Advanced File Analysis System

File Name: malware_16.exe

File Type: PE32 executable (GUI) Intel 80386, for MS Windows

SHA1: 90bd16fa5ceffcf3e26ebb8891494b5245005df1

MD5: cd1cdc56b8db2b18da1d5c3f5ed2a014

Download Kill Chain Report

Accessed Files

\Device\KsecDD
C:\Users\user\AppData\Local\Temp\90bd16fa5ceffcf3e26ebb8891494b5245005df1.exe.cfg
C:\Windows\sysnative\C_932.NLS
C:\Windows\sysnative\C_949.NLS
C:\Windows\sysnative\C_950.NLS
- C:\Windows\sysnative\C_936.NLS
- C:\Windows\Fonts\staticcache.dat
- C:\Windows\SysWOW64\ntdll.dll
Show More 3

Read Registry Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
Show More 19

Resolved APIs

cryptbase.dll.SystemFunction036
uxtheme.dll.ThemeInitApiHook
user32.dll.IsProcessDPIAware
oleaut32.dll.OleLoadPictureEx
oleaut32.dll.DispCallFunc
- oleaut32.dll.LoadTypeLibEx
- oleaut32.dll.UnRegisterTypeLib
- oleaut32.dll.CreateTypeLib2
- oleaut32.dll.VarDateFromUdate
- oleaut32.dll.VarUdateFromDate
- oleaut32.dll.GetAltMonthNames
- oleaut32.dll.VarNumFromParseNum
- oleaut32.dll.VarParseNumFromStr
- oleaut32.dll.VarDecFromR4
- oleaut32.dll.VarDecFromR8
- oleaut32.dll.VarDecFromDate
- oleaut32.dll.VarDecFromI4
- oleaut32.dll.VarDecFromCy
- oleaut32.dll.VarR4FromDec
- oleaut32.dll.GetRecordInfoFromTypeInfo
- oleaut32.dll.GetRecordInfoFromGuids
- oleaut32.dll.SafeArrayGetRecordInfo
- oleaut32.dll.SafeArraySetRecordInfo
- oleaut32.dll.SafeArrayGetIID
- oleaut32.dll.SafeArraySetIID
- oleaut32.dll.SafeArrayCopyData
- oleaut32.dll.SafeArrayAllocDescriptorEx
- oleaut32.dll.SafeArrayCreateEx
- oleaut32.dll.VarFormat
- oleaut32.dll.VarFormatDateTime
- oleaut32.dll.VarFormatNumber
- oleaut32.dll.VarFormatPercent
- oleaut32.dll.VarFormatCurrency
- oleaut32.dll.VarWeekdayName
- oleaut32.dll.VarMonthName
- oleaut32.dll.VarAdd
- oleaut32.dll.VarAnd
- oleaut32.dll.VarCat
- oleaut32.dll.VarDiv
- oleaut32.dll.VarEqv
- oleaut32.dll.VarIdiv
- oleaut32.dll.VarImp
- oleaut32.dll.VarMod
- oleaut32.dll.VarMul
- oleaut32.dll.VarOr
- oleaut32.dll.VarPow
- oleaut32.dll.VarSub
- oleaut32.dll.VarXor
- oleaut32.dll.VarAbs
- oleaut32.dll.VarFix
- oleaut32.dll.VarInt
- oleaut32.dll.VarNeg
- oleaut32.dll.VarNot
- oleaut32.dll.VarRound
- oleaut32.dll.VarCmp
- oleaut32.dll.VarDecAdd
- oleaut32.dll.VarDecCmp
- oleaut32.dll.VarBstrCat
- oleaut32.dll.VarCyMulI4
- oleaut32.dll.VarBstrCmp
- ole32.dll.CoCreateInstanceEx
- ole32.dll.CLSIDFromProgIDEx
- sxs.dll.SxsOleAut32MapIIDOrCLSIDToTypeLibrary
- user32.dll.GetSystemMetrics
- user32.dll.MonitorFromWindow
- user32.dll.MonitorFromRect
- user32.dll.MonitorFromPoint
- user32.dll.EnumDisplayMonitors
- user32.dll.GetMonitorInfoA
- dwmapi.dll.DwmIsCompositionEnabled
- gdi32.dll.GetLayout
- gdi32.dll.GdiRealizationInfo
- gdi32.dll.FontIsLinked
- advapi32.dll.RegOpenKeyExW
- advapi32.dll.RegQueryInfoKeyW
- gdi32.dll.GetTextFaceAliasW
- advapi32.dll.RegEnumValueW
- advapi32.dll.RegCloseKey
- advapi32.dll.RegQueryValueExW
- gdi32.dll.GetFontAssocStatus
- advapi32.dll.RegQueryValueExA
- advapi32.dll.RegEnumKeyExW
- gdi32.dll.GdiIsMetaPrintDC
- user32.dll.GetDC
- gdi32.dll.PlgBlt
- gdi32.dll.CreateDIBPatternBrushPt
- gdi32.dll.SelectObject
- gdi32.dll.PatBlt
- gdi32.dll.DeleteObject
- kernel32.dll.NlsGetCacheUpdateCount
- kernel32.dll.GetCalendarInfoW
- user32.dll.EnumWindowStationsW
- user32.dll.EnumWindows
- kernel32.dll.VirtualAlloc
- kernel32.dll.GetTickCount
- kernel32.dll.Sleep
- kernel32.dll.SetErrorMode
- kernel32.dll.SetLastError
- kernel32.dll.VirtualAllocEx
- user32.dll.GetCursorPos
- kernel32.dll.CloseHandle
- shell32.dll.ShellExecuteW
- kernel32.dll.WriteFile
- kernel32.dll.CreateFileW
- kernel32.dll.TerminateProcess
- kernel32.dll.VirtualProtectEx
- kernel32.dll.CreateProcessW
- kernel32.dll.GetTempPathW
- kernel32.dll.GetLongPathNameW
- kernel32.dll.GetFileSize
- kernel32.dll.ReadFile
- kernel32.dll.GetCommandLineW
- ntdll.dll.NtAllocateVirtualMemory
- ntdll.dll.NtWriteVirtualMemory
- ntdll.dll.NtTerminateThread
- ntdll.dll.NtOpenEvent
- kernel32.dll.ReadProcessMemory
- ntdll.dll.NtResumeThread
- kernel32.dll.GetExitCodeProcess
Show More 114

Registry Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Codepage
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT\UserEra
- HKEY_CURRENT_USER
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Control Panel\International\Calendars\TwoDigitYearMax
- HKEY_CURRENT_USER\Control Panel\International\Calendars\TwoDigitYearMax
Show More 30

Read Files

\Device\KsecDD
C:\Windows\Fonts\staticcache.dat
C:\Windows\SysWOW64\ntdll.dll

Loading...