Static task
static1
Behavioral task
behavioral1
Sample
7267e54646538a2bee233da48dc0520586e781fbef80c41dd9479f9e40854615.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
7267e54646538a2bee233da48dc0520586e781fbef80c41dd9479f9e40854615.exe
Resource
win10v2004-20230703-en
General
-
Target
7267e54646538a2bee233da48dc0520586e781fbef80c41dd9479f9e40854615
-
Size
222KB
-
MD5
6f519f65b7367ee7bf859e18168247ea
-
SHA1
a13e69e7cc17269d4d39d743ad227e227ae4a7df
-
SHA256
7267e54646538a2bee233da48dc0520586e781fbef80c41dd9479f9e40854615
-
SHA512
c2ba05530d7c2daf80e8b2ebdc5720eceba2501f20450cc04a6481d021ce5f5c28e63c18af72f7967d19c2621b2188f5f0ffc56bbfe2ebb763aa643fdc4f36c0
-
SSDEEP
6144:aBNYj5b7bX/AlQ8CLBymfORVpjMVlQBl11p/+l:arY9b7bIC9rfO/pjIeT+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7267e54646538a2bee233da48dc0520586e781fbef80c41dd9479f9e40854615
Files
-
7267e54646538a2bee233da48dc0520586e781fbef80c41dd9479f9e40854615.exe windows x86
6e02cc424ab490459fb12ea04ba2ee00
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
filechecklib
??1CFileCheck@@QAE@XZ
kernel32
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
Sleep
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetTempPathA
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringA
SetLastError
GetModuleFileNameW
GetModuleHandleA
LoadLibraryW
EnterCriticalSection
user32
UnregisterClassA
msvcp140
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Xlength_error@std@@YAXPBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exception@std@@YA_NXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
vcruntime140
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__std_terminate
memcpy
memmove
_except_handler4_common
__std_type_info_destroy_list
__CxxFrameHandler3
__current_exception
strchr
strstr
__current_exception_context
_purecall
memset
api-ms-win-crt-runtime-l1-1-0
_exit
exit
_register_onexit_function
__p___argv
_initterm_e
_register_thread_local_exe_atexit_callback
_initterm
_initialize_onexit_table
_get_initial_narrow_environment
terminate
_controlfp_s
_invalid_parameter_noinfo
_errno
_initialize_narrow_environment
_set_app_type
_seh_filter_exe
_cexit
_configure_narrow_argv
_crt_at_quick_exit
_c_exit
_execute_onexit_table
__p___argc
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_crt_atexit
api-ms-win-crt-heap-l1-1-0
free
_recalloc
_set_new_mode
malloc
_callnewh
api-ms-win-crt-stdio-l1-1-0
fclose
fflush
fgetc
__stdio_common_vfprintf
_get_stream_buffer_pointers
__p__commode
_set_fmode
__stdio_common_vsprintf
_ftelli64
fopen
ferror
_wfopen
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
__acrt_iob_func
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
_access
api-ms-win-crt-convert-l1-1-0
_strtoui64
_strtoi64
strtol
strtod
_ecvt_s
atof
strtoul
api-ms-win-crt-math-l1-1-0
_finite
_CIfmod
__setusermatherr
ceil
_except1
_isnan
floor
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
oleaut32
SysFreeString
Sections
.text Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ