Static task
static1
Behavioral task
behavioral1
Sample
5e25bcb8de66c8e0446ce351bc1fe783e5db768b14ead715ebaa12c6c36791c6.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5e25bcb8de66c8e0446ce351bc1fe783e5db768b14ead715ebaa12c6c36791c6.exe
Resource
win10v2004-20230703-en
General
-
Target
5e25bcb8de66c8e0446ce351bc1fe783e5db768b14ead715ebaa12c6c36791c6
-
Size
15.3MB
-
MD5
53e8363ca81700a00a2afb159cefe5c5
-
SHA1
aaf84020430085cecc18b3589bd824326c084b3c
-
SHA256
5e25bcb8de66c8e0446ce351bc1fe783e5db768b14ead715ebaa12c6c36791c6
-
SHA512
4ebc57269c234e534594562c7c827d72f87b3255c99a7a6fda4cedfc81fed1cad6f8aacece55e38849a89f2d577d90c963af056a35d3544b9d82bec8d46c0fda
-
SSDEEP
393216:mognvwmk3b+n57MSX01AHgvNa9iRWuyDL6YSnsMLnG:Tgk3b+n5fYAH0Na9iRTS6nnsJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e25bcb8de66c8e0446ce351bc1fe783e5db768b14ead715ebaa12c6c36791c6
Files
-
5e25bcb8de66c8e0446ce351bc1fe783e5db768b14ead715ebaa12c6c36791c6.exe windows x86
6517a274e0063dafecd2e143a0de00cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
tbeauty
TBeauty_CreateTdxTab
tcalc
?GetTypeNum@CMainCalcInterface@@QAEJXZ
tcontrol
??1CMarkup@@QAE@XZ
viewthem
?INFO_GetCjzxNum@@YAHXZ
invest
?SetPrivateInvestDir@@YAXPAD@Z
tmarquee
NewMarquee
tjyaid
GetWtDefInfoFromETradeXML_More
tqqcalc
TQQCalc_Index
tqqanaly
TQQAnaly_RegisterCallBack
mfc100
ord3892
msvcr100
_localtime64_s
kernel32
GetProcAddress
user32
KillTimer
gdi32
GetObjectA
msimg32
AlphaBlend
advapi32
RegSetValueExA
shell32
SHGetFileInfoA
comctl32
_TrackMouseEvent
ole32
CoInitialize
oleaut32
OleLoadPicture
gdiplus
GdipAlloc
wsock32
WSAGetLastError
msvcp100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
winmm
PlaySoundA
imm32
ImmIsIME
tgear
RejustDateCtrlRange
tdxasiocomm
?MakeUserCommModule@@YAPAVVUserComm@@XZ
ribbonbar
?ReLoadUserCfg@@YAXJ@Z
psapi
GetProcessImageFileNameA
ws2_32
getaddrinfo
Sections
.text Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 808KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 942KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.svmp1 Size: - Virtual size: 845KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp2 Size: 4.4MB - Virtual size: 4.4MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp3 Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp4 Size: 5.3MB - Virtual size: 5.3MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp5 Size: 13KB - Virtual size: 13KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp6 Size: 430KB - Virtual size: 430KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE