose
SetTapeParameters
MoveFileWithProgressA
GetModuleHandleW
CreateNamedPipeW
LocalFlags
FindNextVolumeMountPointA
GetConsoleAliasesA
GetConsoleAliasesLengthA
ConvertFiberToThread
ExpandEnvironmentStringsA
ReadConsoleW
GetConsoleAliasExesW
WaitNamedPipeW
GetUserDefaultLangID
SetCommState
GetCommandLineA
CreateDirectoryExW
GetDriveTypeA
GetVolumePathNameW
GetCurrencyFormatW
ActivateActCtx
GetConsoleCP
GetSystemDirectoryW
SetFileShortNameW
LoadLibraryW
GetConsoleMode
SetCommConfig
_hread
GetCalendarInfoW
GetSystemWindowsDirectoryA
InterlockedPopEntrySList
GetFileAttributesA
GlobalFlags
HeapCreate
EnumSystemCodePagesA
SetTimeZoneInformation
SetSystemPowerState
WritePrivateProfileSectionW
TerminateProcess
ReplaceFileW
GetCompressedFileSizeA
SetThreadContext
CompareStringW
lstrlenW
GlobalUnlock
DisconnectNamedPipe
GetTempPathW
GetNamedPipeHandleStateW
EnumSystemLocalesA
GetPrivateProfileIntW
GetConsoleOutputCP
VerifyVersionInfoW
GlobalUnfix
FindFirstFileA
GetCurrentDirectoryW
GetProcAddress
RemoveDirectoryA
SetComputerNameA
GetProcessVersion
GetPrivateProfileStringA
OpenWaitableTimerA
Process32FirstW
LocalAlloc
IsWow64Process
BuildCommDCBAndTimeoutsW
AddAtomW
CreateEventW
GlobalGetAtomNameW
SetThreadIdealProcessor
FoldStringW
FoldStringA
GlobalFindAtomW
FindNextFileA
_lread
GetModuleHandleA
SetLocaleInfoW
CancelIo
GetProcessAffinityMask
FindNextFileW
GetStringTypeW
WriteProfileStringW
VirtualProtect
GetConsoleCursorInfo
QueryPerformanceFrequency
GetShortPathNameW
SetCalendarInfoA
SetProcessShutdownParameters
OpenSemaphoreW
ReadConsoleInputW
FindAtomW
GetWindowsDirectoryW
DeleteFileW
MoveFileWithProgressW
GetTempPathA
ReadConsoleOutputCharacterW
InterlockedPushEntrySList
TlsFree
EnumSystemLocalesW
GetVolumeInformationW
lstrcpyA
CloseHandle
WriteConsoleW
SetStdHandle
FlushFileBuffers
SetFilePointer
HeapReAlloc
FindFirstFileW
CreateFileA
DebugActiveProcess
GetVolumeNameForVolumeMountPointA
CreateActCtxA
ExitProcess
IsValidLocale
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
IsProcessorFeaturePresent
WriteFile
GetStdHandle
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
SetLastError
GetCurrentThreadId
FreeEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
CreateFileW
user32
CharToOemBuffA
GetDlgCtrlID
GetAltTabInfoW
DrawCaption
CharUpperW
gdi32
GetCharWidthFloatA
advapi32
ClearEventLogA
RevertToSelf
InitiateSystemShutdownA
AbortSystemShutdownW
shell32
DragAcceptFiles
ole32
CoGetInstanceFromFile
winhttp
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReadData
WinHttpOpen
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4.0MB - Virtual size: 7.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ