Static task
static1
Behavioral task
behavioral1
Sample
8dfda70db63c76c602d231815730e483fa861b25ff9f5703799c4b1c2db5fa89.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8dfda70db63c76c602d231815730e483fa861b25ff9f5703799c4b1c2db5fa89.exe
Resource
win10v2004-20230220-en
General
-
Target
8dfda70db63c76c602d231815730e483fa861b25ff9f5703799c4b1c2db5fa89
-
Size
278KB
-
MD5
db085ac17bcbdd5955f3e959ece22adb
-
SHA1
acec59d41239bf1062bbb10080ca9507d4cb5242
-
SHA256
8dfda70db63c76c602d231815730e483fa861b25ff9f5703799c4b1c2db5fa89
-
SHA512
e83214344f2378a606ff6f3df2d0c9f8faca3923183121f56c6c2311819c63e01d784088361b3905d1e82c2be74ce44f4027168a205ce0f0af5ed7682953e30d
-
SSDEEP
3072:TjeHfKOSzP1gGUiUn9RSz8fUynqdbhIVWj4x3WNvbnnoRSRM4/c/GqcegXoLe:T0yDr1C190zAnFPwvQos
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8dfda70db63c76c602d231815730e483fa861b25ff9f5703799c4b1c2db5fa89
Files
-
8dfda70db63c76c602d231815730e483fa861b25ff9f5703799c4b1c2db5fa89.exe windows x86
eea0110b810e94e59191a9c4e33cd3e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
xsyslog
?xSyslog@@YAPAVCxSyslog@xcom@@XZ
uicomm
?onBroken@CxUesAppliction@@MAEXXZ
?qt_metacast@CxUesAppliction@@UAEPAXPBD@Z
?qt_metacall@CxUesAppliction@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?onIssue@CxUesAppliction@@MAEXABV?$CxStringBase@DUStrAlloc@xcom@@@xcom@@ABVCxByteArray@3@@Z
?onCallMethod@CxUesAppliction@@MAEHABV?$CxStringBase@DUStrAlloc@xcom@@@xcom@@ABVCxByteArray@3@AAV43@AAV23@@Z
??1CxUesAppliction@@UAE@XZ
?metaObject@CxUesAppliction@@UBEPBUQMetaObject@@XZ
??0CxUesAppliction@@QAE@AAHPAPAD@Z
qt5widgets
?event@QApplication@@MAE_NPAVQEvent@@@Z
?compressEvent@QApplication@@MAE_NPAVQEvent@@PAVQObject@@PAVQPostEventList@@@Z
?notify@QApplication@@UAE_NPAVQObject@@PAVQEvent@@@Z
qt5gui
?addApplicationFont@QFontDatabase@@SAHABVQString@@@Z
?setHighDpiScaleFactorRoundingPolicy@QGuiApplication@@SAXW4HighDpiScaleFactorRoundingPolicy@Qt@@@Z
?applicationFontFamilies@QFontDatabase@@SA?AVQStringList@@H@Z
?setQuitOnLastWindowClosed@QGuiApplication@@SAX_N@Z
qt5core
?qInstallMessageHandler@@YAP6AXW4QtMsgType@@ABVQMessageLogContext@@ABVQString@@@ZP6AX012@Z@Z
??1QByteArray@@QAE@XZ
??0QString@@QAE@XZ
?shared_null@QListData@@2UData@1@B
?translate@QTranslator@@UBE?AVQString@@PBD00H@Z
?timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z
?qt_metacast@QTranslator@@UAEPAXPBD@Z
?qt_metacall@QTranslator@@UAEHW4Call@QMetaObject@@HPAPAX@Z
?metaObject@QTranslator@@UBEPBUQMetaObject@@XZ
?isEmpty@QTranslator@@UBE_NXZ
?eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z
?event@QObject@@UAE_NPAVQEvent@@@Z
?disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?customEvent@QObject@@MAEXPAVQEvent@@@Z
?connectNotify@QObject@@MAEXABVQMetaMethod@@@Z
?childEvent@QObject@@MAEXPAVQChildEvent@@@Z
?setCurrent@QDir@@SA_NABVQString@@@Z
?entryInfoList@QDir@@QBE?AV?$QList@VQFileInfo@@@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z
?setNameFilters@QDir@@QAEXABVQStringList@@@Z
??1QDir@@QAE@XZ
??0QDir@@QAE@ABVQString@@@Z
?isFile@QFileInfo@@QBE_NXZ
?absolutePath@QFileInfo@@QBE?AVQString@@XZ
?fileName@QFileInfo@@QBE?AVQString@@XZ
?absoluteFilePath@QFileInfo@@QBE?AVQString@@XZ
??1QFileInfo@@QAE@XZ
?end@QListData@@QBEPAPAXXZ
??0QFileInfo@@QAE@ABV0@@Z
?load@QTranslator@@QAE_NABVQString@@000@Z
??1QTranslator@@UAE@XZ
??0QTranslator@@QAE@PAVQObject@@@Z
?setCodecForLocale@QTextCodec@@SAXPAV1@@Z
?codecForName@QTextCodec@@SAPAV1@PBD@Z
?installTranslator@QCoreApplication@@SA_NPAVQTranslator@@@Z
?applicationDirPath@QCoreApplication@@SA?AVQString@@XZ
?setAttribute@QCoreApplication@@SAXW4ApplicationAttribute@Qt@@_N@Z
?registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1PBX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z
??0QString@@QAE@ABV0@@Z
?begin@QListData@@QBEPAPAXXZ
?at@QListData@@QBEPAPAXH@Z
?size@QListData@@QBEHXZ
?append@QListData@@QAEPAPAXXZ
?dispose@QListData@@SAXPAUData@1@@Z
?dispose@QListData@@QAEXXZ
?realloc@QListData@@QAEXH@Z
?detach_grow@QListData@@QAEPAUData@1@PAHH@Z
?detach@QListData@@QAEPAUData@1@H@Z
?normalizedType@QMetaObject@@SA?AVQByteArray@@PBD@Z
?fromAscii_helper@QString@@CAPAU?$QTypedArrayData@G@@PBDH@Z
?toStdString@QString@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?fromUtf8@QString@@SA?AV1@PBDH@Z
?append@QString@@QAEAAV1@ABV1@@Z
??1QString@@QAE@XZ
shlwapi
PathFileExistsW
PathRemoveExtensionW
kernel32
LoadLibraryExW
DecodePointer
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetStringTypeW
SetStdHandle
LCMapStringW
CompareStringW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetCommandLineW
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
lstrlenW
LoadLibraryW
FreeLibrary
GetLocalTime
SuspendThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
SetUnhandledExceptionFilter
CloseHandle
GetCommandLineA
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
GetModuleFileNameW
GetProcAddress
WriteConsoleW
LocalAlloc
LocalFree
FormatMessageW
CreateDirectoryW
CreateFileW
GetFileAttributesW
Sections
.text Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 149KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ