Static task
static1
Behavioral task
behavioral1
Sample
098367c1445b458876614b927ec8e88a8031ee0f65df47d9b74e26bf426b15fa.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
098367c1445b458876614b927ec8e88a8031ee0f65df47d9b74e26bf426b15fa.exe
Resource
win10v2004-20230831-en
General
-
Target
098367c1445b458876614b927ec8e88a8031ee0f65df47d9b74e26bf426b15fa
-
Size
98KB
-
MD5
7ce444167e076ecb5a1067bbbd86d02c
-
SHA1
ec6764fb4709a7d00d1a2a40a7f90b89c3026270
-
SHA256
098367c1445b458876614b927ec8e88a8031ee0f65df47d9b74e26bf426b15fa
-
SHA512
46545f1d8db77a5bbdefe596c5418bc3fbb5bfa8d43930dd48b0ac95631c3d379c551f21e14fd9337d78abc79263e42587a64d7ab93aec9334fba44b50362b8a
-
SSDEEP
1536:rBlgPnyH6xOXy0PLnB/v0aSSmOCVtdWxrW:+yHwOXy+B/OSmOCVj4W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 098367c1445b458876614b927ec8e88a8031ee0f65df47d9b74e26bf426b15fa
Files
-
098367c1445b458876614b927ec8e88a8031ee0f65df47d9b74e26bf426b15fa.exe windows x64
4462f2dc59e35b32ca45d986bdaeb798
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mfc90
ord2480
ord2457
ord2473
ord2478
ord2461
ord2463
ord2465
ord2459
ord2475
ord2455
ord947
ord943
ord945
ord941
ord936
ord5353
ord5355
ord6086
ord1636
ord4384
ord4833
ord3488
ord5334
ord4285
ord6406
ord5191
ord1949
ord1954
ord5272
ord4346
ord1434
ord4039
ord4591
ord1659
ord1662
ord6041
ord3133
ord1080
ord1938
ord1103
ord8756
ord6533
ord11869
ord8517
ord9354
ord3265
ord362
ord1585
ord1713
ord1714
ord4689
ord5003
ord4846
ord4313
ord5323
ord4364
ord1433
ord6038
ord3131
ord5302
ord4861
ord3732
ord512
ord722
ord2468
ord1840
ord5993
ord3970
ord2139
ord4340
ord310
ord589
ord8878
ord6744
ord6938
ord2450
ord2452
ord2470
ord2233
ord2932
ord2226
ord1556
ord6410
ord3893
ord6408
ord8058
ord9571
ord7372
ord12223
ord11771
ord12742
ord9910
ord10063
ord9578
ord12800
ord12010
ord6806
ord2067
ord6366
ord3430
ord5083
ord617
ord5333
ord1237
ord6012
ord3011
ord1393
ord2602
ord2797
ord2904
ord5295
ord2010
ord1699
ord1698
ord1635
ord5320
ord1516
ord798
ord316
ord5350
ord4041
ord5344
ord3002
ord1966
ord1071
ord3923
ord5499
ord6348
ord5220
ord1023
ord3897
ord5701
ord2065
ord2110
ord4429
ord6407
ord3892
ord6409
ord4648
ord3921
ord5684
ord4677
ord5346
ord4112
ord3774
ord4136
ord4363
ord4586
ord4042
ord2709
ord3800
ord3810
ord3809
ord2598
ord2711
ord266
ord776
ord265
ord1149
ord2605
ord2907
ord2780
ord4410
ord778
msvcr90
_CxxThrowException
memset
_setmbcp
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
_stricmp
strrchr
free
malloc
strstr
fopen
fwrite
_localtime64
fclose
_time64
sprintf
vsprintf
fprintf
memmove_s
?what@exception@std@@UEBAPEBDXZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
??0exception@std@@QEAA@AEBV01@@Z
_invalid_parameter_noinfo
_strlwr
_strupr
vsprintf_s
realloc
memcpy
kernel32
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileSectionA
DeleteCriticalSection
WritePrivateProfileStringA
FreeLibrary
WritePrivateProfileSectionA
TerminateProcess
FindFirstFileA
GetProcAddress
FindClose
LoadLibraryA
LocalFree
GetCurrentThreadId
Sleep
GetPrivateProfileIntA
GetTickCount
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
lstrlenA
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoA
lstrcpyA
GetTempPathA
GetModuleFileNameA
user32
GetSystemMetrics
SendMessageA
EnableWindow
GetClientRect
wsprintfA
IsIconic
LoadIconA
DrawIcon
advapi32
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
oleaut32
VariantClear
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ