Static task
static1
Behavioral task
behavioral1
Sample
3DEA9EB77E4357AB40F45FFFFACF8D6C.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3DEA9EB77E4357AB40F45FFFFACF8D6C.exe
Resource
win10v2004-20230220-en
General
-
Target
3DEA9EB77E4357AB40F45FFFFACF8D6C.exe
-
Size
862KB
-
MD5
3dea9eb77e4357ab40f45ffffacf8d6c
-
SHA1
23638cd56a18d5ea8d5d5168f93e401fb439ca7d
-
SHA256
09b3983dd87e82f72c84d3deb9f2ad3a6c85b01d7a2908fdc5cbaa7396f7071f
-
SHA512
89d0c7af439229c5cd3624af622b519529277bf0ab2b50a18b1592e7171df1abc26c6b0084a791cd4edf5946253dfa84cc94b29826745db01f166a5551d44412
-
SSDEEP
24576:Kkx0qKNV9Bp4VPKPenDtCWdbTIrMsXWvJdvs/TlaIJ9S:Kkx8/6XCWdbTIrMsXWvJdvATlaIO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3DEA9EB77E4357AB40F45FFFFACF8D6C.exe
Files
-
3DEA9EB77E4357AB40F45FFFFACF8D6C.exe.exe windows x86
ada0898ae6082f14492106e7bc89c2cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
CallNtPowerInformation
user32
GetWindowLongW
DestroyWindow
CreateWindowExW
UnregisterClassW
SetWindowLongW
DefWindowProcW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterClassW
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
winhttp
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
advapi32
SystemFunction036
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
RevertToSelf
ImpersonateNamedPipeClient
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegCloseKey
kernel32
VirtualAllocEx
FlushInstructionCache
CreateProcessW
GetExitCodeThread
Sleep
SleepEx
RaiseException
GetFileAttributesW
DeleteFileW
VirtualProtectEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
InitOnceExecuteOnce
DeleteCriticalSection
TryEnterCriticalSection
WriteProcessMemory
WerRegisterRuntimeExceptionModule
FindFirstFileExW
FindNextFileW
GetFileTime
RemoveDirectoryW
MoveFileExW
InitializeCriticalSection
InitOnceBeginInitialize
CreateDirectoryW
InitOnceComplete
SetUnhandledExceptionFilter
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetProcessTimes
SuspendThread
ResumeThread
GetProcessId
GetThreadContext
VerSetConditionMask
IsProcessorFeaturePresent
GetSystemInfo
VerifyVersionInfoW
GetTimeZoneInformation
GetThreadLocale
GetSystemDefaultLCID
GetUserDefaultLCID
GetModuleFileNameW
DuplicateHandle
GetLastError
ConnectNamedPipe
DisconnectNamedPipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcess
CreateThread
OpenProcess
UnregisterWaitEx
RegisterWaitForSingleObject
GetFileInformationByHandleEx
SetLastError
IsWow64Process
GetModuleHandleW
FormatMessageA
VirtualQueryEx
ReadProcessMemory
GetSystemTimeAsFileTime
GetProcAddress
LoadLibraryW
FindClose
CloseHandle
LocalFree
CreateFileW
SetNamedPipeHandleState
TransactNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetVersion
TerminateProcess
ReleaseSemaphore
CreateSemaphoreW
GetStdHandle
GetFileSizeEx
GetFileType
LockFileEx
ReadFile
SetEndOfFile
SetFilePointerEx
UnlockFileEx
WriteFile
GetNamedPipeInfo
OutputDebugStringW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
msvcp140
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Xbad_function_call@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?_Xout_of_range@std@@YAXPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
_Mbrtowc
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
vcruntime140
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_except_handler4_common
__std_type_info_destroy_list
__current_exception_context
__current_exception
strchr
memchr
_purecall
memset
memmove
memcpy
__CxxFrameHandler3
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_controlfp_s
__p___argc
_seh_filter_exe
_set_app_type
_configure_wide_argv
_configure_narrow_argv
_seh_filter_dll
terminate
signal
_register_thread_local_exe_atexit_callback
__p___wargv
_invalid_parameter_noinfo_noreturn
_c_exit
_invoke_watson
abort
_exit
exit
_initterm_e
_errno
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_cexit
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsscanf
__stdio_common_vsprintf_p
__p__commode
fflush
__stdio_common_vsprintf
__stdio_common_vfprintf
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
strncmp
wcsncmp
_wcsicmp
wcsnlen
isalnum
tolower
strnlen
isspace
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
free
_aligned_free
_aligned_malloc
malloc
_callnewh
_set_new_mode
calloc
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtol
strtoul
api-ms-win-crt-math-l1-1-0
ldexp
_except1
__setusermatherr
_dclass
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_wstat64
Sections
.text Size: 648KB - Virtual size: 647KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CPADinfo Size: 512B - Virtual size: 304B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ