Static task
static1
Behavioral task
behavioral1
Sample
bff0d2b02f46c5974c8be9c99689d020f0d56489aca70b0857b835130dde12d7.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bff0d2b02f46c5974c8be9c99689d020f0d56489aca70b0857b835130dde12d7.exe
Resource
win10v2004-20230703-en
General
-
Target
bff0d2b02f46c5974c8be9c99689d020f0d56489aca70b0857b835130dde12d7
-
Size
3.9MB
-
MD5
40b2e9bddc5fa3cf8aae9075bea59276
-
SHA1
0786fc6e4544ae392bfac1672d4656d067b682c6
-
SHA256
bff0d2b02f46c5974c8be9c99689d020f0d56489aca70b0857b835130dde12d7
-
SHA512
eb9d2c4f5ed85c2392b310973cc8001c95c87dc794d31baf91aa449147cd01516a3d8d6de2ffeaaf2db5ddfc842dff84f126a6689c3ce0bc69058f7e256361ed
-
SSDEEP
49152:n6DnIJzjk4VpfERDeepXSFrx3KEvd7//z2BT/rTV5YTICVHAohQzDwuEt2dhc3lX:n6jIJzhAzBcrt//svPYRA3Dyt2jc31
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bff0d2b02f46c5974c8be9c99689d020f0d56489aca70b0857b835130dde12d7
Files
-
bff0d2b02f46c5974c8be9c99689d020f0d56489aca70b0857b835130dde12d7.exe windows x86
c994993d9e6db94f03c9efc3c01748bf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
listen
htonl
accept
WSACleanup
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAEventSelect
recvfrom
sendto
gethostname
ntohl
connect
ioctlsocket
bind
WSAGetLastError
send
recv
WSAEnumNetworkEvents
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
closesocket
wldap32
ord216
ord14
ord46
ord219
ord145
ord301
ord147
ord133
ord79
ord142
ord167
ord73
ord127
ord27
ord26
ord117
ord41
ord208
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
kernel32
LocalFree
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetFileSizeEx
CreateFileW
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
WaitForSingleObjectEx
MoveFileExW
WideCharToMultiByte
MultiByteToWideChar
Sleep
GetTickCount
QueryPerformanceCounter
LoadLibraryW
GetModuleHandleW
FreeLibrary
GetSystemDirectoryW
QueryPerformanceFrequency
SleepEx
DeleteCriticalSection
InitializeCriticalSectionEx
CloseHandle
GetEnvironmentVariableA
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
LeaveCriticalSection
Process32FirstW
GetProcAddress
WinExec
GetLastError
SetLastError
FormatMessageW
EnterCriticalSection
advapi32
CryptGetHashParam
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
GetLengthSid
CryptReleaseContext
CryptAcquireContextW
LookupPrivilegeValueW
AdjustTokenPrivileges
SetTokenInformation
OpenProcessToken
ole32
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
oleaut32
VariantClear
SysFreeString
VariantInit
SysAllocString
msvcp140
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Xlength_error@std@@YAXPBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??0_Lockit@std@@QAE@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1_Lockit@std@@QAE@XZ
vcruntime140
__current_exception_context
__current_exception
_CxxThrowException
_except_handler4_common
wcschr
memchr
strstr
memmove
memcpy
strrchr
strchr
memset
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
fsetpos
fwrite
ungetc
fputc
_lseeki64
setvbuf
_set_fmode
__stdio_common_vsscanf
fclose
fgets
fgetc
fputs
_wfopen_s
__p__commode
_get_stream_buffer_pointers
fgetpos
fopen
_wfopen
__stdio_common_vsprintf
fflush
feof
fseek
ftell
fread
_fseeki64
_read
_write
_close
_open
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
terminate
_controlfp_s
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
_beginthreadex
_exit
__p___argc
__sys_nerr
_initterm_e
_getpid
_initterm
exit
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
strerror
_seh_filter_exe
_set_app_type
api-ms-win-crt-string-l1-1-0
_wcsdup
strncpy
isupper
wcsncpy
strspn
_strdup
strpbrk
wcsncmp
strncmp
wcspbrk
_wcsicmp
strcspn
tolower
api-ms-win-crt-filesystem-l1-1-0
_stat64
_wstat64
_access
_lock_file
_waccess
_unlink
_unlock_file
_fstat64
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
realloc
free
calloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoll
strtol
strtoul
wcstombs
atoi
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 305KB - Virtual size: 304KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ