Static task
static1
Behavioral task
behavioral1
Sample
421651cffd42b47a075cda4e0cfbe822.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
421651cffd42b47a075cda4e0cfbe822.exe
Resource
win10v2004-20231215-en
General
-
Target
421651cffd42b47a075cda4e0cfbe822
-
Size
105KB
-
MD5
421651cffd42b47a075cda4e0cfbe822
-
SHA1
77367ebc5c62469ed1efecedc815771ec1e33ade
-
SHA256
5d41baad80a551a215cb5fd9ac488c7a8aa2dc40120cf0a9ca3aec05cb7d9e76
-
SHA512
b0ca252ffe3edb3f06928545383ec67d22c651b85f2f45eb48876ea6eea2bfc8a092cbf48cbd564ada7a3897f07ebef12e289dd74b2d8a535a12468ae90741a4
-
SSDEEP
3072:z/gRMbya2MFrjKhtOj6/7/pyhGJs1tnyQ:zIRJaZ6htYmU9KQ
Malware Config
Signatures
Files
-
421651cffd42b47a075cda4e0cfbe822.exe windows:4 windows x86 arch:x86
632a36082eb3bccfc57ff488fbb1589c
Code Sign
05:eb:b4:8b:52:1e:e4:71:bc:5e:c5:cd:9b:76:27:54Certificate
IssuerCN=Root AgencyNot Before23/02/2011, 11:36Not After31/12/2039, 23:59SubjectCN=MineFilter 인증서Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
GetCurrentProcessId
GetCurrentThreadId
MoveFileA
WriteFile
CreateFileA
GetShortPathNameA
CreateProcessA
GetVersionExA
GetProcAddress
GetModuleHandleA
ResetEvent
GetFileAttributesExA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetFilePointer
CreateDirectoryA
GetLocalTime
LoadLibraryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
ExpandEnvironmentStringsA
LoadLibraryExA
GetPrivateProfileIntA
CopyFileA
DeleteFileA
FreeLibrary
CloseHandle
GetPrivateProfileStringA
Sleep
lstrcatA
GetTickCount
GetLastError
SetEvent
lstrcpyA
GetModuleFileNameA
lstrcmpiA
CreateEventA
CreateThread
WaitForSingleObject
lstrlenA
TerminateThread
GetTempPathA
SetStdHandle
SetConsoleCtrlHandler
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
ExitProcess
TerminateProcess
GetCurrentProcess
RtlUnwind
GetTimeZoneInformation
GetSystemTime
HeapFree
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
HeapReAlloc
HeapSize
WideCharToMultiByte
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
MultiByteToWideChar
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FlushFileBuffers
user32
wvsprintfA
wsprintfA
advapi32
RegSetValueExA
RegCreateKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegCloseKey
StartServiceA
QueryServiceStatus
CreateServiceA
ChangeServiceConfig2A
StartServiceCtrlDispatcherA
OpenSCManagerA
EnumServicesStatusA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
shell32
SHGetFileInfoA
ShellExecuteA
wininet
InternetReadFile
HttpQueryInfoA
InternetSetOptionA
InternetOpenA
InternetCloseHandle
InternetOpenUrlA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
shlwapi
SHDeleteKeyA
SHDeleteValueA
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ