Static task
static1
Behavioral task
behavioral1
Sample
5f8aac638145efd417790b1468f9069d039182e7a79d83ce073b2143bd99aa11.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5f8aac638145efd417790b1468f9069d039182e7a79d83ce073b2143bd99aa11.exe
Resource
win10v2004-20230703-en
General
-
Target
5f8aac638145efd417790b1468f9069d039182e7a79d83ce073b2143bd99aa11
-
Size
1.9MB
-
MD5
621234332ae7e07a792a978d2dd07bbf
-
SHA1
dc14d1872c832d9c1cd3adc12293863af1c17e83
-
SHA256
5f8aac638145efd417790b1468f9069d039182e7a79d83ce073b2143bd99aa11
-
SHA512
b57e2cb408c6a192fe5ce3a9c72e97d1005fae78eda6634a4062c67608df26e1193b025e65a53374cdb5a2f066c1f96f4312b00259b2e9583280182064142cd1
-
SSDEEP
49152:IM90DEyCFvL1JoYb+15yq3YPos+o9qM39zq+fH22u9:I+0DTCp815f3YPN+oX9zq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f8aac638145efd417790b1468f9069d039182e7a79d83ce073b2143bd99aa11
Files
-
5f8aac638145efd417790b1468f9069d039182e7a79d83ce073b2143bd99aa11.exe windows x86
f0e4c8aec3960e13c7057a436ec098e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnlockFile
WriteFile
DuplicateHandle
GetCurrentProcess
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
GetFileTime
SetFileTime
SystemTimeToTzSpecificLocalTime
GetTickCount
GetUserDefaultLCID
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetThreadLocale
GetThreadPriority
SetEndOfFile
CreateTimerQueue
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetFilePointerEx
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
IsValidLocale
PeekNamedPipe
GetDriveTypeW
GetStdHandle
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
DosDateTimeToFileTime
GetFileType
TerminateThread
InterlockedDecrement
GetSystemDefaultLangID
InterlockedIncrement
GetStringTypeW
LCMapStringW
GetCPInfo
SwitchToThread
TryEnterCriticalSection
SetFilePointer
LockFile
GetVolumeInformationW
GetFullPathNameW
SignalObjectAndWait
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
SetThreadPriority
SetEvent
GetVersionExW
GetCurrentThread
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryA
LoadLibraryExW
SizeofResource
FreeResource
VirtualProtect
FreeLibrary
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
SystemTimeToFileTime
FileTimeToSystemTime
lstrcmpA
FormatMessageW
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryW
GetModuleHandleA
SetLastError
GetACP
lstrcmpiW
Sleep
DeleteFileW
MoveFileW
GetExitCodeProcess
GetComputerNameA
CreateProcessW
GetProcessHeap
GetFileSize
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetPrivateProfileStringW
HeapSize
CreateFileW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
CreateThread
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
FlushFileBuffers
ReadFile
DeleteCriticalSection
InitializeCriticalSection
CreateEventW
SetUnhandledExceptionFilter
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
WinExec
OutputDebugStringW
MoveFileExW
LocalFree
ExitProcess
CreateMutexW
GetCurrentProcessId
CloseHandle
DeleteFileA
GetFileAttributesW
GetModuleFileNameW
CreateDirectoryW
lstrcatW
lstrlenW
lstrcpynW
SetCurrentDirectoryW
GetCurrentDirectoryW
RemoveDirectoryW
OutputDebugStringA
GetModuleHandleW
GetProcAddress
WaitForSingleObject
CopyFileW
FindClose
FindNextFileW
FindFirstFileW
WideCharToMultiByte
lstrcpyW
GetSystemTime
GetLocalTime
MultiByteToWideChar
GetLastError
GetPrivateProfileIntW
WritePrivateProfileStringW
FindResourceW
LoadResource
LockResource
GetLogicalProcessorInformation
user32
EnableWindow
GetPropW
SetPropW
ShowScrollBar
GetScrollPos
RedrawWindow
GetWindowTextW
GetWindowTextLengthW
AdjustWindowRectEx
MessageBoxW
ScreenToClient
MapWindowPoints
GetSysColor
CopyRect
EqualRect
GetWindowLongW
SetWindowLongW
GetClassLongW
GetClassNameW
GetTopWindow
GetLastActivePopup
GetWindow
SetWindowsHookExW
GetCursorPos
IsWindow
UnhookWindowsHookEx
CallNextHookEx
LoadIconW
WinHelpW
PtInRect
SendMessageW
FindWindowW
RegisterWindowMessageW
MonitorFromWindow
GetMonitorInfoW
ShowWindow
IsWindowEnabled
PostMessageW
IsDialogMessageW
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
PostQuitMessage
SetWindowContextHelpId
MapDialogRect
GetMessageW
TranslateMessage
GetActiveWindow
ShowOwnedPopups
SetCursor
GetDC
ReleaseDC
GetSysColorBrush
LoadCursorW
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
ClientToScreen
FillRect
DestroyMenu
SystemParametersInfoW
RealChildWindowFromPoint
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
RemovePropW
ReleaseCapture
WindowFromPoint
SetTimer
KillTimer
InvalidateRect
CharNextW
CopyAcceleratorTableW
InvalidateRgn
SetRect
IntersectRect
IsRectEmpty
GetNextDlgGroupItem
MessageBeep
DestroyIcon
CharUpperW
SetWindowRgn
SetForegroundWindow
SetWindowPos
SetLayeredWindowAttributes
IsZoomed
GetUpdateRect
SendMessageTimeoutW
UpdateLayeredWindow
RegisterClassExW
GetWindowRgn
GetKeyboardLayout
CreateCaret
HideCaret
ShowCaret
SetCaretPos
CreateAcceleratorTableW
GetWindowRect
GetDesktopWindow
RegisterClipboardFormatW
wsprintfW
UnionRect
PostThreadMessageW
SetWindowTextW
SetCapture
BringWindowToTop
MoveWindow
IsIconic
ValidateRect
EndPaint
BeginPaint
GetForegroundWindow
BroadcastSystemMessageW
OffsetRect
GetSystemMetrics
GetParent
GetWindowThreadProcessId
SetActiveWindow
UnregisterClassW
SendDlgItemMessageA
GetClientRect
SetRectEmpty
GetSubMenu
GetMenuItemID
GetMenuItemCount
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsMenu
IsChild
DestroyWindow
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
GetDlgItem
GetDlgCtrlID
SetFocus
GetFocus
GetKeyState
GetCapture
GetMenu
SetMenu
UpdateWindow
gdi32
PtVisible
RectVisible
RestoreDC
SaveDC
ExtSelectClipRgn
SelectObject
SetBkMode
SetMapMode
GetWindowExtEx
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateFontIndirectW
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
CreateDIBSection
CombineRgn
GetMapMode
CreateCompatibleBitmap
CreateFontW
GetViewportExtEx
GetStockObject
GetClipBox
Escape
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreateDCW
GetDeviceCaps
SetBkColor
SetTextColor
GetObjectW
CreateBitmap
CreateCompatibleDC
GetDIBits
PtInRegion
BitBlt
TextOutW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
winspool.drv
DocumentPropertiesW
OpenPrinterW
ClosePrinter
advapi32
CloseServiceHandle
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
CreateServiceW
RegCloseKey
OpenSCManagerW
StartServiceW
OpenServiceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
QueryServiceStatusEx
RegDeleteValueW
RegOpenKeyW
RegCreateKeyExW
RegSetValueExW
shell32
ShellExecuteA
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFolderPathW
ShellExecuteW
DragQueryPoint
ShellExecuteExW
Shell_NotifyIconW
ExtractAssociatedIconW
DragQueryFileW
DragAcceptFiles
CommandLineToArgvW
shlwapi
PathFileExistsW
StrChrW
PathIsDirectoryW
StrToIntW
PathAppendW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathRemoveFileSpecW
PathCanonicalizeW
ole32
CoInitialize
CoCreateGuid
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoUninitialize
CLSIDFromString
CLSIDFromProgID
CreateStreamOnHGlobal
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoInitializeEx
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoGetMalloc
OleLockRunning
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoCreateInstance
oleaut32
SysAllocStringLen
VariantInit
VariantClear
VariantChangeType
SysAllocString
SysStringLen
SafeArrayDestroy
SystemTimeToVariantTime
VariantCopy
OleCreateFontIndirect
SysFreeString
VariantTimeToSystemTime
GetErrorInfo
oledlg
OleUIBusyW
monsafe
DecryptSafeFile
MonDriverIsRunning
MonLoadDriver
MonGetFileId
MonInstDriver
MonStartRelate
MonUpdatePolicy
MonSetWorkMode
GetShieldRoot
GetDecryptBakRoot
MonStartFilter
MonIsEncryptFile
MonGetFilterState
InitDbgFileName
MonStopRelate
MonStopFilter
MonReadPolicyHead
MonWritePolicyHead
GetUserConfigRoot
MonReadPolicyItem
MonReadCtrlItem
MonMakePolicyHead
MonWritePolicyItem
MonWriteCtrlItem
MonWriteAuthItem
safebase
GetCommonDirectory
GetDeviceClass
GetSHA1Str
HMAC_SHA1Str
GetDeviceInfoByPath
CheckProcess
RunProcess
DeleteDirectory
ForkProcess
DLChangeWndMessageFilter
WriteSafeHead
IsFileExist
FormBakPath
GetFileSHA1Str
CheckFileOpened
GetFileSizeByName
BackupFileDirs
CreateDirs
DeleteFolder
ParseFileName
WriteDbgLogW
NormalPattern
MakeSafeHead
GetComputerModel
Utf82Uni
Uni2Utf8
WriteSafeFile
WriteDbgLog
CheckOverIcon
ModifyOverIconPos
CreateDumpFile
GetWorkDirectory
GetFileVersion
GetMACAddr
Ansi2Uni
Uni2Ansi
DeleteExtName
GenRandKey
GetLocalMACIPStr
GetIPV6Addr
Is64BitOS
GetWindowsEdition
RSAPublicEncrypt
encode_base64
SafeBase_free
RSAPublicDecrypt
DecodeBase64
DecodeAES
DateStr2Time
GetCurDate
EncodeAES
Adler32
RemoveOnePattern
shieldbase
?SendServerFile@CCurlHttp@@QAEPADPADPBDPAU_DocFileList@@IP6AHPAXNNNN@Z30@Z
?RequestServer@CCurlHttp@@QAEPADPADPBD0@Z
??1CCurlHttp@@QAE@XZ
??0CCurlHttp@@QAE@XZ
??1Sqlmanager@@QAE@XZ
??0Sqlmanager@@QAE@XZ
?SendServerLogFile@CCurlHttp@@QAEHPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAD@Z
GetDeviceUUID
?Init@CNamePipe@@QAEXPA_W@Z
?RegisterFunc@CNamePipe@@QAEXPADP6A_N00PAK@Z@Z
?SendRcvMsg@CNamePipe@@QAEHPA_WPADPAXH1PAK@Z
?emit@socket@sio@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVlist@message@2@ABV?$function@$$A6AXABVlist@message@sio@@@Z@4@@Z
RegOverIcon
?clear_con_listeners@client@sio@@QAEXXZ
?sync_close@client@sio@@QAEXXZ
?on@socket@sio@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$function@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$shared_ptr@Vmessage@sio@@@2@_NAAVlist@message@sio@@@Z@4@@Z
?socket@client@sio@@QAEABV?$shared_ptr@Vsocket@sio@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?connect@client@sio@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@4@@Z
?set_reconnect_listener@client@sio@@QAEXABV?$function@$$A6AXII@Z@std@@@Z
?set_fail_listener@client@sio@@QAEXABV?$function@$$A6AXXZ@std@@@Z
?set_close_listener@client@sio@@QAEXABV?$function@$$A6AXABW4close_reason@client@sio@@@Z@std@@@Z
?set_open_listener@client@sio@@QAEXABV?$function@$$A6AXXZ@std@@@Z
?DownLoadFile@CCurlHttp@@QAEHPADPBDPB_W@Z
wextract_file_dir
ShieldBase_free
?SendServer@CCurlHttp@@QAEPADPADPBDH0@Z
?getinstance@CNamePipe@@SAPAV1@XZ
?SendMsg@CNamePipe@@QAEHPA_WPADPAXH@Z
??1client@sio@@QAE@XZ
??0client@sio@@QAE@XZ
wget_filename
ExtractBasename
?QueryCount@Sqlmanager@@QAEHPAD0@Z
syslog
?SetTermInfo@CCurlHttp@@QAEXPAU_Terminal_Info@@@Z
?ExecSql@Sqlmanager@@QAE_NPADP6AHPAXHPAPAD2@Z1@Z
rpcrt4
RpcStringFreeA
UuidToStringA
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
oleacc
CreateStdAccessibleObject
LresultFromObject
gdiplus
GdipSetPenColor
GdipSetPenWidth
GdipGraphicsClear
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetFontHeightGivenDPI
GdipGetFontSize
GdipGetFontStyle
GdipGetFamily
GdipCreateHICONFromBitmap
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipGetPathWorldBounds
GdipAddPathString
GdipSetClipPath
GdipDrawImageRectI
GdipSetSmoothingMode
GdipDrawRectanglesI
GdipDeletePath
GdipCreatePath
GdipDrawRectangle
GdipSetPenDashStyle
GdipDeletePen
GdipCreatePen1
GdiplusStartup
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDrawImageRectRectI
GdipDrawImageRectRect
GdipFillRectangleI
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateTexture
GdipSetSolidFillColor
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipGetImageHeight
GdipGetImageWidth
GdiplusShutdown
GdipFillRectangle
GdipDrawLineI
GdipAddPathEllipseI
GdipCreateFromHDC
winmm
timeKillEvent
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
timeSetEvent
imm32
ImmIsIME
ImmGetContext
ImmReleaseContext
ImmGetDescriptionW
msimg32
AlphaBlend
comctl32
_TrackMouseEvent
Sections
.text Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 279KB - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ