ISDllCompileScript
ISDllGetVersion
_ZN8DllClass10HelloWorldEv
_ZN8DllClassC1Ev
_ZN8DllClassC2Ev
_ZN8DllClassD0Ev
_ZN8DllClassD1Ev
_ZN8DllClassD2Ev
_ZTI8DllClass
_ZTV8DllClass
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aac/mis.exe
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
aac/mis.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
aac.rar
-
Size
515KB
-
MD5
c818944b440510dfc379cef941ffc53d
-
SHA1
d085825ba180c4485546114ef36f0cdd6f4c1950
-
SHA256
cc517815a64ecdc2a61a52b87c974413784331caaf9c19ec2627d9c705378fe9
-
SHA512
18ffee3d3211eb21c0a74621edf4b8238b1f3c68719f83ec2fb46e44908a206830ae9bc0f14261b9a491330a52c611706930f6116f117fac419b10216786e650
-
SSDEEP
12288:TpoBrjG4bT8YuCDZPSy6zZ9XpOltZXIftGW3IVjHmRECh:VopjG4P8UtqZ9ZCtuKZHmRR
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/aac/ISCmplr.dll
Files
-
aac.rar.rar
-
aac/ISCmplr.dll.dll windows x86
c67dff5385c1d930bb826cad4db9b04f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WriteProcessMemory
msvcrt
_amsg_exit
_initterm
_iob
_itoa_s
_lock
_unlock
abort
calloc
free
fwrite
realloc
strcmp
strlen
strncmp
vfprintf
psapi
GetModuleInformation
Exports
Exports
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 940B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 323B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1024B - Virtual size: 584B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/4 Size: 1024B - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 174KB - Virtual size: 173KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/31 Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/45 Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/57 Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/70 Size: 1024B - Virtual size: 790B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/81 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/92 Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
aac/isscint.dll.dll windows x86
b002e16e4930e3fcbc0117d5da819ced
Code Sign
04:7a:53Certificate
IssuerCN=Certum CA,O=Unizeto Sp. z o.o.,C=PLNot Before03/03/2009, 12:53Not After03/03/2024, 12:53SubjectCN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLKey Usages
KeyUsageCertSign
KeyUsageCRLSign
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before31/12/2015, 00:00Not After09/07/2019, 18:40SubjectCN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
71:09:fa:42:a4:c1:c7:05:08:a6:82:a0:2d:56:dc:2fCertificate
IssuerCN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLNot Before01/06/2015, 00:00Not After31/05/2016, 00:00SubjectCN=Open Source Developer\, Martijn Laan,O=Martijn Laan,C=NL,1.2.840.113549.1.9.1=#0c146d6c61616e406a72736f6674776172652e6f7267Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
d4:48:80:e6:b8:33:63:d1:57:fb:65:df:ce:40:75:a5Certificate
IssuerCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before19/12/2014, 00:00Not After18/12/2017, 23:59SubjectCN=Korton Group B.V.,O=Korton Group B.V.,POSTALCODE=2132 XZ,STREET=Jadelaan 99,L=Hoofddorp,ST=Noord Holland,C=NLExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate
IssuerCN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before09/05/2013, 00:00Not After08/05/2028, 23:59SubjectCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before31/12/2015, 00:00Not After09/07/2019, 18:40SubjectCN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
5a:66:c9:98:b8:b1:2c:79:ff:a7:34:06:96:8f:be:6f:49:a8:2f:96:ad:42:ec:74:33:cc:4e:e0:f0:f8:57:faSigner
Actual PE Digest5a:66:c9:98:b8:b1:2c:79:ff:a7:34:06:96:8f:be:6f:49:a8:2f:96:ad:42:ec:74:33:cc:4e:e0:f0:f8:57:faDigest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedtrueVerification
Signing CertificateCN=Korton Group B.V.,O=Korton Group B.V.,POSTALCODE=2132 XZ,STREET=Jadelaan 99,L=Hoofddorp,ST=Noord Holland,C=NL15/02/2016, 08:34 Valid: true
Chain 1
CN=Korton Group B.V.,O=Korton Group B.V.,POSTALCODE=2132 XZ,STREET=Jadelaan 99,L=Hoofddorp,ST=Noord Holland,C=NL
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
da:86:a0:44:32:aa:ac:e9:90:53:03:fb:4c:27:f3:e3:9a:65:b8:47Signer
Actual PE Digestda:86:a0:44:32:aa:ac:e9:90:53:03:fb:4c:27:f3:e3:9a:65:b8:47Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Open Source Developer\, Martijn Laan,O=Martijn Laan,C=NL,1.2.840.113549.1.9.1=#0c146d6c61616e406a72736f6674776172652e6f726715/02/2016, 08:34 Valid: false
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStringTypeW
GetStringTypeA
RtlUnwind
HeapReAlloc
VirtualAlloc
HeapSize
GetCurrentProcessId
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
Sleep
ExitProcess
LCMapStringA
GetConsoleMode
WriteFile
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetLastError
RaiseException
GetProcessHeap
HeapAlloc
HeapFree
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetFilePointer
GetModuleFileNameA
GetConsoleCP
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CloseHandle
FlushFileBuffers
GetLocaleInfoA
GlobalLock
GlobalSize
GlobalFree
GetTickCount
LCMapStringW
WideCharToMultiByte
IsValidCodePage
GlobalUnlock
GlobalAlloc
GetCPInfo
GetProcAddress
MulDiv
InitializeCriticalSection
DeleteCriticalSection
IsDBCSLeadByteEx
QueryPerformanceFrequency
LeaveCriticalSection
QueryPerformanceCounter
GetModuleHandleA
LoadLibraryA
MultiByteToWideChar
GetACP
EnterCriticalSection
GetVersionExA
GetStdHandle
user32
GetUpdateRgn
GetCapture
ShowCaret
DestroyCaret
IsChild
GetDlgCtrlID
GetCaretBlinkTime
RegisterClassExW
SetTimer
GetClipboardData
KillTimer
OpenClipboard
GetClientRect
ReleaseDC
CreateWindowExA
FrameRect
InflateRect
HideCaret
ScreenToClient
MsgWaitForMultipleObjects
SystemParametersInfoA
GetKeyboardLayout
RegisterClipboardFormatA
SetCaretPos
SetScrollInfo
EmptyClipboard
AppendMenuA
GetScrollInfo
CreateCaret
IsClipboardFormatAvailable
PostMessageA
IsWindowUnicode
UpdateWindow
ScrollWindow
SetClipboardData
GetMessageTime
CloseClipboard
SetFocus
SendMessageA
GetWindowRect
MapWindowPoints
SetWindowLongA
CallWindowProcA
BeginPaint
DefWindowProcA
MonitorFromRect
InvalidateRect
DestroyMenu
GetParent
LoadCursorA
RegisterClassExA
MonitorFromPoint
GetDoubleClickTime
TrackPopupMenu
GetMonitorInfoA
GetSysColor
FillRect
SetWindowPos
EndPaint
AdjustWindowRectEx
UnregisterClassA
ClientToScreen
GetCursorPos
DestroyWindow
ReleaseCapture
SetCapture
GetWindowLongA
GetDC
ShowWindow
DrawTextW
DrawFocusRect
CreatePopupMenu
GetSystemMetrics
SetCursor
DrawTextA
GetKeyState
gdi32
LineTo
CreateCompatibleDC
RealizePalette
SetTextColor
CreateSolidBrush
GetTextExtentPoint32W
CreatePalette
RoundRect
SetTextAlign
DeleteDC
SetBkMode
Polygon
CreateCompatibleBitmap
IntersectClipRect
GetNearestColor
DeleteObject
Rectangle
GetObjectA
CreateDIBSection
GetStockObject
GetDeviceCaps
ExtTextOutW
GetTextExtentPoint32A
MoveToEx
CreateFontIndirectA
SelectObject
SelectPalette
CreatePatternBrush
Ellipse
GetTextExtentExPointW
SetBkColor
CreatePen
ExtTextOutA
BitBlt
GetTextExtentExPointA
CombineRgn
CreateBitmap
TranslateCharsetInfo
CreateRectRgn
GetTextMetricsA
imm32
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmNotifyIME
ImmReleaseContext
ImmGetContext
ImmSetCompositionFontA
ole32
DoDragDrop
RevokeDragDrop
OleUninitialize
RegisterDragDrop
OleInitialize
Exports
Exports
Scintilla_DirectFunction
Sections
.text Size: 212KB - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
aac/mis.exe.exe windows x86
Code Sign
04:7a:53Certificate
IssuerCN=Certum CA,O=Unizeto Sp. z o.o.,C=PLNot Before03/03/2009, 12:53Not After03/03/2024, 12:53SubjectCN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLKey Usages
KeyUsageCertSign
KeyUsageCRLSign
16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before31/12/2015, 00:00Not After09/07/2019, 18:40SubjectCN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
71:09:fa:42:a4:c1:c7:05:08:a6:82:a0:2d:56:dc:2fCertificate
IssuerCN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PLNot Before01/06/2015, 00:00Not After31/05/2016, 00:00SubjectCN=Open Source Developer\, Martijn Laan,O=Martijn Laan,C=NL,1.2.840.113549.1.9.1=#0c146d6c61616e406a72736f6674776172652e6f7267Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
d4:48:80:e6:b8:33:63:d1:57:fb:65:df:ce:40:75:a5Certificate
IssuerCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before19/12/2014, 00:00Not After18/12/2017, 23:59SubjectCN=Korton Group B.V.,O=Korton Group B.V.,POSTALCODE=2132 XZ,STREET=Jadelaan 99,L=Hoofddorp,ST=Noord Holland,C=NLExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate
IssuerCN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBNot Before09/05/2013, 00:00Not After08/05/2028, 23:59SubjectCN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before31/12/2015, 00:00Not After09/07/2019, 18:40SubjectCN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
89:2c:8c:4c:ca:24:55:3d:4d:4d:7b:97:a3:c0:71:2f:50:77:6a:4e:33:a8:b7:41:e2:a6:52:14:50:a4:c5:75Signer
Actual PE Digest89:2c:8c:4c:ca:24:55:3d:4d:4d:7b:97:a3:c0:71:2f:50:77:6a:4e:33:a8:b7:41:e2:a6:52:14:50:a4:c5:75Digest Algorithmsha256PE Digest MatchestrueSignature Validations
TrustedtrueVerification
Signing CertificateCN=Korton Group B.V.,O=Korton Group B.V.,POSTALCODE=2132 XZ,STREET=Jadelaan 99,L=Hoofddorp,ST=Noord Holland,C=NL06/04/2016, 14:38 Valid: true
Chain 1
CN=Korton Group B.V.,O=Korton Group B.V.,POSTALCODE=2132 XZ,STREET=Jadelaan 99,L=Hoofddorp,ST=Noord Holland,C=NL
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
bd:84:4b:0a:25:37:01:e4:3b:9f:36:82:cd:32:aa:93:13:b2:5a:31Signer
Actual PE Digestbd:84:4b:0a:25:37:01:e4:3b:9f:36:82:cd:32:aa:93:13:b2:5a:31Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Open Source Developer\, Martijn Laan,O=Martijn Laan,C=NL,1.2.840.113549.1.9.1=#0c146d6c61616e406a72736f6674776172652e6f726706/04/2016, 14:38 Valid: false
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 391KB - Virtual size: 390KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 343KB - Virtual size: 343KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ