Static task
static1
Behavioral task
behavioral1
Sample
92cf397b96b415120689dbbb49f5fecdd03a65689c2aa1838dc6292aa28eb464.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
92cf397b96b415120689dbbb49f5fecdd03a65689c2aa1838dc6292aa28eb464.exe
Resource
win10v2004-20230915-en
General
-
Target
92cf397b96b415120689dbbb49f5fecdd03a65689c2aa1838dc6292aa28eb464
-
Size
2.0MB
-
MD5
0e06fa09ef37b681165cd21016f1204c
-
SHA1
7306d2e4724a192ae332bc478da8e2477a9c7614
-
SHA256
92cf397b96b415120689dbbb49f5fecdd03a65689c2aa1838dc6292aa28eb464
-
SHA512
6171ce859e12e1276fe740deaaf4384f96208b2353cb2c5d86566ada6a9b04841606bdb01377d78c4f89e907aa5b53d97580dcc09077f30961c766879672e6ec
-
SSDEEP
49152:AwXt+PoE4xieEoqnTt0TJH+w8Csm32mUH/ac6:AUE/q41Hp6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 92cf397b96b415120689dbbb49f5fecdd03a65689c2aa1838dc6292aa28eb464
Files
-
92cf397b96b415120689dbbb49f5fecdd03a65689c2aa1838dc6292aa28eb464.exe windows x64
658ee05212e3f0bb2b0d6afd0d46baa2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
VirtualFree
GetCurrentProcess
GetStdHandle
VirtualAlloc
VirtualUnlock
CreateMutexA
WaitForSingleObject
GetModuleHandleA
Sleep
GetTempPathA
CopyFileA
GetLastError
K32GetProcessMemoryInfo
FillConsoleOutputCharacterW
LockResource
DeleteFileA
CloseHandle
CreateThread
LoadResource
FindResourceW
FillConsoleOutputAttribute
VirtualLock
GetCurrentProcessId
GlobalMemoryStatusEx
CreateProcessA
SetProcessWorkingSetSize
SetConsoleCursorPosition
SetConsoleTitleW
GetSystemTimeAsFileTime
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
GetProcessWorkingSetSize
SizeofResource
GetNativeSystemInfo
GetModuleFileNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
user32
MessageBoxW
ShowWindow
GetWindowTextA
GetForegroundWindow
advapi32
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
shell32
ShellExecuteA
msvcp140
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xout_of_range@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
winhttp
WinHttpOpen
WinHttpReceiveResponse
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
pdh
PdhAddCounterW
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__std_exception_destroy
__std_exception_copy
__C_specific_handler
_CxxThrowException
__current_exception
__current_exception_context
memset
memcpy
api-ms-win-crt-stdio-l1-1-0
fgetc
_get_stream_buffer_pointers
_fseeki64
__stdio_common_vfprintf_s
fread
fsetpos
fputc
__acrt_iob_func
fflush
__p__commode
ungetc
fclose
fwrite
__stdio_common_vsprintf_s
setvbuf
fgetpos
_set_fmode
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_crt_atexit
_errno
system
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_invalid_parameter_noinfo
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strcat_s
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ