Static task
static1
Behavioral task
behavioral1
Sample
94f5aa0493604d1bdf885c97ade68e01ede8acff599610ec9424e5245aaea2c2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
94f5aa0493604d1bdf885c97ade68e01ede8acff599610ec9424e5245aaea2c2.exe
Resource
win10v2004-20230915-en
General
-
Target
94f5aa0493604d1bdf885c97ade68e01ede8acff599610ec9424e5245aaea2c2
-
Size
16.0MB
-
MD5
0e855410b53990f54ed6c0f44062a76d
-
SHA1
2ebd208575e82e6b973c1cc5723e7dccbcfae419
-
SHA256
94f5aa0493604d1bdf885c97ade68e01ede8acff599610ec9424e5245aaea2c2
-
SHA512
7c92d62e3908325c87048d378a301c33dd313fd7af6f5a202d53b40c469f3fbd2df0d0f19fa1c118d07aebb355bf6ddf70e6bac9955a1f9ecf088db31b802571
-
SSDEEP
393216:Lor1Fdwy1e0AbUx4jKMpBpY7oUWGKAAVvQEq+Q3isvpi+S:chFR1e0ATKepY7wGKAi5bQ3isxin
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94f5aa0493604d1bdf885c97ade68e01ede8acff599610ec9424e5245aaea2c2
Files
-
94f5aa0493604d1bdf885c97ade68e01ede8acff599610ec9424e5245aaea2c2.exe windows x86
6517a274e0063dafecd2e143a0de00cd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
tbeauty
TBeauty_CreateTdxTab
tcalc
?GetTypeNum@CMainCalcInterface@@QAEJXZ
tcontrol
??1CMarkup@@QAE@XZ
viewthem
?INFO_GetCjzxNum@@YAHXZ
invest
?SetPrivateInvestDir@@YAXPAD@Z
tmarquee
NewMarquee
tjyaid
GetWtDefInfoFromETradeXML_More
tqqcalc
TQQCalc_Index
tqqanaly
TQQAnaly_RegisterCallBack
mfc100
ord3892
msvcr100
_localtime64_s
kernel32
GetProcAddress
user32
KillTimer
gdi32
GetObjectA
msimg32
AlphaBlend
advapi32
RegSetValueExA
shell32
SHGetFileInfoA
comctl32
_TrackMouseEvent
ole32
CoInitialize
oleaut32
OleLoadPicture
gdiplus
GdipAlloc
wsock32
WSAGetLastError
msvcp100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
winmm
PlaySoundA
imm32
ImmIsIME
tgear
RejustDateCtrlRange
tdxasiocomm
?MakeUserCommModule@@YAPAVVUserComm@@XZ
ribbonbar
?ReLoadUserCfg@@YAXJ@Z
psapi
GetProcessImageFileNameA
ws2_32
getaddrinfo
Sections
.text Size: - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 808KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 942KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.svmp1 Size: - Virtual size: 801KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp2 Size: 4.3MB - Virtual size: 4.3MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp3 Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp4 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp5 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.svmp6 Size: 391KB - Virtual size: 390KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE