Static task
static1
Behavioral task
behavioral1
Sample
ff7025ca0121dcb41b4cae60a1873b16d137033f4393a394831138fa28a3885a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ff7025ca0121dcb41b4cae60a1873b16d137033f4393a394831138fa28a3885a.exe
Resource
win10v2004-20230703-en
General
-
Target
ff7025ca0121dcb41b4cae60a1873b16d137033f4393a394831138fa28a3885a
-
Size
1.3MB
-
MD5
b55d6b002f9ded14691c38dbb5aabb22
-
SHA1
855f5700df6b7091fc59c372839f4bde902dc660
-
SHA256
ff7025ca0121dcb41b4cae60a1873b16d137033f4393a394831138fa28a3885a
-
SHA512
9395dd9678e0f19ba029f14e76e1cdf51b3aa88ce10ff84811d820b3b7f8d83f6695f0422eda04a0014da082b790d546183caaafe2b17fe949c845472470ed4b
-
SSDEEP
24576:lBbkg6VQ+VlrG2J88+mw0apga2Uy9AdH8I/hjrQ6NFxgTlAkAeBjUH55z1bhvCxs:D4PPVb+R0apLylIpQ6NFxgTlAkw591bn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff7025ca0121dcb41b4cae60a1873b16d137033f4393a394831138fa28a3885a
Files
-
ff7025ca0121dcb41b4cae60a1873b16d137033f4393a394831138fa28a3885a.exe windows x86
17eabce09a155e45bd853f29380ed562
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
shlwapi
PathIsNetworkPathW
PathFileExistsW
crypt32
CertFreeCertificateContext
CryptMsgClose
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
kernel32
MoveFileExW
Sleep
GetTempPathW
CreateFileW
FileTimeToSystemTime
LocalFree
GetUserDefaultLangID
WriteFile
SetFilePointer
GetCurrentThreadId
GetLocalTime
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
DeleteFileW
MoveFileW
InitializeCriticalSectionAndSpinCount
FormatMessageW
GetFileTime
GetFileSize
SetEndOfFile
SetFileTime
ReadFile
HeapAlloc
GlobalFree
GlobalAlloc
GetLastError
CreateMutexW
WaitForMultipleObjects
InterlockedIncrement
GetModuleHandleW
GetProcessHeap
GetProcAddress
GetModuleFileNameW
InterlockedDecrement
HeapFree
FindResourceW
LoadResource
GetSystemInfo
LockResource
lstrcmpiW
DeviceIoControl
InterlockedExchange
SetLastError
GlobalMemoryStatusEx
InitializeSListHead
ResumeThread
GetTickCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
GetComputerNameW
GetTempFileNameW
CopyFileW
GetWindowsDirectoryW
GetCurrentDirectoryW
SetFileAttributesW
ExpandEnvironmentStringsW
GetFileAttributesW
GetVolumeInformationW
GetDiskFreeSpaceW
GetDriveTypeW
FindFirstFileW
GetLongPathNameW
OpenMutexW
GetCurrentProcessId
CloseHandle
GetFileAttributesExW
GetCurrentProcess
FindNextFileW
FindClose
GetFileSizeEx
OpenProcess
CreateDirectoryW
GetFullPathNameW
RemoveDirectoryW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SearchPathW
TerminateProcess
InterlockedExchangeAdd
CreateEventW
SetEvent
ResetEvent
CreateProcessW
GetExitCodeProcess
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
FreeLibrary
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
lstrlenW
GetVersionExW
user32
GetWindowLongW
IsWindowVisible
SendMessageW
wsprintfW
IsWindow
ShowWindow
SetForegroundWindow
advapi32
DeleteService
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ChangeServiceConfig2W
ControlService
StartServiceW
OpenServiceW
shell32
SHGetPathFromIDListW
SHGetFolderPathW
ShellExecuteW
SHChangeNotify
ole32
CoCreateInstance
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Facet_base@std@@UAE@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
_Strcoll
??_7facet@locale@std@@6B@
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Strxfrm
??_7_Facet_base@std@@6B@
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
vcruntime140
wcsrchr
strchr
wcschr
memchr
__CxxFrameHandler3
__std_type_info_name
__std_exception_destroy
wcsstr
memmove
memcpy
memset
_CxxThrowException
_except_handler4_common
_purecall
strstr
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__p__commode
__stdio_common_vswprintf_s
__stdio_common_vsscanf
__stdio_common_vswscanf
__stdio_common_vsprintf
_set_fmode
rewind
fclose
fputws
_wfopen
ftell
fopen
fseek
fread
_wfopen_s
fwrite
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_set_app_type
_errno
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
exit
_exit
_beginthreadex
api-ms-win-crt-heap-l1-1-0
malloc
free
realloc
_callnewh
calloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
atoi
wcstoul
_wtoi
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setlocale
api-ms-win-crt-string-l1-1-0
isalnum
_wcsicmp
towupper
towlower
_wcsnicmp
wcsncpy
_stricmp
tolower
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-time-l1-1-0
_mktime64
_localtime64
_time64
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
_splitpath_s
api-ms-win-crt-math-l1-1-0
modf
_except1
__setusermatherr
_dtest
Sections
.text Size: 932KB - Virtual size: 932KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 189KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ