Behavioral task
behavioral1
Sample
unpacked_i_love_kids(1).exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
unpacked_i_love_kids(1).exe
Resource
win10v2004-20230220-en
General
-
Target
unpacked_i_love_kids(1).exe
-
Size
48.4MB
-
MD5
1c6073b2a5aee78ef55a9d7925de0e6f
-
SHA1
699fc1dbc28e6330f184ea3acfaa4b47115657c1
-
SHA256
443d8792ccb478172c8207c082a0112abb58127d64e502af71bbd90d531c5f98
-
SHA512
92e25bf7252d7c72984c0f1ccba2f3e52591f06843ea16732fe0efb5d1e1dc145eb008362032569e0653d4e9cfa2fd200c2301daa39c7a781b0eed429f58543c
-
SSDEEP
786432:sLN8xRjtE+EdjpgmACmefwN56MNzmuKJTEQGafZRZ+:s+/tdEtXAF8GfQVfZW
Malware Config
Signatures
-
resource yara_rule sample themida
Files
-
unpacked_i_love_kids(1).exe.exe windows x86
ef2b73071509960d48bacdf8bf2ea9ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
AddFontMemResourceEx
RemoveFontMemResourceEx
kernel32
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
InitializeSListHead
GetModuleFileNameA
Process32First
WriteProcessMemory
Module32Next
GetFullPathNameA
OpenProcess
CreateToolhelp32Snapshot
LoadLibraryA
Process32Next
CloseHandle
LeaveCriticalSection
GetProcAddress
VirtualAllocEx
CreateRemoteThread
IsDebuggerPresent
EnterCriticalSection
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryW
msvcp140
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
user32
DispatchMessageA
LoadCursorA
GetDesktopWindow
ScreenToClient
GetCapture
DefWindowProcA
CreateWindowExA
TranslateMessage
SetCapture
PeekMessageA
UnregisterClassA
RegisterClassExA
UpdateWindow
ReleaseCapture
GetWindowRect
SetWindowPos
FindWindowA
PostQuitMessage
SetLayeredWindowAttributes
MessageBoxA
GetWindowLongA
SetWindowLongA
ShowWindow
GetWindowThreadProcessId
GetCursorPos
vcruntime140
_CxxThrowException
_except_handler4_common
memcpy
memset
__current_exception_context
__current_exception
__std_terminate
memcpy
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler
memchr
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
ucrtbase
_unlock_file
_lock_file
rename
malloc
_callnewh
_set_new_mode
free
_configthreadlocale
ceil
__setusermatherr
floor
roundf
_crt_atexit
_cexit
_register_onexit_function
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_get_narrow_winmain_command_line
_initterm
_initterm_e
_Exit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
exit
terminate
_controlfp_s
_invalid_parameter_noinfo_noreturn
fputc
_get_stream_buffer_pointers
fflush
_set_fmode
__p__commode
_fseeki64
fread
fsetpos
fclose
ungetc
fgetc
setvbuf
fgetpos
fwrite
strcpy_s
strcat_s
_stricmp
_time64
rand
srand
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateFontA
D3DXCreateSprite
urlmon
URLDownloadToFileA
Sections
.text Size: 61KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 418KB - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 28.9MB - Virtual size: 28.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 19.0MB - Virtual size: 19.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SCY Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE