Behavioral task
behavioral1
Sample
2385464149ef687d4ea39222e1918700.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2385464149ef687d4ea39222e1918700.exe
Resource
win10v2004-20240704-en
General
-
Target
2385464149ef687d4ea39222e1918700.exe
-
Size
618KB
-
MD5
2385464149ef687d4ea39222e1918700
-
SHA1
f1ac70ac410314ca3d420941aab83fd16b140d39
-
SHA256
f67268a95a285291d3d407ac1eaf9e6027c15c50c8651c78cb3e98892311c779
-
SHA512
99e13f49803bf84337fe444425ddbd8778efd8c03d6201506bd5d873b32d9560420de5ab19fdda2a5a86cb5c92c29afc8911ba9e95275a014e51c9c93018fe88
-
SSDEEP
12288:cQ+ijM/hwnfJkdmWS2ynDtPxaNDo3koFkKFJBGKsNCGtWdopqCq3YpWj:hGtaDt5aK0qxtGKsNCGtWdq3Y
Malware Config
Signatures
Files
-
2385464149ef687d4ea39222e1918700.exe.exe windows:6 windows x64 arch:x64
2486a9bb18017055bb32dc57a87898d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
connect
htons
WSACleanup
__WSAFDIsSet
accept
send
ntohs
recv
WSAPoll
WSASetLastError
WSAStartup
select
WSARecvFrom
bind
WSAIoctl
WSASend
shutdown
listen
WSASocketW
getsockname
socket
WSARecv
ioctlsocket
FreeAddrInfoW
GetAddrInfoW
closesocket
getsockopt
setsockopt
htonl
WSAGetLastError
gethostname
iphlpapi
GetAdaptersAddresses
kernel32
FindClose
GetTimeZoneInformation
FindFirstFileExA
HeapSize
FindNextFileA
HeapFree
HeapReAlloc
SetLastError
InitializeCriticalSectionEx
GetLastError
RaiseException
DecodePointer
DeleteCriticalSection
WideCharToMultiByte
GetStdHandle
SetConsoleMode
GetConsoleMode
CloseHandle
FreeConsole
GetConsoleWindow
SetThreadAffinityMask
GetCurrentProcess
SetProcessAffinityMask
GetCurrentThread
VirtualFree
VirtualAlloc
LocalAlloc
LocalFree
SetPriorityClass
SetThreadPriority
GetProcAddress
GetModuleHandleW
TlsSetValue
EnterCriticalSection
ReleaseSemaphore
WaitForMultipleObjects
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
ResumeThread
SetEvent
TlsAlloc
ResetEvent
CreateSemaphoreW
TlsGetValue
TlsFree
CreateSemaphoreA
CreateEventA
VerifyVersionInfoA
GetModuleFileNameW
MultiByteToWideChar
QueryPerformanceFrequency
GetSystemInfo
VerSetConditionMask
IsValidCodePage
QueryPerformanceCounter
SetConsoleCtrlHandler
PostQueuedCompletionStatus
Sleep
SetErrorMode
GetQueuedCompletionStatus
CreateIoCompletionPort
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
RegisterWaitForSingleObject
UnregisterWait
GetConsoleCursorInfo
CreateFileW
DuplicateHandle
QueueUserWorkItem
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
CreateFileA
ReadConsoleW
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
GetFileType
CreateDirectoryW
ReadFile
WriteFile
DeviceIoControl
RemoveDirectoryW
SetFileTime
CreateHardLinkW
GetFileAttributesW
GetFileInformationByHandle
SetFilePointerEx
MoveFileExW
CopyFileW
FlushFileBuffers
CancelIo
SetHandleInformation
GetModuleHandleA
LoadLibraryA
DebugBreak
SetNamedPipeHandleState
CreateNamedPipeW
PeekNamedPipe
GetNamedPipeHandleStateA
SwitchToThread
ConnectNamedPipe
GetLongPathNameW
ReadDirectoryChangesW
TerminateProcess
UnregisterWaitEx
LCMapStringW
GetExitCodeProcess
GetStartupInfoW
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
GetTickCount64
HeapAlloc
GetACP
GetModuleFileNameA
ExitProcess
SetFileAttributesW
GetFileAttributesExW
GetConsoleCP
SetStdHandle
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
GetThreadTimes
GetCurrentProcessId
FormatMessageA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
RtlPcToFileHeader
LoadLibraryExW
FreeLibrary
RtlUnwindEx
OutputDebugStringW
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
CompareStringW
GetStringTypeW
GetCPInfo
user32
ShowWindow
TranslateMessage
DispatchMessageA
MapVirtualKeyW
GetMessageA
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
LsaOpenPolicy
LsaAddAccountRights
LsaClose
GetTokenInformation
winhttp
WinHttpAddRequestHeaders
Sections
.text Size: 406KB - Virtual size: 406KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 129KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 49KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ