Static task
static1
Behavioral task
behavioral1
Sample
220d569855329821d70379babb719db2444a9a23ab6884087049f8ecd2181ed6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
220d569855329821d70379babb719db2444a9a23ab6884087049f8ecd2181ed6.exe
Resource
win10v2004-20230831-en
General
-
Target
220d569855329821d70379babb719db2444a9a23ab6884087049f8ecd2181ed6
-
Size
1.4MB
-
MD5
57450a369a7e8cfeb73d5319fac202c8
-
SHA1
3b6d0030b4fcbb7de9195bbabe707a6a8d8d3d43
-
SHA256
220d569855329821d70379babb719db2444a9a23ab6884087049f8ecd2181ed6
-
SHA512
bd148cffc1c6b97deb179030665aaa2ba5cd475775260c65ba7532a2ed94ae10776dec904745ed34ec8d71374e4e02d2f51782682e6637fb834f6427f1e9eaa7
-
SSDEEP
24576:UWtqcrpYpFB5fevUbtjCrEzP+TIXuP5QnEvggNwG2OPum1XglfBWHZ:UWYcJEjqIXuPmEhwtOPum1XglfBW5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 220d569855329821d70379babb719db2444a9a23ab6884087049f8ecd2181ed6
Files
-
220d569855329821d70379babb719db2444a9a23ab6884087049f8ecd2181ed6.exe windows x86
d5d6d7eaf2b1515c6fbae127de3ae223
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
kernel32
ReleaseMutex
CreateMutexW
CreateNamedPipeW
RegisterWaitForSingleObject
UnregisterWaitEx
UnregisterWait
lstrcpynW
OutputDebugStringW
TerminateThread
OpenThread
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
DisconnectNamedPipe
GetModuleFileNameW
QueryDosDeviceW
CreateFileMappingW
FreeLibrary
GetProcAddress
FileTimeToLocalFileTime
LoadLibraryW
VirtualQuery
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedIncrement
GetProcessTimes
InitializeSListHead
GetCurrentProcessId
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
ReadProcessMemory
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
DuplicateHandle
TerminateProcess
SetPriorityClass
SetLastError
GlobalMemoryStatusEx
GetNativeSystemInfo
LoadLibraryA
InterlockedDecrement
GetLocalTime
DeviceIoControl
InterlockedExchangeAdd
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LoadLibraryExW
GetTempFileNameW
GetVersionExA
GetComputerNameA
SetEnvironmentVariableA
GetEnvironmentVariableA
CreateHardLinkW
CloseHandle
GetTimeZoneInformation
InterlockedExchange
ResumeThread
GetLogicalDriveStringsW
CopyFileW
MoveFileExW
SetCurrentDirectoryW
GetWindowsDirectoryW
GetCurrentDirectoryW
DeleteFileW
SetFileAttributesW
GetSystemDirectoryW
GetFileAttributesW
GetTempPathW
RemoveDirectoryW
lstrlenW
GetFullPathNameW
CreateDirectoryW
GetFileTime
GetFileSize
SetEndOfFile
SetFilePointer
SetFileTime
WriteFile
ReadFile
FileTimeToDosDateTime
DosDateTimeToFileTime
GetSystemTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FindClose
FindNextFileW
GetDiskFreeSpaceW
GetVolumeInformationW
GetProcessHeap
HeapAlloc
GlobalFree
GlobalAlloc
GetComputerNameExW
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetACP
ResetEvent
SetEvent
Sleep
CreateEventW
OpenEventW
lstrcmpiW
FindResourceW
LoadResource
GetSystemInfo
LockResource
GetVersionExW
OpenProcess
GetCurrentProcess
GetExitCodeProcess
GetModuleHandleW
CreateProcessW
LocalFree
GetFileType
WaitForSingleObject
ExpandEnvironmentStringsW
SearchPathW
GetFileAttributesExW
CreateFileW
GetShortPathNameW
GetLongPathNameW
FindFirstFileW
GetDriveTypeW
OpenMutexW
GetEnvironmentVariableW
FileTimeToSystemTime
GetLastError
GetCurrentThreadId
GetTickCount
WaitForMultipleObjects
GetOverlappedResult
ConnectNamedPipe
GetStdHandle
GetDiskFreeSpaceExW
MoveFileW
user32
GetDesktopWindow
GetClassNameW
SetFocus
GetWindowRect
GetWindowThreadProcessId
SetWindowPos
GetUserObjectInformationW
GetProcessWindowStation
GetDC
ReleaseDC
EnumDisplayMonitors
GetMonitorInfoW
GetParent
GetFocus
MessageBoxW
GetForegroundWindow
AttachThreadInput
WindowFromPoint
GetShellWindow
GetSystemMetrics
advapi32
LookupPrivilegeNameW
LookupPrivilegeValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
LookupAccountSidW
AdjustTokenPrivileges
EqualSid
AllocateAndInitializeSid
FreeSid
GetTokenInformation
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
ole32
PropVariantClear
CoInitializeEx
CoInitializeSecurity
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
msvcp140
?_Xbad_alloc@std@@YAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?_Getdays@_Locinfo@std@@QBEPBDXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?fail@ios_base@std@@QBE_NXZ
??7ios_base@std@@QBE_NXZ
??1_Lockit@std@@QAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??0_Lockit@std@@QAE@H@Z
?_Xruntime_error@std@@YAXPBD@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?global@locale@std@@SA?AV12@ABV12@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_C_str@?$_Yarn@D@std@@QBEPBDXZ
??Bios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??Bid@locale@std@@QAEIXZ
?_Getname@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@HPBD@Z
?classic@locale@std@@SAABV12@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
_Mbrtowc
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
iphlpapi
GetAdaptersInfo
vcruntime140
__std_type_info_destroy_list
strchr
__CxxFrameHandler3
_purecall
wcsrchr
__std_terminate
wcschr
wcsstr
strstr
__RTtypeid
__std_exception_destroy
__std_exception_copy
__std_type_info_compare
__std_type_info_name
memcpy
_CxxThrowException
memmove
memset
memchr
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
abort
exit
_initialize_narrow_environment
_initialize_onexit_table
raise
_controlfp_s
_initterm_e
_register_onexit_function
_execute_onexit_table
_initterm
_crt_atexit
_crt_at_quick_exit
_register_thread_local_exe_atexit_callback
_c_exit
_invalid_parameter_noinfo_noreturn
_cexit
_beginthreadex
_seh_filter_exe
_configure_wide_argv
_set_app_type
_get_wide_winmain_command_line
_initialize_wide_environment
strerror_s
terminate
_seh_filter_dll
_errno
_exit
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
realloc
free
calloc
malloc
api-ms-win-crt-convert-l1-1-0
strtol
atoi
atoll
strtod
_i64tow_s
_wtoi
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__acrt_iob_func
__stdio_common_vswscanf
__stdio_common_vsprintf
__stdio_common_vswprintf
__stdio_common_vfprintf
fgetc
ungetc
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
setvbuf
fgetpos
__p__commode
fwrite
fclose
fflush
__stdio_common_vswprintf_s
__stdio_common_vsprintf_s
fputc
__stdio_common_vsscanf
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
_mktime64
api-ms-win-crt-string-l1-1-0
isspace
isdigit
_stricmp
_wcsnicmp
wcsncpy
wcscpy_s
tolower
wcsncmp
towlower
toupper
_memicmp
towupper
strpbrk
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-filesystem-l1-1-0
_splitpath_s
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
ceil
_isnan
_finite
floor
_except1
_dtest
modf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
shlwapi
PathRemoveFileSpecW
SHStrDupW
rpcrt4
NdrServerCall2
NdrAsyncServerCall
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerListen
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
psapi
GetProcessMemoryInfo
GetProcessImageFileNameW
gdi32
GetDeviceCaps
shell32
ShellExecuteW
ord155
ord190
SHChangeNotify
SHGetSpecialFolderPathW
oleaut32
SetErrorInfo
CreateErrorInfo
VariantChangeType
VariantInit
GetErrorInfo
SysFreeString
VariantClear
SysAllocString
Sections
.text Size: 898KB - Virtual size: 897KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384KB - Virtual size: 383KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.msvcjmc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ