Static task
static1
Behavioral task
behavioral1
Sample
38932ef5fcebf626b81546a84500b581c5ec305fa40653fada4f615c5d6de012.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
38932ef5fcebf626b81546a84500b581c5ec305fa40653fada4f615c5d6de012.exe
Resource
win10v2004-20230703-en
General
-
Target
38932ef5fcebf626b81546a84500b581c5ec305fa40653fada4f615c5d6de012
-
Size
566KB
-
MD5
dd511e6bc51fa48f207aa8ee163d7b7d
-
SHA1
0cf5bd16a1a90bacafd8c1c2c22dd7a25aa63ac8
-
SHA256
38932ef5fcebf626b81546a84500b581c5ec305fa40653fada4f615c5d6de012
-
SHA512
00ab2cd41091fa7619ad9d41b1907a0e0c09fc9c3fc3d4fdc2eae07a7789cbf1f0230db87522366954ee895a7201ccea5bc24d214bb4ab551faa657224359169
-
SSDEEP
12288:FrarU/REniwYz/p0cdvQpvVk1xccFA4L/Y0EzaTziUCwGt4i9sbPt4lqcUVIheIm:FrarU/REnijz/p0cdvQpvVkbccFA4L/P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 38932ef5fcebf626b81546a84500b581c5ec305fa40653fada4f615c5d6de012
Files
-
38932ef5fcebf626b81546a84500b581c5ec305fa40653fada4f615c5d6de012.exe windows x86
355c625e7c9d7b3627f05e04413dda78
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
filechecklib
?SetSingleThreadParam@CFileCheck@@QAE_NABUST_PARAM@@@Z
?CheckFile@CFileCheck@@QAE_NABUST_File@@AAV?$vector@UST_FILERESULT@@V?$allocator@UST_FILERESULT@@@std@@@std@@@Z
?UnInit@CFileCheck@@QAEXXZ
?MultiThreadCheck@CFileCheck@@QAE_NXZ
?SetParam@CFileCheck@@QAE_NABUST_PARAM@@PAVCHttpPostData@@@Z
??1CFileCheck@@QAE@XZ
kernel32
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
Sleep
WaitForMultipleObjects
DecodePointer
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
ReleaseMutex
CreateMutexA
CreateFileA
FlushFileBuffers
ReadFile
WriteFile
GetStdHandle
GetTempPathA
CreatePipe
CreateProcessA
GetModuleFileNameA
GetLogicalDriveStringsA
GetConsoleWindow
GetCompressedFileSizeA
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
LoadLibraryW
RaiseException
CreateThread
GetModuleHandleA
GetModuleFileNameW
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringA
SetLastError
EnterCriticalSection
user32
UnregisterClassA
ShowWindow
advapi32
GetUserNameA
shell32
SHGetSpecialFolderPathA
msvcp140
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??7ios_base@std@@QBE_NXZ
?eof@ios_base@std@@QBE_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Xout_of_range@std@@YAXPBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Xlength_error@std@@YAXPBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
vcruntime140
_except_handler4_common
__std_type_info_destroy_list
__current_exception_context
__std_terminate
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memchr
__current_exception
memset
strchr
_purecall
strstr
api-ms-win-crt-runtime-l1-1-0
_seh_filter_dll
_configure_narrow_argv
_invalid_parameter_noinfo
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_errno
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_controlfp_s
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
strncmp
tolower
isspace
strncpy
toupper
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
_ftelli64
ferror
_set_fmode
__p__commode
_get_stream_buffer_pointers
fclose
_wfopen
fflush
fgetc
fgetpos
_popen
_pclose
freopen
__acrt_iob_func
fputc
ftell
fseek
fgets
__stdio_common_vfprintf
fread
fsetpos
_fseeki64
fopen
__stdio_common_vsprintf
fwrite
ungetc
setvbuf
api-ms-win-crt-heap-l1-1-0
free
_set_new_mode
_recalloc
_callnewh
malloc
api-ms-win-crt-convert-l1-1-0
atof
strtol
strtoul
_strtoi64
atoi
_ecvt_s
_strtoui64
strtod
api-ms-win-crt-filesystem-l1-1-0
_findnext64i32
_lock_file
_findfirst64i32
_stat64i32
_mkdir
_access
_unlock_file
_findclose
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
_localtime64
api-ms-win-crt-math-l1-1-0
floor
_isnan
_finite
_except1
__setusermatherr
ceil
_CIfmod
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
oleaut32
SysFreeString
Sections
.text Size: 478KB - Virtual size: 478KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ