Behavioral task
behavioral1
Sample
443d8792ccb478172c8207c082a0112abb58127d64e502af71bbd90d531c5f98.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
443d8792ccb478172c8207c082a0112abb58127d64e502af71bbd90d531c5f98.exe
Resource
win10v2004-20230220-en
General
-
Target
1c6073b2a5aee78ef55a9d7925de0e6f.bin
-
Size
37.3MB
-
MD5
90af3d450f0158206736d3348ed43090
-
SHA1
a29f75d92abb5175b7b29b48f016c99d2e563a0d
-
SHA256
7743db79e793b6c23cfb680b1ec10aa2c62a8d447ecbb047de58ffc224b58a2a
-
SHA512
10f0886830678480fdc44b84b0c44b9cb6c3dc5b7b39b4ade0cb1bf32cd70e73122966aa0347f93ca143f37d62ca0d6231e23ed3a9e1297200f8c904006b19ec
-
SSDEEP
786432:m4hxld7jivkSq7hbx5Qp4qZ1wHMQ/l98aX0H4aeLQdy7TNh2UwHKZ32x5wa+3bnd:mkMvpq7hbx5a4iI998w0Hjy/NhNwqAoJ
Malware Config
Signatures
-
resource yara_rule static1/unpack001/443d8792ccb478172c8207c082a0112abb58127d64e502af71bbd90d531c5f98.bin themida
Files
-
1c6073b2a5aee78ef55a9d7925de0e6f.bin.zip
Password: infected
-
443d8792ccb478172c8207c082a0112abb58127d64e502af71bbd90d531c5f98.bin.exe windows x86
Password: infected
ef2b73071509960d48bacdf8bf2ea9ca
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
AddFontMemResourceEx
RemoveFontMemResourceEx
kernel32
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
InitializeSListHead
GetModuleFileNameA
Process32First
WriteProcessMemory
Module32Next
GetFullPathNameA
OpenProcess
CreateToolhelp32Snapshot
LoadLibraryA
Process32Next
CloseHandle
LeaveCriticalSection
GetProcAddress
VirtualAllocEx
CreateRemoteThread
IsDebuggerPresent
EnterCriticalSection
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
LoadLibraryW
msvcp140
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
user32
DispatchMessageA
LoadCursorA
GetDesktopWindow
ScreenToClient
GetCapture
DefWindowProcA
CreateWindowExA
TranslateMessage
SetCapture
PeekMessageA
UnregisterClassA
RegisterClassExA
UpdateWindow
ReleaseCapture
GetWindowRect
SetWindowPos
FindWindowA
PostQuitMessage
SetLayeredWindowAttributes
MessageBoxA
GetWindowLongA
SetWindowLongA
ShowWindow
GetWindowThreadProcessId
GetCursorPos
vcruntime140
_CxxThrowException
_except_handler4_common
memcpy
memset
__current_exception_context
__current_exception
__std_terminate
memcpy
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler
memchr
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
ucrtbase
_unlock_file
_lock_file
rename
malloc
_callnewh
_set_new_mode
free
_configthreadlocale
ceil
__setusermatherr
floor
roundf
_crt_atexit
_cexit
_register_onexit_function
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_get_narrow_winmain_command_line
_initterm
_initterm_e
_Exit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
exit
terminate
_controlfp_s
_invalid_parameter_noinfo_noreturn
fputc
_get_stream_buffer_pointers
fflush
_set_fmode
__p__commode
_fseeki64
fread
fsetpos
fclose
ungetc
fgetc
setvbuf
fgetpos
fwrite
strcpy_s
strcat_s
_stricmp
_time64
rand
srand
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateFontA
D3DXCreateSprite
urlmon
URLDownloadToFileA
Sections
.text Size: 61KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 418KB - Virtual size: 420KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 28.9MB - Virtual size: 28.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 19.0MB - Virtual size: 19.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.SCY Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE