Static task
static1
Behavioral task
behavioral1
Sample
1cc62a157907c23d6222f952b41ffb407540d8fc2e7c7e8d53311a13784ed449.exe
Resource
win7-20230824-en
Behavioral task
behavioral2
Sample
1cc62a157907c23d6222f952b41ffb407540d8fc2e7c7e8d53311a13784ed449.exe
Resource
win10v2004-20230703-en
General
-
Target
1cc62a157907c23d6222f952b41ffb407540d8fc2e7c7e8d53311a13784ed449
-
Size
51KB
-
MD5
be005e06bcfd8c9df6acab025a6c459b
-
SHA1
138b186df3248b4da06c7f9d72ac0d44a70630e9
-
SHA256
1cc62a157907c23d6222f952b41ffb407540d8fc2e7c7e8d53311a13784ed449
-
SHA512
6c7d9866acd43bc5936451a60136e86f77a7d149df81aa6e1a912335d8939086b78f515aa59fa660fee133a061df640185302ffe4e4f5e1b464002ebbb185644
-
SSDEEP
768:qfprQNIIO2DdlENl0wUcMja/xWkE2zchjSmOU3YdBMSUaq1LyJIC:G5QNVO2DXEIg4a9LzchOPfa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1cc62a157907c23d6222f952b41ffb407540d8fc2e7c7e8d53311a13784ed449
Files
-
1cc62a157907c23d6222f952b41ffb407540d8fc2e7c7e8d53311a13784ed449.exe windows x86
12d42c0c787fa20cdf37573de9a4274d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dbghelp
SymInitialize
SymGetOptions
SymSetOptions
kernel32
CreateProcessW
HeapAlloc
GetCurrentProcess
EnumTimeFormatsA
GetConsoleWindow
HeapCreate
GetFileAttributesW
GetModuleFileNameW
ExitProcess
Process32NextW
CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
Sleep
InterlockedExchange
DecodePointer
Process32FirstW
EncodePointer
InterlockedCompareExchange
HeapSetInformation
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
user32
wsprintfW
ShowWindow
advapi32
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
msvcr100
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
??2@YAPAXI@Z
wcscpy_s
getenv
wcscat_s
??3@YAXPAX@Z
wcsstr
isalnum
memchr
_wgetenv
malloc
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_stricmp
__CxxFrameHandler3
memset
memcpy
_CxxThrowException
msvcp100
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
_Stolx
?_Xinvalid_argument@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
ws2_32
gethostbyname
closesocket
socket
htons
recv
WSACleanup
connect
WSAStartup
send
Sections
.text Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ