Static task
static1
Behavioral task
behavioral1
Sample
311499f0edf6c0e924ae79312e649da87c4b2abb1197e4ac1a79206751540756.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
311499f0edf6c0e924ae79312e649da87c4b2abb1197e4ac1a79206751540756.exe
Resource
win10v2004-20230703-en
General
-
Target
311499f0edf6c0e924ae79312e649da87c4b2abb1197e4ac1a79206751540756
-
Size
164KB
-
MD5
cf4a59f64c16030e6febf3cc2257afdb
-
SHA1
95070da9a3b3318c4ca8c297f4d2984a26a52e91
-
SHA256
311499f0edf6c0e924ae79312e649da87c4b2abb1197e4ac1a79206751540756
-
SHA512
d702423f7340e1b9077a0ae26323123dea91e84f15da4c3708779233e387c94744d7a860e39b4be55972db5a6082ce32d589b74077a1eb9babc57e96ae735c7d
-
SSDEEP
3072:HPcSmmIOqooRJuW4/2t1P3lOgvdwW5WXyufapGCH:gmIOqooRJuV/e1P3zVwWtu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 311499f0edf6c0e924ae79312e649da87c4b2abb1197e4ac1a79206751540756
Files
-
311499f0edf6c0e924ae79312e649da87c4b2abb1197e4ac1a79206751540756.exe windows x86
073339f917344721fa7f9f6976d3e62b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetPrivateProfileStringW
WideCharToMultiByte
GetCommandLineW
FindNextFileA
FindFirstFileA
MultiByteToWideChar
HeapFree
GetProcessHeap
TerminateProcess
WaitForSingleObject
CreateProcessW
GetCurrentProcessId
SetCurrentDirectoryW
DuplicateHandle
SearchPathW
GetCurrentProcess
CreateEventW
GetCurrentThreadId
SetUnhandledExceptionFilter
VirtualAllocEx
SetErrorMode
GetModuleHandleW
HeapAlloc
GetSystemTimeAsFileTime
GetTickCount
GetModuleFileNameA
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
CloseHandle
GetPrivateProfileIntW
QueryPerformanceCounter
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
Sleep
InterlockedExchange
user32
MessageBoxW
advapi32
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
shell32
CommandLineToArgvW
SHGetSpecialFolderPathW
ole32
CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoInitialize
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?_Xran@_String_base@std@@SAXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
msvcr90
_encode_pointer
??3@YAXPAX@Z
wcsrchr
_snwprintf_s
memset
_stricmp
wcstombs_s
strcat_s
strcpy_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_wmkdir
_waccess
_snwprintf
wcsncpy
memcpy
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_unlink
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
libglog
??0LogMessage@google@@QAE@PBDHH@Z
??0LogMessage@google@@QAE@PBDH@Z
?SetLogDestination@google@@YAXHPBD@Z
?stream@LogMessage@google@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?FLAGS_logbuflevel@fLI@@3HA
?FLAGS_alsologtostderr@fLB@@3_NA
?InitGoogleLogging@google@@YAXPBD@Z
??0LogMessageFatal@google@@QAE@PBDH@Z
??1LogMessage@google@@QAE@XZ
??1LogMessageFatal@google@@QAE@XZ
?LogSeverityNames@google@@3QBQBDB
?ShutdownGoogleLogging@google@@YAXXZ
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ