Static task
static1
Behavioral task
behavioral1
Sample
379e6054dc1468d8b5fe60a1638e07cc1cbff25329bda0a7e6e0139902aed7ef.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
379e6054dc1468d8b5fe60a1638e07cc1cbff25329bda0a7e6e0139902aed7ef.exe
Resource
win10v2004-20230221-en
General
-
Target
379e6054dc1468d8b5fe60a1638e07cc1cbff25329bda0a7e6e0139902aed7ef
-
Size
1.1MB
-
MD5
328b33f382d390dbd18c4f2e9dd494a9
-
SHA1
b58555e9aef6a855fa5183e2591bedee9e1c8e17
-
SHA256
379e6054dc1468d8b5fe60a1638e07cc1cbff25329bda0a7e6e0139902aed7ef
-
SHA512
98304a8b977bb9ea5f1c0db5398574e12ded808a215bc07e379bba0a69ff59d1a20e7c885d44b93fb80c4263247b675306bc823dba7922660149cf88925dcc8b
-
SSDEEP
24576:A7IJcleGACycED9xhPAP4a3lJxHw7MmIJNJSj:l+oDCVehoV31HwMmIJNy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 379e6054dc1468d8b5fe60a1638e07cc1cbff25329bda0a7e6e0139902aed7ef
Files
-
379e6054dc1468d8b5fe60a1638e07cc1cbff25329bda0a7e6e0139902aed7ef.exe windows x86
5c4436a7b2572b189c2f1fca5aef48f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetSetOptionW
HttpQueryInfoW
InternetReadFile
InternetCrackUrlW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetCloseHandle
InternetOpenW
kernel32
WriteFile
lstrlenW
CreateFileA
SetFilePointer
DeviceIoControl
InterlockedIncrement
InterlockedDecrement
lstrcpyW
GetACP
GetCurrentDirectoryW
GetModuleHandleW
FreeResource
GetFileType
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
SetFileTime
MulDiv
GetLocalTime
InterlockedCompareExchange
lstrlenA
GetDiskFreeSpaceExW
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
ExitProcess
CloseHandle
GetLastError
CreateProcessW
CopyFileW
GetCurrentThreadId
GetCurrentProcessId
GetTempPathW
GetModuleFileNameW
LocalFree
GetCurrentProcess
InterlockedExchange
GetExitCodeProcess
WaitForSingleObject
GetVersionExW
GetNativeSystemInfo
DeleteFileW
Sleep
CreateDirectoryW
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
GetTickCount
OutputDebugStringW
RemoveDirectoryW
MoveFileExW
GetSystemDirectoryW
LocalAlloc
HeapFree
HeapAlloc
GetProcessHeap
FreeLibrary
LoadLibraryW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
ReadFile
GetFileSize
CreateFileW
LockResource
SizeofResource
LoadResource
FindResourceW
OpenProcess
GetProcAddress
LoadLibraryA
Process32NextW
GetSystemTimeAsFileTime
QueryFullProcessImageNameW
Process32FirstW
CreateToolhelp32Snapshot
FindClose
TerminateProcess
FindNextFileW
FindFirstFileW
GetFileAttributesW
WideCharToMultiByte
user32
SetWindowTextW
PostMessageW
SetCursor
LoadCursorW
wvsprintfW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
ExitWindowsEx
MessageBoxW
PostQuitMessage
InflateRect
OffsetRect
GetWindowLongW
SetWindowLongW
SetWindowPos
LoadStringW
wsprintfW
FindWindowW
GetWindowThreadProcessId
ShowWindow
CreateAcceleratorTableW
MoveWindow
InvalidateRgn
GetWindowTextLengthW
GetWindowTextW
GetSysColor
ClientToScreen
SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetRect
CharPrevW
DrawTextW
FillRect
IntersectRect
CharNextW
SetWindowRgn
IsZoomed
IsIconic
GetClassInfoExW
RegisterClassExW
RegisterClassW
SetPropW
GetPropW
CallWindowProcW
GetSystemMetrics
LoadImageW
MonitorFromWindow
GetMonitorInfoW
EnableWindow
GetKeyState
DefWindowProcW
GetMessageW
GetParent
GetCursorPos
ScreenToClient
GetWindow
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
GetWindowRect
MapWindowPoints
CreateWindowExW
GetFocus
SetFocus
DestroyWindow
ReleaseDC
PtInRect
ReleaseCapture
SetCapture
IsWindow
KillTimer
SetTimer
InvalidateRect
GetClientRect
GetDC
SendMessageW
gdi32
GetObjectA
GetDeviceCaps
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
SetBkMode
SetTextColor
RoundRect
CreatePenIndirect
MoveToEx
LineTo
CreateSolidBrush
SetBkColor
ExtTextOutW
SetStretchBltMode
CreateDIBSection
StretchBlt
CombineRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SelectClipRgn
CreateRoundRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
SaveDC
BitBlt
RestoreDC
Rectangle
SetWindowOrgEx
DeleteDC
CreatePen
GetStockObject
GetObjectW
CreateFontIndirectW
DeleteObject
SelectObject
GetTextMetricsW
advapi32
LookupPrivilegeValueW
OpenProcessToken
DeregisterEventSource
RegDeleteKeyValueW
RegOpenKeyExW
RegQueryValueExW
DuplicateTokenEx
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyExW
RegSetValueExW
RegCloseKey
StartServiceW
EnumDependentServicesW
ControlService
QueryServiceStatusEx
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ChangeServiceConfigW
RegisterEventSourceW
ReportEventW
AdjustTokenPrivileges
shell32
CommandLineToArgvW
ord165
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHCreateDirectoryExW
SHFileOperationW
ShellExecuteW
SHBrowseForFolderW
SHGetFolderPathW
SHGetSpecialFolderPathW
ole32
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
CoCreateGuid
CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
msvcp90
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?capacity@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI_W@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
??7ios_base@std@@QBE_NXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
gdiplus
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateLineBrushI
GdiplusStartup
GdipDrawString
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteFont
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneBrush
GdiplusShutdown
GdipDeleteGraphics
comctl32
_TrackMouseEvent
ord17
msvcr90
toupper
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
_CxxThrowException
_beginthreadex
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
wcscpy_s
printf
_local_unwind4
_wsplitpath
rand
srand
memcpy
_wtoi64
_wcsicmp
_close
?_wsopen@@YAHPB_WHHH@Z
_wrename
wcsrchr
memmove_s
isalnum
iswalnum
malloc
free
sprintf_s
fprintf
abort
modf
strchr
_finite
sprintf
strstr
realloc
wcstol
wcsncpy
tolower
_wfopen
fwrite
memmove
_vsnprintf_s
isalpha
isspace
strncmp
wcschr
wcslen
wcscat
wcscpy
strlen
wcscmp
_wcsupr
_wcslwr
??0exception@std@@QAE@ABQBD@Z
isdigit
wcstoul
_gmtime64
calloc
strcmp
strcpy
memcmp
wcsncmp
abs
_lrotl
strcpy_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_vsnwprintf
_vswprintf
wcsstr
_wfopen_s
fseek
ftell
rewind
fread
fclose
??_V@YAXPAX@Z
_wcsdup
swprintf_s
memset
_swprintf
_waccess
_wtoi
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_purecall
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
shlwapi
SHDeleteKeyW
PathCombineW
PathFileExistsW
iphlpapi
GetAdaptersInfo
ws2_32
ntohl
ntohs
htonl
htons
Sections
.text Size: 612KB - Virtual size: 611KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 361KB - Virtual size: 360KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ