Static task
static1
Behavioral task
behavioral1
Sample
0422c3c334becd53a32028abbe075e6f7d21013b8bb16c553ec23cf439505207.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0422c3c334becd53a32028abbe075e6f7d21013b8bb16c553ec23cf439505207.exe
Resource
win10v2004-20230703-en
General
-
Target
0422c3c334becd53a32028abbe075e6f7d21013b8bb16c553ec23cf439505207
-
Size
251KB
-
MD5
85141e17aa8d834aed8aaae6378e31e2
-
SHA1
984887171cbcd458254f24aae98b19606fca4ddf
-
SHA256
0422c3c334becd53a32028abbe075e6f7d21013b8bb16c553ec23cf439505207
-
SHA512
cba78cd824ed4ff8fd29a38d9f084ef4c0a684173d9a4147cc820d4a0fe20cea895e4e4ae9de10d1354883798815bf08337cb3042267fa9b917a814eb6bffb65
-
SSDEEP
6144:bWfnGOviOP05hbxWPOs+7C0LGyKVV/zZkAYTz5Z:bWPGOz05hgPOswMzm5n
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0422c3c334becd53a32028abbe075e6f7d21013b8bb16c553ec23cf439505207
Files
-
0422c3c334becd53a32028abbe075e6f7d21013b8bb16c553ec23cf439505207.exe windows x86
a5782d54e834f485cd7ab0139b214890
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MapViewOfFile
CreateFileMappingW
CloseHandle
UnmapViewOfFile
WaitForSingleObject
GetLastError
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
InitializeCriticalSection
DeleteCriticalSection
Sleep
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetLocalTime
CreateThread
MoveFileExW
GetCurrentThreadId
TerminateThread
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultUILanguage
GetTickCount
GetCurrentProcessId
CreateEventW
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
GetProcAddress
user32
GetMessageW
LoadAcceleratorsW
TranslateAcceleratorW
GetPropW
PostQuitMessage
GetWindowRect
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
ShowWindow
DialogBoxParamW
DestroyWindow
DefWindowProcW
BeginPaint
EndPaint
EndDialog
LoadStringW
wsprintfW
SetWindowLongW
RegisterClassW
GetWindowLongW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ws2_32
socket
closesocket
shutdown
bind
WSAStartup
setsockopt
inet_addr
htons
sendto
recvfrom
WSACleanup
msvcp120
?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_init
_Mtx_lock
_Mtx_unlock
_Cnd_init
_Cnd_broadcast
_Cnd_destroy
_Mtx_destroy
?_Future_error_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Open_dir@sys@tr2@std@@YAPAXAAY0BAE@_WPB_WAAHAAW4file_type@123@@Z
?_Close_dir@sys@tr2@std@@YAXPAX@Z
?_Read_dir@sys@tr2@std@@YAPA_WAAY0BAE@_WPAXAAW4file_type@123@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_BADOFF@std@@3_JB
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_Xtime_get_ticks
_Cnd_timedwait
_Mtx_current_owns
?_Throw_Cpp_error@std@@YAXH@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0_Pad@std@@QAE@XZ
?_Release@_Pad@std@@QAEXXZ
??1_Pad@std@@QAE@XZ
??Bios_base@std@@QBE_NXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
?_Make_dir@sys@tr2@std@@YAHPB_W@Z
avcodec-55
av_free_packet
av_init_packet
av_packet_from_data
avcodec_alloc_frame
avcodec_decode_audio4
avcodec_encode_audio2
avcodec_encode_video2
avcodec_fill_audio_frame
avcodec_find_decoder
avcodec_find_encoder
avcodec_open2
avpicture_fill
avpicture_get_size
avformat-55
av_interleaved_write_frame
av_register_all
av_write_trailer
avformat_alloc_context
avformat_alloc_output_context2
avformat_close_input
avformat_free_context
avformat_new_stream
avformat_write_header
avio_close
avio_open
avutil-52
av_audio_fifo_alloc
av_audio_fifo_free
av_audio_fifo_read
av_audio_fifo_size
av_audio_fifo_space
av_audio_fifo_write
av_compare_ts
av_fifo_alloc
av_fifo_free
av_fifo_generic_read
av_fifo_generic_write
av_fifo_size
av_fifo_space
av_frame_alloc
av_frame_free
av_frame_get_buffer
av_get_channel_layout_nb_channels
av_rescale_q_rnd
av_samples_set_silence
avdevice-55
avdevice_register_all
swscale-2
sws_getContext
sws_scale
msvcr120
swprintf_s
memmove
_purecall
??2@YAPAXI@Z
clock
??_V@YAXPAX@Z
free
malloc
??3@YAXPAX@Z
wcscpy_s
wcstol
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
realloc
_CxxThrowException
__CxxFrameHandler3
_setjmp3
memcpy
memset
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
vsprintf_s
?terminate@@YAXXZ
_vswprintf_c_l
tolower
_beginthreadex
longjmp
sprintf_s
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
_except1
memcpy_s
fgetc
ungetc
fwrite
fputc
_unlock_file
_lock_file
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
srand
_time64
rand
??8type_info@@QBE_NABV0@@Z
vswprintf_s
_wtoi
shell32
SHGetFolderPathW
Sections
.text Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ