Static task
static1
Behavioral task
behavioral1
Sample
128aa1ecf3bf5ce0f68ae6e5a8b048e54512abfd49fb875a8b30da699ad5a58b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
128aa1ecf3bf5ce0f68ae6e5a8b048e54512abfd49fb875a8b30da699ad5a58b.exe
Resource
win10v2004-20230915-en
General
-
Target
128aa1ecf3bf5ce0f68ae6e5a8b048e54512abfd49fb875a8b30da699ad5a58b
-
Size
2.9MB
-
MD5
5478fad547af7f5e620b45bedee7d8ee
-
SHA1
e55725c2842fe07f9a4beebac8c130ecac673b8b
-
SHA256
128aa1ecf3bf5ce0f68ae6e5a8b048e54512abfd49fb875a8b30da699ad5a58b
-
SHA512
1f520a71a2372c0a13741fabfed58b45ee415b6c9c1000d0bcf6130507191d49a61448c3995e44f726242b5dd7f291bf1cdcb8d15b080cb3928fc0dd306cc4b0
-
SSDEEP
49152:wOSZRmV6ttKiSnv/qgCeAlo1VGGPjfczxouFeW1cSp8LjNxb:8Rm4ttKiSnv7Cek6TMxfFeW1ca8Ljbb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 128aa1ecf3bf5ce0f68ae6e5a8b048e54512abfd49fb875a8b30da699ad5a58b
Files
-
128aa1ecf3bf5ce0f68ae6e5a8b048e54512abfd49fb875a8b30da699ad5a58b.exe windows x86
c3fcd2df445eb066b5bbd922e6f7dfff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
net
?GetAlyInstance@@YAPAVAlyFunction@@XZ
?HttpDepandFileNeedUpload@@YA_NQBEAAHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?HttpSendFileUploadInfo@@YA_NABUUploadFileInfo@@@Z
?HttpPostScreenShotInfo@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00_N@Z
?HttpPostShqOpeTypeInfo@@YA_NW4SHQOPETYPTEENUM@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@1H1@Z
utilities
?StopProcess@BasicsProcess@@YAKK@Z
?GetProcIdByProcName@BasicsProcess@@YAKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?ProcessIsExist@BasicsProcess@@YA_NK@Z
?FindFile@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV12@HP6A_N0PAX@Z2@Z
?CompareNoCaseW@@YA_NPB_W0@Z
?GetTimeStringW@BasicsTime@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@W4TIME_SHOWMODE@1@@Z
?GetFileExtensionW@BasicsFile@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z
?GetFileNameW@BasicsFile@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PB_W@Z
?Md5ToString@NanAoMd5@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE@Z
?UTF8ToUnicode@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?GetFileMd5@BasicsOther@@YA_NPB_WAAHQAE@Z
?NewGetFileSizeW@BasicsFile@@YAJPB_W@Z
?AddPostedFile@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?IsPostedFile@@YA_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetExeDirW@BasicsFile@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetMachineCode@BasicsSystem@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?GetPidFilePathW@BasicsProcess@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@K@Z
?InitLowSec@@YAXAAU_SECURITY_ATTRIBUTES@@@Z
?WriteLogFunction@@YAXHPB_W0ZZ
?GetErrLevel@@YAIXZ
?GetModuleNameW@BasicsFile@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?SetLogRelocation@@YAXP6AXPBDH@Z@Z
?CompareMd5@BasicsOther@@YA_NQBE0@Z
?GetFileTime@BasicsFile@@YAKV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV23@11@Z
?IsFileExistW@BasicsFile@@YA_NPB_W@Z
kernel32
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CloseHandle
Sleep
OpenFileMappingW
CreateFileMappingW
GetLastError
MapViewOfFile
OpenMutexW
CreateMutexW
UnmapViewOfFile
GetTickCount
ReleaseMutex
CreateEventW
ResetEvent
SetEvent
CreateThread
ResumeThread
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
OpenFileMappingA
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetModuleFileNameW
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
GetProcessHeap
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
IsDebuggerPresent
OutputDebugStringW
GetFileType
GetModuleHandleExW
WriteConsoleW
LCMapStringW
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ExitProcess
WriteFile
CreateFileW
GetStdHandle
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
advapi32
StartServiceCtrlDispatcherW
SetServiceStatus
OpenSCManagerW
DeleteService
ControlService
CreateServiceW
CloseServiceHandle
OpenServiceW
RegisterServiceCtrlHandlerW
shlwapi
PathFileExistsW
Sections
.text Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.GGZuhao Size: 896KB - Virtual size: 896KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.GGZuhao Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE