Static task
static1
Behavioral task
behavioral1
Sample
Tap.zip
Resource
win10-20230703-en
General
-
Target
Tap.zip
-
Size
5.3MB
-
MD5
38dd9548b8bddf8b3e5c98bf09bebc88
-
SHA1
fd9a5c5d03f5516dc30a32588c3e0dac45eef0d1
-
SHA256
aea7e2aa9e9c058839161f8c5c9c7dc1c2cf7dad1d6998560382a9b66fcdd0c1
-
SHA512
37e9d00b9befdcb014bacdc159ee805cf537705f31cfc90b07de95cfe13fd358aebbf105b6f8cfbcaae4eda9f40514b181fe5bfa8ea429d17fb80db462f0af64
-
SSDEEP
98304:ct7WDPBM6MGCGe64SEv0b3awThpWEjUmUfkDlfPIF6HszRfdwWA4+HHMr:ctMZVMGCr6XEMb3aKpGoPIFxzRlBUMr
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tap.exe unpack001/TapCrack.dll unpack001/TapLoader.exe
Files
-
Tap.zip.zip
-
ReadMe.txt
-
Tap.exe.exe windows x64
b56ee3a0fbd0d198e092f1256799a946
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
opengl32
wglGetProcAddress
kernel32
MultiByteToWideChar
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
QueryPerformanceCounter
QueryPerformanceFrequency
GetFileSizeEx
CreateFileA
SetLastError
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
WideCharToMultiByte
MoveFileExA
GetTickCount
VerifyVersionInfoA
GetModuleHandleA
GetSystemDirectoryA
SleepEx
InitializeCriticalSectionEx
FormatMessageA
LocalFree
TerminateProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
VirtualQueryEx
IsDebuggerPresent
GetConsoleWindow
ReadProcessMemory
CreateThread
CloseHandle
Process32Next
GetLastError
K32GetModuleFileNameExA
Sleep
CreateToolhelp32Snapshot
OpenProcess
ReleaseMutex
WaitForSingleObject
GetVolumeInformationA
CreateMutexA
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
WriteProcessMemory
Process32First
SetConsoleCtrlHandler
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetEnvironmentVariableA
user32
SystemParametersInfoW
RegisterDeviceNotificationW
EnumDisplaySettingsW
EnumDisplaySettingsExW
EnumDisplayDevicesW
ChangeDisplaySettingsExW
GetRawInputDeviceList
GetRawInputDeviceInfoA
DispatchMessageW
LoadImageW
RegisterClassExW
GetPropW
DefWindowProcW
TrackMouseEvent
ReleaseCapture
SetCapture
PtInRect
CopyIcon
WindowFromPoint
SetCursor
LoadCursorW
ScreenToClient
IsZoomed
IsIconic
PeekMessageW
GetAsyncKeyState
GetKeyState
GetMessageTime
ClientToScreen
ClipCursor
AdjustWindowRectEx
GetWindowThreadProcessId
GetMessageA
GetWindow
EnumDisplayDevicesA
DispatchMessageA
GetWindowRect
GetDC
IsWindowVisible
keybd_event
CallNextHookEx
ShowWindow
GetKeyNameTextA
SetWindowsHookExA
GetWindowTextA
MapVirtualKeyA
MessageBoxA
GetForegroundWindow
MoveWindow
UnhookWindowsHookEx
EnumWindows
TranslateMessage
mouse_event
GetDesktopWindow
SetCursorPos
GetCursorPos
SendInput
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetClientRect
SetPropW
CreateWindowExW
DestroyWindow
RemovePropW
UnregisterClassW
DestroyIcon
GetActiveWindow
GetWindowLongW
SetWindowLongW
BringWindowToTop
SetForegroundWindow
SetFocus
SetWindowPos
gdi32
CreateDCW
DeleteDC
GetDeviceCaps
GetPixel
SwapBuffers
SetPixelFormat
DescribePixelFormat
advapi32
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
GetCurrentHwProfileA
shell32
DragQueryPoint
DragFinish
DragAcceptFiles
ShellExecuteA
DragQueryFileW
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
msvcp140
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Cnd_unregister_at_thread_exit
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
_Mtx_init_in_situ
_Cnd_register_at_thread_exit
_Cnd_do_broadcast_at_thread_exit
_Cnd_wait
_Thrd_detach
_Mtx_unlock
_Cnd_broadcast
_Cnd_destroy_in_situ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
normaliz
IdnToAscii
ws2_32
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
closesocket
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
recv
getsockname
send
getpeername
connect
bind
WSAGetLastError
ntohl
wldap32
ord50
ord41
ord22
ord26
ord301
ord32
ord33
ord35
ord79
ord30
ord45
ord27
ord60
ord211
ord46
ord217
ord143
ord200
crypt32
CertCreateCertificateChainEngine
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CryptQueryObject
CertGetNameStringA
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
ntdll
NtRaiseHardError
RtlLookupFunctionEntry
RtlCaptureContext
RtlAdjustPrivilege
VerSetConditionMask
RtlVirtualUnwind
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
memchr
memcmp
memmove
strrchr
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
memcpy
__std_exception_copy
__std_terminate
strstr
strchr
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
_lseeki64
__p__commode
fgets
_read
_write
_close
_open
_get_stream_buffer_pointers
_fseeki64
ftell
fgetpos
fputc
setvbuf
ungetc
__acrt_iob_func
feof
fputs
fopen
fflush
fgetc
getchar
_set_fmode
fclose
fseek
__stdio_common_vfprintf
fsetpos
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
api-ms-win-crt-string-l1-1-0
strcspn
strncmp
isprint
strspn
tolower
strpbrk
strcmp
strncpy
_strdup
isupper
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-heap-l1-1-0
free
realloc
malloc
_callnewh
calloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_c_exit
_register_thread_local_exe_atexit_callback
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
_wassert
_set_app_type
exit
_seh_filter_exe
_cexit
_beginthreadex
system
terminate
_crt_atexit
_errno
_Exit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
__p___argc
strerror
_invalid_parameter_noinfo_noreturn
__sys_nerr
_getpid
__p___argv
api-ms-win-crt-convert-l1-1-0
atof
strtod
strtoll
strtoull
strtol
atoi
strtoul
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
asctime
_localtime64
api-ms-win-crt-math-l1-1-0
_dsign
powf
floorf
cosf
ceilf
__setusermatherr
pow
sinf
sqrt
fmodf
_dclass
sqrtf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_access
_stat64
_unlink
_fstat64
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 780KB - Virtual size: 780KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 333KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 1000KB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
TapCrack.dll.dll windows x64
844d97eebee0ec332d39551ab1089c29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateThread
CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
Sleep
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
GetProcessHeap
GetLastError
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeLibrary
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
RaiseException
IsDebuggerPresent
vcruntime140
__std_type_info_destroy_list
__vcrt_GetModuleFileNameW
__C_specific_handler
memset
__C_specific_handler_noexcept
memcpy
__vcrt_LoadLibraryExW
strstr
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initterm_e
_initterm
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_dll
api-ms-win-crt-string-l1-1-0
strcpy_s
strcat_s
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TapLoader.exe.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp Size: - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.8MB - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ