Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
General
-
Target
tmp
-
Size
1.2MB
-
MD5
ebe8ab32783e5b6d7b43f186f5939590
-
SHA1
5ad3e206e0eb7c5813af7fcd7e0bfb3cdef72427
-
SHA256
0a6de94dd6d07e90bd452c6321c5bdb4028248125dfed2bbef535af4c5f31330
-
SHA512
9892f6669f8542c3ceea2971b96a172642844d469fe573addeb60b9e6dfeac192def60516410ed8ed627f7b251d2a0971d683b8cf15a3b9673915072bb5dd1da
-
SSDEEP
24576:uqleYnuoxOfjtbW8mcVlVVhChy8nPXINaYqGk32vgmEtxb:nVuNTetxb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows x86
fca27ecb6de1c7214fbcd4f9d7bfd248
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
Shell_NotifyIconW
SHAddToRecentDocs
SHCreateDirectoryExW
SHGetFolderPathW
DragAcceptFiles
DragQueryFileW
DragFinish
SHAppBarMessage
SHGetSpecialFolderPathW
ord180
SHChangeNotify
SHGetMalloc
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteExW
ShellExecuteW
SHBrowseForFolderW
SHGetPathFromIDListW
ole32
RegisterDragDrop
RevokeDragDrop
OleInitialize
OleUninitialize
CoCreateInstance
CoInitialize
CoUninitialize
DoDragDrop
advapi32
IsTextUnicode
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
OpenProcessToken
GetTokenInformation
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegQueryValueExW
comctl32
ImageList_Create
ImageList_Destroy
ord8
InitCommonControlsEx
ImageList_AddMasked
CreateStatusWindowW
shlwapi
StrRetToBufW
StrCpyNW
StrStrIA
StrCmpW
StrNCatW
StrChrIA
StrCmpNIA
StrChrA
StrCatBuffA
StrDupW
StrTrimA
StrTrimW
StrDupA
StrCmpNIW
PathIsRootW
StrCatW
SHCopyKeyW
StrCatBuffW
SHAutoComplete
PathRemoveFileSpecW
PathQuoteSpacesW
PathFindFileNameW
PathFileExistsW
PathIsUNCW
PathUnquoteSpacesW
StrChrW
PathMatchSpecW
StrStrW
PathUnExpandEnvStringsW
PathRelativePathToW
PathIsRelativeW
PathCommonPrefixW
PathGetDriveNumberW
PathAppendW
PathFindExtensionW
PathIsDirectoryW
PathCanonicalizeW
StrChrIW
PathRenameExtensionW
StrRChrW
StrFormatByteSizeW
PathCompactPathExW
StrStrIW
StrCmpNA
imm32
ImmNotifyIME
ImmGetContext
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCompositionFontA
user32
CheckMenuRadioItem
CountClipboardFormats
GetWindowPlacement
IsZoomed
KillTimer
ChangeClipboardChain
PostQuitMessage
DefWindowProcW
GetDlgCtrlID
LoadMenuW
ScreenToClient
ClientToScreen
GetCursorPos
GetSubMenu
TrackPopupMenuEx
DestroyMenu
ShowOwnedPopups
IsIconic
IsWindowVisible
SetMenuDefaultItem
TrackPopupMenu
IntersectRect
UpdateWindow
SetClipboardViewer
SetTimer
RegisterClassW
MessageBoxW
RegisterWindowMessageW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
IsWindow
IsChild
IsDialogMessageW
UnregisterClassW
GetDoubleClickTime
SetActiveWindow
SetForegroundWindow
FindWindowExW
SystemParametersInfoW
DrawAnimatedRects
CreateDialogIndirectParamW
DialogBoxIndirectParamW
CharPrevW
CharUpperBuffW
GetMenu
GetMenuState
GetDC
ReleaseDC
GetSysColor
InvalidateRect
SetRect
MapWindowPoints
DeferWindowPos
GetClientRect
AdjustWindowRectEx
GetMenuStringW
CheckMenuItem
MonitorFromRect
GetMonitorInfoW
SetWindowTextW
LoadCursorW
SetCursor
DestroyCursor
DialogBoxParamW
IsWindowEnabled
SetFocus
GetSystemMenu
InsertMenuW
DestroyWindow
wsprintfA
IsCharLowerA
IsCharAlphaNumericW
IsCharUpperW
CharLowerW
IsCharLowerW
CharUpperW
CharLowerA
IsCharAlphaNumericA
CharNextW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
CreateWindowExW
GetCaretBlinkTime
GetParent
LoadIconW
LoadImageW
GetDlgItemInt
SetDlgItemInt
CheckRadioButton
GetPropW
PeekMessageW
TranslateMessage
DispatchMessageW
RemovePropW
IsDlgButtonChecked
SetPropW
CheckDlgButton
GetWindowTextLengthW
BeginDeferWindowPos
EndDeferWindowPos
GetWindowLongW
MessageBeep
SetWindowLongW
PostMessageW
EnableWindow
EndDialog
wsprintfW
SetDlgItemTextW
SendDlgItemMessageW
GetDlgItem
ShowWindow
GetDlgItemTextW
SendMessageW
MessageBoxIndirectW
wvsprintfW
GetFocus
MessageBoxExW
GetWindowRect
SetWindowPos
LoadStringW
EnableMenuItem
GetClassNameW
ShowWindowAsync
EnumWindows
GetKeyState
ReleaseCapture
SetCapture
FillRect
FrameRect
DrawFocusRect
DrawTextA
DrawTextW
InflateRect
CallWindowProcW
EndPaint
BeginPaint
CreatePopupMenu
RegisterClassExW
RegisterClipboardFormatW
GetUpdateRgn
GetKeyboardLayout
MsgWaitForMultipleObjects
GetMessageTime
IsWindowUnicode
ScrollWindow
SetCaretPos
SetScrollInfo
GetScrollInfo
AppendMenuA
ShowCaret
CreateCaret
HideCaret
GetSystemMetrics
DestroyCaret
gdi32
LineTo
GetDeviceCaps
TranslateCharsetInfo
SelectObject
MoveToEx
GetTextExtentPoint32W
DeleteObject
GetStockObject
GetObjectW
CreateFontIndirectW
CreatePen
ExtTextOutW
SetTextAlign
SetBkColor
SetTextColor
StartPage
DeleteDC
StartDocW
GetTextMetricsW
CreateFontW
DPtoLP
CreatePalette
CreateFontIndirectA
SelectPalette
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
GetNearestColor
SetMapMode
Polygon
Rectangle
CreatePatternBrush
EndPage
RoundRect
CreateDIBSection
Ellipse
BitBlt
GetTextExtentPoint32A
ExtTextOutA
SetBkMode
GetTextExtentExPointA
GetTextExtentExPointW
RealizePalette
IntersectClipRect
CreateRectRgn
CombineRgn
CreateBitmap
EndDoc
comdlg32
ChooseColorW
ChooseFontW
PageSetupDlgW
PrintDlgW
GetSaveFileNameW
GetOpenFileNameW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
msvcp60
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIG@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBGI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
msvcrt
wcslen
swprintf
sprintf
__CxxFrameHandler
wcsncmp
free
calloc
??2@YAPAXI@Z
isgraph
_vsnwprintf
qsort
_swab
sscanf
swscanf
memmove
wcsftime
mktime
strncpy
strchr
strncmp
isalnum
_purecall
isupper
islower
ispunct
isdigit
realloc
toupper
tolower
isspace
iscntrl
isprint
_wcsnicmp
__isascii
isalpha
malloc
strncat
atoi
strstr
memchr
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
isxdigit
_strdup
kernel32
LoadResource
LockResource
SizeofResource
FreeResource
MulDiv
WritePrivateProfileSectionW
GetPrivateProfileSectionW
GetLocaleInfoW
ExpandEnvironmentStringsW
GetWindowsDirectoryW
FindResourceW
GetModuleHandleA
lstrcmpiA
lstrcmpA
lstrcpynA
GetModuleHandleW
GetProcAddress
lstrlenA
SetEndOfFile
WriteFile
CreateFileW
GetTickCount
FreeLibrary
LoadLibraryW
SetErrorMode
GetVersion
GetCurrentProcess
SearchPathW
GetLastError
GetFileSize
GlobalSize
ReadFile
IsValidCodePage
GetCPInfo
GetACP
GetOEMCP
LocalSize
GlobalLock
lstrcpyA
GlobalUnlock
lstrcmpW
GetPrivateProfileIntW
LocalAlloc
WritePrivateProfileStringW
CloseHandle
GlobalFree
CreateThread
GlobalAlloc
CreateEventW
ResetEvent
WaitForSingleObject
GetFileAttributesW
SetEvent
ExitThread
lstrcpynW
lstrcatW
lstrcmpiW
GetModuleFileNameW
lstrcpyW
GetCurrentDirectoryW
FormatMessageW
GetTimeFormatW
GetVersionExW
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetStartupInfoA
GetLocaleInfoA
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
IsDBCSLeadByteEx
EnterCriticalSection
LeaveCriticalSection
CompareFileTime
FindNextChangeNotification
FindCloseChangeNotification
FindFirstFileW
FindClose
FindFirstChangeNotificationW
GetStartupInfoW
CreateProcessW
GetLongPathNameW
GetCommandLineW
GetPrivateProfileStringW
GetLocalTime
SetFileAttributesW
GetDateFormatW
LocalFree
Sections
.text Size: 784KB - Virtual size: 783KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 212KB - Virtual size: 242KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 156KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ