Static task
static1
Behavioral task
behavioral1
Sample
31fc4b5aacc9d865c19c7dc8fbd0a5558560d41115494ea7157a5eb72b7857fa.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
31fc4b5aacc9d865c19c7dc8fbd0a5558560d41115494ea7157a5eb72b7857fa.exe
Resource
win10v2004-20230915-en
General
-
Target
31fc4b5aacc9d865c19c7dc8fbd0a5558560d41115494ea7157a5eb72b7857fa
-
Size
1.7MB
-
MD5
99b5cac017e5cbaef36576ec00ac1e9c
-
SHA1
0dd47919b69ec1d78ea0e0ace7d3589b1073f7fe
-
SHA256
31fc4b5aacc9d865c19c7dc8fbd0a5558560d41115494ea7157a5eb72b7857fa
-
SHA512
343b41c03f64ddc6fa5cfb5464853926331cda8d25c4a111bb472a85372d9c1824db3a00536c079b751f480fadb588a39893f260c5954b41b086651f1034d577
-
SSDEEP
24576:ks75k6tPb/EjJb+TA2GkFSJFLZ3XJGAHos7pJMYdBKYDhQ+8zZrFVh:B9ntT/QbYXFSJhlMJUqYdB/tClzh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 31fc4b5aacc9d865c19c7dc8fbd0a5558560d41115494ea7157a5eb72b7857fa
Files
-
31fc4b5aacc9d865c19c7dc8fbd0a5558560d41115494ea7157a5eb72b7857fa.exe windows x64
8339925f8a12cfb307ffdea23963ad8d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
flac
FLAC__metadata_object_vorbiscomment_entry_from_name_value_pair
FLAC__stream_encoder_new
FLAC__stream_encoder_delete
FLAC__stream_encoder_set_verify
FLAC__stream_encoder_set_channels
FLAC__stream_encoder_set_bits_per_sample
FLAC__metadata_object_vorbiscomment_append_comment
FLAC__stream_encoder_set_compression_level
FLAC__stream_encoder_set_metadata
FLAC__stream_encoder_init_stream
FLAC__stream_encoder_finish
FLAC__stream_encoder_process_interleaved
FLAC__StreamEncoderInitStatusString
FLAC__metadata_object_delete
FLAC__stream_encoder_set_sample_rate
FLAC__metadata_object_new
opus
opus_encode
opus_encoder_create
opus_encoder_destroy
opus_encoder_ctl
opus_strerror
soxr
soxr_process
soxr_delay
soxr_quality_spec
soxr_io_spec
soxr_create
soxr_delete
kernel32
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
VerSetConditionMask
CloseHandle
GetLastError
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
WaitForMultipleObjects
QueueUserAPC
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleA
GetProcAddress
LocalFree
FormatMessageA
FormatMessageW
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
CreateWaitableTimerW
Sleep
GetSystemTime
SystemTimeToFileTime
GetCurrentThreadId
GetModuleHandleW
GetSystemTimeAsFileTime
QueryPerformanceCounter
CancelIoEx
WaitForSingleObjectEx
ResetEvent
InitializeSListHead
advapi32
ReportEventW
RegisterEventSourceW
msvcp140
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
_Xtime_get_ticks
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
_Query_perf_counter
_Query_perf_frequency
?_Random_device@std@@YAIXZ
_Thrd_join
_Thrd_hardware_concurrency
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??1_Lockit@std@@QEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Cnd_init_in_situ
_Cnd_destroy_in_situ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
ws2_32
WSAIoctl
ntohs
ioctlsocket
getsockname
connect
accept
__WSAFDIsSet
WSARecv
shutdown
WSAStringToAddressW
WSAAddressToStringW
WSASocketW
WSASend
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
setsockopt
ntohl
listen
htons
htonl
getsockopt
getpeername
bind
closesocket
select
mswsock
GetAcceptExSockaddrs
TransmitFile
AcceptEx
vcruntime140
__C_specific_handler
__std_type_info_compare
memset
memcmp
memchr
__RTDynamicCast
__current_exception_context
_purecall
memmove
memcpy
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__current_exception
__std_terminate
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
_errno
strerror
_invalid_parameter_noinfo_noreturn
exit
terminate
_c_exit
__p___argv
__p___argc
_exit
_register_onexit_function
_initterm
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_set_app_type
_initterm_e
_seh_filter_exe
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_cexit
_crt_atexit
api-ms-win-crt-math-l1-1-0
_dsign
__setusermatherr
ceil
_dclass
api-ms-win-crt-heap-l1-1-0
free
_callnewh
realloc
malloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoll
strtoull
strtod
strtoul
strtol
api-ms-win-crt-stdio-l1-1-0
fsetpos
_get_osfhandle
_fseeki64
fwrite
__stdio_common_vsscanf
_get_stream_buffer_pointers
setvbuf
_set_fmode
ungetc
__stdio_common_vsprintf
_getcwd
fclose
fputc
fgetpos
__p__commode
_read
_open
fread
fgetc
fflush
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_lock_file
_unlock_file
api-ms-win-crt-string-l1-1-0
isspace
tolower
strncpy
strcmp
api-ms-win-crt-time-l1-1-0
strftime
_localtime64_s
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 89KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ