Static task
static1
Behavioral task
behavioral1
Sample
detect.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
detect.exe
Resource
win10v2004-20230220-en
General
-
Target
detect.exe
-
Size
505KB
-
MD5
046950a77fbc28083db3bbe37f333087
-
SHA1
265c452d57c8caed040649be20197ea7f5d75d75
-
SHA256
c40964d77250097f36c61af3c1ea425b1c2bc467cde9688827dd1478f2d8c9b1
-
SHA512
dab4952c0092233a75eddcebb4dd50a2a61c76df8afd9ce51f57f32de670fec34b69c2ee5d92d609946cac5857d9790835932e8ec63d8b92d91b8ffb1ddbfa99
-
SSDEEP
12288:FGbW6fPuqsA7y+NoDlcOjRjzDY8iQBK2SOpU8Ih:FGbW6uq9RNozjRjzDYINk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource detect.exe
Files
-
detect.exe.exe windows x64
bfcd118a29a3feab82d44102561a4046
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
setsockopt
WSACleanup
htons
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
socket
__WSAFDIsSet
select
accept
bind
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
ioctlsocket
gethostname
WSAIoctl
send
connect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
getsockopt
wldap32
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord217
ord50
ord45
ord60
ord211
ord143
ord46
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
normaliz
IdnToAscii
kernel32
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
GetCurrentProcessId
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
MultiByteToWideChar
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetTickCount
GlobalMemoryStatusEx
QueryPerformanceCounter
FormatMessageW
Process32First
CreateToolhelp32Snapshot
GetTickCount64
Process32Next
CloseHandle
GetSystemInfo
GetModuleHandleW
WideCharToMultiByte
GetDiskFreeSpaceExA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetLastError
SetLastError
advapi32
CryptGetHashParam
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
RegOpenKeyExA
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegQueryValueExA
GetUserNameA
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
ntdll
RtlGetVersion
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
_CxxThrowException
__C_specific_handler
memcmp
strstr
__current_exception_context
memchr
strrchr
strchr
memset
memcpy
__std_terminate
__std_exception_copy
__std_exception_destroy
memmove
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
realloc
malloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
fread
_lseeki64
__stdio_common_vsprintf_s
__p__commode
fgets
_open
fopen
fflush
fputc
__acrt_iob_func
__stdio_common_vsscanf
fseek
fclose
_read
_write
ftell
_close
feof
fputs
fwrite
__stdio_common_vsprintf
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_crt_atexit
_initialize_onexit_table
terminate
_invalid_parameter_noinfo_noreturn
_errno
_beginthreadex
__sys_nerr
_register_thread_local_exe_atexit_callback
system
__sys_errlist
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_c_exit
_cexit
__p___argc
__p___argv
_exit
api-ms-win-crt-string-l1-1-0
_strdup
strcmp
strspn
strncpy
strncmp
strpbrk
strcspn
api-ms-win-crt-convert-l1-1-0
strtol
wcstombs
strtoul
strtoll
atoi
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlink
_stat64
_access
_fstat64
api-ms-win-crt-math-l1-1-0
_fdopen
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 387KB - Virtual size: 386KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ