Static task
static1
Behavioral task
behavioral1
Sample
e2b8aac56c475dcc2ece764c485b2b3174cf32ba4143f2276f7521afcd19e91c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e2b8aac56c475dcc2ece764c485b2b3174cf32ba4143f2276f7521afcd19e91c.exe
Resource
win10v2004-20230703-en
General
-
Target
e2b8aac56c475dcc2ece764c485b2b3174cf32ba4143f2276f7521afcd19e91c
-
Size
4.7MB
-
MD5
7eeffa63aac9baf900bed4c0e8b2f4a2
-
SHA1
7bf62c2a8b530290130c022f728d684317dad259
-
SHA256
e2b8aac56c475dcc2ece764c485b2b3174cf32ba4143f2276f7521afcd19e91c
-
SHA512
a40c34ced791aac293092061aa7270b3c2bb2d17a6adb92ae7795d6e80d2a1e1875ad2fdf09ca7d724d467298dadea0064ef0e8a76d83bd1169f81e00949175c
-
SSDEEP
98304:VwN1SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSHd:Vahd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e2b8aac56c475dcc2ece764c485b2b3174cf32ba4143f2276f7521afcd19e91c
Files
-
e2b8aac56c475dcc2ece764c485b2b3174cf32ba4143f2276f7521afcd19e91c.exe windows x86
a68acaaca048f41751f15b6ae56e5a9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
csflogger
CSFLogger_getLogger
CSFLog_isDebugEnabled
?GetInstance@LogController@csflogger@CSF@@SA?AV?$shared_ptr@VLogController@csflogger@CSF@@@std@@XZ
CSFLogger_initialize
CSFLog
CSFLog_isTraceEnabled
tsdetectionlib
GetEnvironment
vxccommunication
ReleaseStream
CreateStream
wtsapi32
WTSRegisterSessionNotification
msvcp140
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_XGetLastError@std@@YAXXZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Cnd_init
?__ExceptionPtrAssign@@YAXPAXPBX@Z
_Cnd_destroy
?__ExceptionPtrToBool@@YA_NPBX@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
_Thrd_start
_Thrd_join
_Thrd_id
_Mtx_init
_Cnd_wait
_Mtx_destroy
_Mtx_lock
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?_Xbad_alloc@std@@YAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
?_Xout_of_range@std@@YAXPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
user32
GetWindowThreadProcessId
GetClassNameA
EnumWindows
SetWindowLongW
GetWindowLongW
GetCursorPos
MessageBoxW
EndPaint
BeginPaint
SetForegroundWindow
TrackPopupMenu
InsertMenuW
CheckMenuItem
DestroyMenu
LoadIconW
GetMenuState
LoadAcceleratorsW
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
PostQuitMessage
DefWindowProcW
AttachThreadInput
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterWindowMessageW
CreatePopupMenu
SystemParametersInfoW
LoadStringW
LoadCursorW
ole32
CoUninitialize
CoInitializeEx
CoRevokeClassObject
CoResumeClassObjects
CoAddRefServerProcess
CoReleaseServerProcess
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CoRegisterClassObject
oleaut32
DispInvoke
UnRegisterTypeLi
LoadRegTypeLi
LoadTypeLibEx
SysStringLen
DispGetIDsOfNames
kernel32
InitializeCriticalSectionAndSpinCount
SetEvent
Process32NextW
OutputDebugStringW
Process32FirstW
CreateToolhelp32Snapshot
GetUserDefaultLangID
VerifyVersionInfoW
TerminateProcess
GetCurrentProcessId
VerSetConditionMask
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
CreateThread
CreateMutexA
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
RaiseException
GetModuleHandleA
GetModuleFileNameA
CreateEventW
WaitForSingleObjectEx
OpenProcess
Sleep
WaitForSingleObject
CloseHandle
CreateMutexW
ReleaseMutex
GetLastError
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ResetEvent
advapi32
RegEnumKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
shell32
Shell_NotifyIconW
vcruntime140
strchr
__std_exception_destroy
__std_exception_copy
memset
memchr
_CxxThrowException
wcsstr
_purecall
strstr
__std_terminate
memmove
memcpy
__CxxFrameHandler3
_except_handler4_common
__RTDynamicCast
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_invalid_parameter_noinfo
_errno
_exit
exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_initterm
_c_exit
_get_wide_winmain_command_line
_controlfp_s
_initterm_e
_initialize_wide_environment
_configure_wide_argv
terminate
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
api-ms-win-crt-environment-l1-1-0
_dupenv_s
api-ms-win-crt-convert-l1-1-0
strtoul
strtoll
strtoull
strtol
mbstowcs
wcstombs
strtod
api-ms-win-crt-string-l1-1-0
strcpy_s
strncat_s
strncpy_s
strncpy
wcscpy_s
strcat_s
_wcsicmp
wmemcpy_s
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
fflush
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__p__commode
api-ms-win-crt-math-l1-1-0
__setusermatherr
_except1
_dtest
_fdtest
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 661KB - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.9MB - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ