Static task
static1
Behavioral task
behavioral1
Sample
5f5c13be481a62da11d8a89cf8d2d510c03a41e67f65231fe78b37a5532669e2.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5f5c13be481a62da11d8a89cf8d2d510c03a41e67f65231fe78b37a5532669e2.exe
Resource
win10v2004-20230220-en
General
-
Target
5f5c13be481a62da11d8a89cf8d2d510c03a41e67f65231fe78b37a5532669e2
-
Size
1.3MB
-
MD5
d99a09d80dbe0bfe572123f4b34ffce4
-
SHA1
85ebc905d31686c0ab6a355bd7a22d4b2b8bb93e
-
SHA256
5f5c13be481a62da11d8a89cf8d2d510c03a41e67f65231fe78b37a5532669e2
-
SHA512
e12e1fdd7336e8f5d656dd5369537ea55e1f4513f3d8d610134b3918f75ebe463305d1e2b3e61667ce4aeaacf7b72e140eb25728c6984c1c3df599e0485f7753
-
SSDEEP
24576:9aphphUHFbtVqKeiGkn4Rwnvg2v67wf+UTr/yTPjt5We3wNw/FdnFrWd7xi:9ahqhqaGkLoTATr/yTLtOwjnFrWd7xi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f5c13be481a62da11d8a89cf8d2d510c03a41e67f65231fe78b37a5532669e2
Files
-
5f5c13be481a62da11d8a89cf8d2d510c03a41e67f65231fe78b37a5532669e2.exe windows x86
343bd6b05fcebe2b5614329ea0163c16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
shlwapi
PathFileExistsW
PathIsNetworkPathW
crypt32
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptMsgClose
psapi
GetModuleFileNameExW
kernel32
GetProcessHeap
GetModuleHandleW
InterlockedIncrement
MoveFileExW
GetTempPathW
CreateFileW
FileTimeToSystemTime
LocalFree
GetUserDefaultLangID
WriteFile
SetFilePointer
GetCurrentThreadId
GetLocalTime
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
DeleteFileW
MoveFileW
InitializeCriticalSectionAndSpinCount
ReadFile
SetEndOfFile
GetFileSize
GetComputerNameW
GetTickCount
SetEvent
lstrlenW
InterlockedExchange
InterlockedExchangeAdd
SetLastError
LoadLibraryW
GlobalMemoryStatusEx
FreeLibrary
ExpandEnvironmentStringsW
WaitForMultipleObjects
GetCurrentProcess
GetFileAttributesW
CopyFileW
GetLongPathNameW
InterlockedDecrement
GetDriveTypeW
GetDiskFreeSpaceW
GetVolumeInformationW
CreateEventW
ResetEvent
GetModuleFileNameW
GetFileAttributesExW
GetProcAddress
HeapFree
OpenMutexW
GetCurrentProcessId
CloseHandle
GetLastError
Sleep
OpenProcess
CreateProcessW
GetExitCodeProcess
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExW
GetTempFileNameW
DeviceIoControl
FormatMessageW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
GetWindowsDirectoryW
GetCurrentDirectoryW
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
CreateDirectoryW
GetFileSizeEx
ResumeThread
FindClose
FindFirstFileW
CreateMutexW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SearchPathW
TerminateProcess
GetVersionExW
FindNextFileW
GetFileTime
SetFileTime
HeapAlloc
GlobalFree
GlobalAlloc
FindResourceW
LoadResource
GetSystemInfo
LockResource
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
user32
wsprintfW
SetForegroundWindow
IsWindow
ShowWindow
SendMessageW
IsWindowVisible
GetWindowLongW
advapi32
RegCreateKeyExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ChangeServiceConfig2W
DeleteService
ControlService
StartServiceW
OpenServiceW
shell32
ShellExecuteW
SHChangeNotify
SHGetPathFromIDListW
SHGetFolderPathW
ole32
CoCreateInstance
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?uncaught_exception@std@@YA_NXZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Facet_base@std@@UAE@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
_Strcoll
??_7facet@locale@std@@6B@
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Strxfrm
??_7_Facet_base@std@@6B@
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
vcruntime140
__std_exception_destroy
__std_exception_copy
strchr
__std_type_info_name
__CxxFrameHandler3
wcsrchr
wcschr
wcsstr
strstr
_except_handler4_common
_CxxThrowException
memset
memmove
memcpy
memchr
_purecall
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
__stdio_common_vswscanf
_set_fmode
__p__commode
__stdio_common_vswprintf
__stdio_common_vsscanf
fclose
fputws
__stdio_common_vsprintf_s
__stdio_common_vsprintf
_wfopen
ftell
fopen
fseek
fread
fwrite
rewind
_wfopen_s
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_errno
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_crt_atexit
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo
_controlfp_s
_beginthreadex
_invalid_parameter_noinfo_noreturn
terminate
api-ms-win-crt-heap-l1-1-0
malloc
calloc
realloc
_set_new_mode
free
_callnewh
api-ms-win-crt-convert-l1-1-0
wcstoul
atoi
_wtoi
api-ms-win-crt-locale-l1-1-0
setlocale
_configthreadlocale
api-ms-win-crt-string-l1-1-0
wcsncpy
tolower
_stricmp
_wcsicmp
_wcsnicmp
towlower
towupper
isalnum
api-ms-win-crt-time-l1-1-0
_localtime64_s
_localtime64
_time64
_mktime64
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-filesystem-l1-1-0
_splitpath_s
api-ms-win-crt-math-l1-1-0
modf
_dtest
__setusermatherr
_except1
Sections
.text Size: 1024KB - Virtual size: 1023KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ