Static task
static1
Behavioral task
behavioral1
Sample
HL2SRM.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
HL2SRM.exe
Resource
win10v2004-20230220-en
General
-
Target
HL2SRM.exe
-
Size
964KB
-
MD5
cc6421bbce200ea621d41790f6c62751
-
SHA1
255dfd6b3f446f385ec55d1cbd83577135cd2c65
-
SHA256
f92b5dc8eb88424316b1801657dfe809a8d1e84e5e77debba6521c9193a906ea
-
SHA512
a7c75d35b3a7f4fd13ced9f3ec74fedf9b119f0a2416b953a916579eaa408e5e337bb6f5ae04de5821e1edb40e1c9ffe5806bf9d636ceed458b79c7c3f622f1a
-
SSDEEP
12288:bmMJJDW2Oku+UeLmBJlw0AsoBFJTSeXV17B03QG3ah5OIvqomyBtfGZ7CRAMbLs9:37LmBJmqe3TSq03cbr7f07CRCKG/+u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource HL2SRM.exe
Files
-
HL2SRM.exe.exe windows x86
ac94ff070449b6c69ba5b776576d10d4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceA
LoadResource
LockResource
LocalFree
GetStartupInfoA
HeapReAlloc
InterlockedIncrement
HeapAlloc
GetProcessHeap
HeapFree
TlsFree
GetCurrentThreadId
GetCurrentProcess
FileTimeToSystemTime
TlsAlloc
TlsGetValue
TlsSetValue
GetVolumeInformationA
ReleaseMutex
CreateMutexA
InterlockedCompareExchange
InterlockedDecrement
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
WaitForSingleObject
SearchPathA
Sleep
GetPrivateProfileStringA
FormatMessageA
OutputDebugStringA
lstrcpyA
GetComputerNameA
GetVersionExA
GetModuleFileNameA
FindNextFileA
FindFirstFileA
SetErrorMode
DeviceIoControl
GetVersion
FreeLibrary
GetSystemTime
SystemTimeToFileTime
GetLocalTime
FindClose
GetFileSize
WriteFile
ReadFile
CloseHandle
CreateFileA
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetEnvironmentVariableA
GetCurrentProcessId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
LocalAlloc
SizeofResource
msvcp60
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$char_traits@D@std@@SAXAADABD@Z
??0bad_alloc@std@@QAE@ABV01@@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
msvcrt
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
??9type_info@@QBEHABV0@@Z
?name@type_info@@QBEPBDXZ
??8type_info@@QBEHABV0@@Z
malloc
memmove
_CxxThrowException
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
_purecall
free
??2@YAPAXI@Z
_local_unwind2
_except_handler3
time
srand
rand
__CxxFrameHandler
__p___argc
tolower
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
memcmp
_mbsrchr
atoi
memset
memchr
atol
mktime
strlen
?set_new_handler@@YAP6AXXZP6AXXZ@Z
strncmp
toupper
isalpha
__setusermatherr
ws2_32
connect
socket
htons
bind
accept
listen
inet_addr
WSAStartup
gethostname
select
send
recv
WSAGetLastError
gethostbyname
inet_ntoa
closesocket
WSACleanup
user32
wsprintfA
KillTimer
SetTimer
advapi32
CryptReleaseContext
CryptGenRandom
GetUserNameA
CryptAcquireContextA
Sections
.text Size: 668KB - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 116KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ