OPENSSL_Applink
Static task
static1
Behavioral task
behavioral1
Sample
ARU.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ARU.exe
Resource
win10v2004-20230220-en
General
-
Target
ARU.exe
-
Size
8.2MB
-
MD5
9cf9c8025205c230c7d871c8049e5df4
-
SHA1
2681cd5deba4055526ce1ef800b63cc4411554bb
-
SHA256
be8fe84fa517ff7f0d0775e6d1609f3da3ea192dc724fe3534d1a293f64c4868
-
SHA512
b8122fedc4e0c4137beadf26a9e5ee631f20c96c982993cb3edea221ec697f093164393d3bf4c97c1fe2aaf047728e8ba1dd24631d70e2cd769f35019dd40421
-
SSDEEP
98304:62JiaHuJYye0mrB1LuoKbUU0HuGkc1VQ6/u4EoHeS4:62JiaHv/pt1L/KbUTHuiVQ6/u4+S4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ARU.exe
Files
-
ARU.exe.exe windows x86
d94329d2b8fb6b713c29259d19fcdd82
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
cdlli63
_SqlRunStartup@12
csi63
?LocateRunFile@@YGJPAUHINSTANCE__@@PA_W@Z
mfc110u
ord4991
ord4992
ord296
ord1039
ord1516
ord8308
ord1502
ord12057
ord12089
ord8062
ord12077
ord5789
ord3794
ord6723
ord989
ord6219
ord14488
ord6220
ord14489
ord6218
ord14487
ord7847
ord12364
ord14287
ord11821
ord11820
ord1985
ord7789
ord12779
ord4031
ord4093
ord9248
ord14415
ord7770
ord14409
ord12375
ord12374
ord2432
ord10224
ord5233
ord8169
ord4528
ord12697
ord10278
ord12085
ord8230
ord1463
ord7505
ord8314
ord9059
ord10095
ord8064
ord5285
ord7563
ord1504
ord5128
ord2355
ord7573
ord7572
ord5109
ord5287
ord5131
ord5638
ord5401
ord9200
ord5635
ord5425
ord2194
msvcr110
__crtGetShowWindowMode
exit
__set_app_type
__wgetmainargs
_XcptFilter
_purecall
_CxxThrowException
__CxxFrameHandler3
_wsplitpath
_amsg_exit
memcpy
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
memmove
kernel32
GetProcAddress
EncodePointer
DecodePointer
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
LoadLibraryW
QueryPerformanceCounter
GetModuleFileNameW
user32
wsprintfW
MessageBoxW
comctl32
ord17
ole32
CoUninitialize
CoInitializeEx
msvcp110
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
Exports
Exports
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ