Behavioral task
behavioral1
Sample
14cdb6e9444d04045a39566d304d69df9cc69c14be509f60d4dd5633b66942e5.exe
Resource
win7-20231025-en
General
-
Target
14cdb6e9444d04045a39566d304d69df9cc69c14be509f60d4dd5633b66942e5
-
Size
1.5MB
-
MD5
ed37b947bc02983a19d24001e1e432bf
-
SHA1
e1bff542282672e21e6e15ed6901068a31571460
-
SHA256
14cdb6e9444d04045a39566d304d69df9cc69c14be509f60d4dd5633b66942e5
-
SHA512
838e6b19bd51ebbf9567c646189a39ffd54ce2ae1cdd82bd348e8952f17eb04c3480a11d43dc96710c7bc0fd423f166d3180cd4aa86878f6f257b537aa667499
-
SSDEEP
49152:XPujn/TJQ1NLlSqrU5tUE1etEtLlWiTHfeiEA2RQ6zHvyRWMzT+:XPcn/TJKSb5tN1etEtLlWiTHfeiEA2Rl
Malware Config
Signatures
Files
-
14cdb6e9444d04045a39566d304d69df9cc69c14be509f60d4dd5633b66942e5.exe windows:6 windows x64
db469bb3aaf1156758357e3a6bb0f090
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAGetLastError
WSASetLastError
WSAStartup
select
WSARecvFrom
bind
WSAIoctl
closesocket
WSASend
shutdown
WSASocketW
socket
WSARecv
getsockopt
ioctlsocket
setsockopt
FreeAddrInfoW
GetAddrInfoW
htonl
htons
kernel32
SetStdHandle
ExitThread
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetConsoleCP
GetDriveTypeW
GetCommandLineA
RaiseException
GetStdHandle
SetConsoleMode
GetConsoleMode
CreateMutexW
Sleep
GetLastError
CreateProcessW
MultiByteToWideChar
SetThreadAffinityMask
SetPriorityClass
GetCurrentProcess
SetThreadPriority
GetCurrentThread
GetProcAddress
GetModuleHandleW
CloseHandle
FreeConsole
GetConsoleWindow
VirtualProtect
VirtualFree
VirtualAlloc
GetLargePageMinimum
LocalAlloc
LocalFree
FlushInstructionCache
GetFileType
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
PostQueuedCompletionStatus
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
WideCharToMultiByte
SetConsoleCursorPosition
EnterCriticalSection
GetModuleFileNameW
SetEnvironmentVariableW
LeaveCriticalSection
InitializeCriticalSection
GetVersionExW
FreeEnvironmentStringsW
FileTimeToSystemTime
QueryPerformanceFrequency
GetSystemInfo
GetCurrentDirectoryW
GetCurrentProcessId
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
CancelIo
SetHandleInformation
CreateEventA
CreateIoCompletionPort
SetFileCompletionNotificationModes
SetErrorMode
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
SleepConditionVariableCS
TryEnterCriticalSection
TlsSetValue
ReleaseSemaphore
WakeConditionVariable
InitializeConditionVariable
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
GetNativeSystemInfo
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
GetLongPathNameW
ReadDirectoryChangesW
ReadFile
SetNamedPipeHandleState
SetLastError
WriteFile
CreateNamedPipeW
RtlUnwind
CancelSynchronousIo
GetNamedPipeHandleStateA
CancelIoEx
SwitchToThread
ConnectNamedPipe
FlushFileBuffers
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetModuleHandleA
LoadLibraryA
FormatMessageA
DebugBreak
GetFileSizeEx
FindNextFileW
FindClose
GetFileInformationByHandle
SetFilePointerEx
GetStartupInfoW
GetProcessAffinityMask
SetProcessAffinityMask
RtlPcToFileHeader
RtlUnwindEx
LoadLibraryW
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
HeapReAlloc
HeapFree
HeapAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapSize
GetFullPathNameW
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetProcessHeap
PeekNamedPipe
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
GetTickCount
EncodePointer
DecodePointer
CompareStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
user32
GetMessageA
TranslateMessage
ShowWindow
GetSystemMetrics
DispatchMessageA
MapVirtualKeyW
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 218KB - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_TEXT_CN Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ