Static task
static1
Behavioral task
behavioral1
Sample
cf48836cc4c50e86b96a3dcd8b127bce9a1ff1136c22e9b53edce1231415b521.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cf48836cc4c50e86b96a3dcd8b127bce9a1ff1136c22e9b53edce1231415b521.exe
Resource
win10v2004-20230915-en
General
-
Target
cf48836cc4c50e86b96a3dcd8b127bce9a1ff1136c22e9b53edce1231415b521
-
Size
1.8MB
-
MD5
09e255c242f9808272e5c2a0fea60150
-
SHA1
b9f97501d47dba83214b49b2de2332d1a16c09c7
-
SHA256
cf48836cc4c50e86b96a3dcd8b127bce9a1ff1136c22e9b53edce1231415b521
-
SHA512
07444a183076e967db193d41fe856289ff86d90420489791a272f08851148a73fe9784c70bb3e90a37d6c5256e71144d0e6d383bb741bbb1ec2458459d1a2b17
-
SSDEEP
49152:uTpQqOkdipBL/5SSvlBmIOmB1/ElXQxZL:+IL/59
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cf48836cc4c50e86b96a3dcd8b127bce9a1ff1136c22e9b53edce1231415b521
Files
-
cf48836cc4c50e86b96a3dcd8b127bce9a1ff1136c22e9b53edce1231415b521.exe windows x64
fd5bf4a112d36c14ca1680d6c677e590
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeleteCriticalSection
CreateFileW
GetFileSizeEx
ReadFile
WriteFile
CloseHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemInfo
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
GetLocalTime
WaitForSingleObject
VirtualAlloc
VirtualFree
GetLastError
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitOnceBeginInitialize
InitOnceComplete
GetCPInfoExW
InitializeCriticalSectionEx
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
OutputDebugStringA
GetModuleHandleW
FindResourceW
LoadResource
LockResource
LeaveCriticalSection
SizeofResource
user32
ReleaseDC
EmptyClipboard
IsIconic
EnumWindows
IsWindowVisible
CloseClipboard
SetCursorPos
DefWindowProcW
PostMessageW
GetWindowRect
SetWindowPos
SetWindowLongPtrW
EnumDisplayMonitors
CreateWindowExW
ScreenToClient
GetWindowLongPtrW
RegisterClassExW
ShowWindow
GetMonitorInfoW
LoadIconW
UpdateLayeredWindow
PostQuitMessage
UpdateWindow
GetMessageW
GetSystemMetrics
LoadCursorW
SetClipboardData
SetCursor
OpenClipboard
SetTimer
KillTimer
TranslateMessage
MessageBoxW
GetDC
GetWindowTextLengthW
DispatchMessageW
SendMessageW
dwmapi
DwmSetWindowAttribute
DwmGetWindowAttribute
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
gdi32
GetDIBits
SetDIBits
BitBlt
CreateCompatibleBitmap
DeleteObject
DeleteDC
StretchBlt
CreateCompatibleDC
SelectObject
ole32
CoTaskMemFree
CoCreateInstance
msvcp140
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?id@?$numpunct@_W@std@@2V0locale@2@A
_Xtime_get_ticks
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception_context
__current_exception
__C_specific_handler
memcpy
memset
memmove
memcmp
_purecall
__std_terminate
__std_exception_copy
__RTDynamicCast
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_configure_wide_argv
abort
terminate
_set_app_type
_beginthreadex
_seh_filter_exe
_get_wide_winmain_command_line
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
free
realloc
malloc
_callnewh
_set_new_mode
calloc
api-ms-win-crt-string-l1-1-0
toupper
strnlen
api-ms-win-crt-math-l1-1-0
fmod
pow
cbrt
tan
_fdclass
sqrt
sin
cos
atan2
_dclass
copysign
_ldsign
floor
_fdsign
_dsign
__setusermatherr
_ldclass
sqrtf
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
_set_fmode
fputs
__p__commode
__acrt_iob_func
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ