strdup
Static task
static1
Behavioral task
behavioral1
Sample
655554f71e3e9d147dc4b56fe9c224afcb70354e9a1f51c4f32807188c80f3d5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
655554f71e3e9d147dc4b56fe9c224afcb70354e9a1f51c4f32807188c80f3d5.exe
Resource
win10v2004-20230221-en
General
-
Target
655554f71e3e9d147dc4b56fe9c224afcb70354e9a1f51c4f32807188c80f3d5
-
Size
1.6MB
-
MD5
0023642898805be58a29397332478993
-
SHA1
c972c395aaddd1b306f8cc9ce2a988c4665fb4db
-
SHA256
655554f71e3e9d147dc4b56fe9c224afcb70354e9a1f51c4f32807188c80f3d5
-
SHA512
d47fc6ca429846dccc5a7ed36edfd2a78183a7c1fd172fc485c097b1384f8c3953a47d77a2c6648c670800b3039df6690ef6c4922c11ed006528292fceac508b
-
SSDEEP
24576:ak/42WhVj2S/rmKTg4Qmur14RPJIQTC74ANMuR7CbNQHo9r2FISMSk0WZYA2P3Xb:QVjBiKpm4EQ+740I52mhSrPulnp80G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 655554f71e3e9d147dc4b56fe9c224afcb70354e9a1f51c4f32807188c80f3d5
Files
-
655554f71e3e9d147dc4b56fe9c224afcb70354e9a1f51c4f32807188c80f3d5.exe windows x86
01a304ee85d579dda574f623559ad5f2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
xml
?GetAttribVal@CXmlNodeWrapper@@QAEPAGH@Z
?GetText@CXmlNodeWrapper@@QAEPAGXZ
?NumNodes@CXmlNodeWrapper@@QAEJXZ
?GetNode@CXmlNodeWrapper@@QAEPAUIXMLDOMNode@MSXML2@@H@Z
??1CXmlNodeWrapper@@UAE@XZ
?Load@CXmlDocumentWrapper@@QAEHPBG@Z
?AsNode@CXmlDocumentWrapper@@QAEPAUIXMLDOMNode@MSXML2@@XZ
??0CXmlDocumentWrapper@@QAE@XZ
?GetAttribName@CXmlNodeWrapper@@QAEPAGH@Z
?NumAttributes@CXmlNodeWrapper@@QAEHXZ
?Name@CXmlNodeWrapper@@QAEPAGXZ
??0CXmlNodeWrapper@@QAE@V?$_com_ptr_t@V?$_com_IIID@UIXMLDOMNode@MSXML2@@$1?_GUID_2933bf80_7b36_11d2_b20e_00c04f983e60@@3U__s_GUID@@A@@@@H@Z
??1CXmlDocumentWrapper@@UAE@XZ
ws2_32
send
htonl
gethostbyname
inet_ntoa
inet_addr
htons
sendto
select
recv
recvfrom
socket
setsockopt
WSAStartup
connect
closesocket
ioctlsocket
__WSAFDIsSet
gethostname
setupapi
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsA
mfc42u
ord1089
ord5193
ord2388
ord3341
ord5296
ord5298
ord4074
ord4692
ord5303
ord5285
ord5710
ord2977
ord3142
ord3254
ord4459
ord3131
ord3257
ord2980
ord3076
ord2971
ord3825
ord3826
ord3820
ord3074
ord4075
ord4616
ord4418
ord3733
ord561
ord815
ord641
ord2506
ord2613
ord1131
ord2717
ord2371
ord3917
ord4370
ord4847
ord4992
ord4704
ord6048
ord4073
ord1767
ord4401
ord5237
ord2377
ord5157
ord6370
ord4347
ord5276
ord3793
ord4831
ord4435
ord2640
ord2047
ord6372
ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord4621
ord4419
ord3592
ord324
ord4229
ord1143
ord1165
ord1761
ord4294
ord1197
ord4155
ord2858
ord6374
ord3566
ord3621
ord3658
ord640
ord2406
ord2397
ord5781
ord1634
ord1633
ord323
ord755
ord470
ord2859
ord4215
ord2576
ord3649
ord2430
ord6266
ord1637
ord535
ord5706
ord6868
ord6771
ord2756
ord4197
ord861
ord2810
ord538
ord6655
ord4124
ord6640
ord5727
ord2504
ord2546
ord4480
ord1569
ord6371
ord4269
ord537
ord922
ord858
ord823
ord825
ord540
ord860
ord800
ord5261
msvcrt
time
_wtoi
strrchr
realloc
memchr
fflush
fputc
printf
_setmode
_flsbuf
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_endthreadex
_except_handler3
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_controlfp
wcscmp
_wcsicmp
localtime
free
malloc
fseek
_wunlink
sprintf
strstr
calloc
_wfopen
fread
fclose
__CxxFrameHandler
_CIacos
isalnum
_write
_lseek
_close
_read
_wopen
isalpha
_beginthreadex
_access
strpbrk
atol
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
floor
isdigit
_errno
atof
isprint
memmove
islower
toupper
_purecall
strchr
qsort
mktime
ftell
vsprintf
rename
_iob
fprintf
fgets
sscanf
fopen
_ftol
longjmp
__CxxLongjmpUnwind
_setjmp3
swprintf
strncpy
atoi
strncmp
wcslen
wcsncpy
wcsncmp
__set_app_type
exit
_unlink
_open
_fdopen
_stat
getenv
fwrite
kernel32
LocalFree
GetStartupInfoW
ReleaseMutex
CreateMutexA
GetSystemTime
OpenFileMappingA
MapViewOfFile
WaitForSingleObject
GetOverlappedResult
SetEvent
WriteFile
ReadFile
SetupComm
ClearCommError
SetCommTimeouts
GetCommState
SetCommState
CreateFileA
GetLastError
FindNextFileA
FindClose
FindFirstFileA
MultiByteToWideChar
LoadLibraryW
Beep
SetLocalTime
GetCurrentProcessId
CreateEventW
PurgeComm
GetModuleHandleW
CreateDirectoryA
GetCommandLineA
GetModuleFileNameW
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetVersionExW
WideCharToMultiByte
Sleep
LoadLibraryA
FreeLibrary
GetProcAddress
GetModuleFileNameA
user32
OffsetRect
ReleaseCapture
GetCursorPos
SetCapture
PtInRect
IsIconic
GetSystemMetrics
GetClientRect
GetWindowRect
SetWindowPos
GetSystemMenu
AppendMenuW
SendMessageW
SetTimer
GetWindowLongW
SetWindowLongW
SystemParametersInfoW
LoadIconW
EnableWindow
InvalidateRect
CheckMenuItem
CreatePopupMenu
GetAsyncKeyState
GetActiveWindow
GetKeyState
SetRect
MessageBoxA
DrawIcon
gdi32
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
StretchDIBits
SetStretchBltMode
SetDIBits
ole32
CoInitialize
CoUninitialize
msvcp60
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0runtime_error@std@@QAE@ABV01@@Z
??1runtime_error@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_7runtime_error@std@@6B@
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??_8?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@
??0ios_base@std@@IAE@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_7?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0Init@ios_base@std@@QAE@XZ
winmm
mciSendCommandW
Exports
Exports
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 232KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ