Static task
static1
Behavioral task
behavioral1
Sample
e00fa90e5d127eb9cfdd00340e87d3ef8292ced8440ba40d2ae9d5d683fea94d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e00fa90e5d127eb9cfdd00340e87d3ef8292ced8440ba40d2ae9d5d683fea94d.exe
Resource
win10v2004-20230915-en
General
-
Target
e00fa90e5d127eb9cfdd00340e87d3ef8292ced8440ba40d2ae9d5d683fea94d
-
Size
4.5MB
-
MD5
497b5f44074e55d3ed7acf9fcd805571
-
SHA1
9544136a405a94a931c1d25fb821c180f8e5c505
-
SHA256
e00fa90e5d127eb9cfdd00340e87d3ef8292ced8440ba40d2ae9d5d683fea94d
-
SHA512
728301e2865a867cc9c927c7a1803c3143cf9925ef3b2f7da3015d366441731995007ed7f1fcdc80b9402c4fcfb483e80c6c62ab8f05f83879105a9f0dae7d5a
-
SSDEEP
98304:Eqr0X8fXQpzoUSDHfJ2jKBKdgxeNMKfVKVE:Eqr0MfgpMLHfJ2jKBSoKfgV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e00fa90e5d127eb9cfdd00340e87d3ef8292ced8440ba40d2ae9d5d683fea94d
Files
-
e00fa90e5d127eb9cfdd00340e87d3ef8292ced8440ba40d2ae9d5d683fea94d.exe windows:6 windows x64
f27be253632a1994738926966167562b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
comctl32
ImageList_Replace
ord16
ImageList_SetBkColor
ImageList_Destroy
ImageList_Create
ord17
ImageList_GetIconSize
ImageList_Draw
ImageList_Add
ImageList_GetImageCount
ImageList_GetImageInfo
rpcrt4
UuidToStringW
RpcStringFreeW
ncore
NStringPrependStrOrCharsA
NObjectReset
NCoreOnExitEx
NCoreOnStart
NDoubleParseN
NObjectGetPropertyNN
NInt32TypeOf
NValueToObject
NTypeIsInstanceOfType
NEnumToStringN
NAsyncOperationAddCompleted
NFileWriteAllBytesN
NObjectToStringN
NAsyncOperationGetResult
NValueToInt32
NAsyncOperationGetError
NObjectRemovePropertyChanged
NReAlloc
NObjectAddPropertyChanged
NStringGetBufferW
NObjectSetPropertyNN
NBooleanTypeOf
NObjectEquals
NStringAppendStrOrCharsW
NStringCreateWrapperW
NErrorCreateN
NCAlloc
NObjectSet
NCallbackCreateCustomRaw
NErrorGetCodeEx
NStringConcatManyVAW
NErrorSetComW
NStringConcatManyVAA
NStringCreateFromStrOrCharsA
NErrorSetLastN
NErrorSetLastA
NErrorSetLastW
NCallbackFree
NStringBuilderInitW
NStringBuilderAppendW
NStringBuilderAppendNW
NStringBuilderAppendCharW
NStringBuilderDetachStringNW
NStringBuilderDisposeW
NStringBuilderGetLengthW
NStringTrim
NFree
NStringToLower
NStringCreateWrapperA
NStringFree
NStringClone
NFileReadAllLinesN
NFileExistsN
NObjectUnref
NErrorSuppress
NErrorGetLastEx
NObjectRef
NStringEqualsStrOrCharsW
NErrorSetLastEx
nmedia
NImageFormatGetNameN
NImageFormatGetFileFilterN
NImageFormatCanRead
NImageFormatGetFormatCount
NImageGetHeight
NImageGetWidth
NImageSaveToFileExN
NImageCreateFromFileExN
NImageFormatGetFormatEx
NImageFormatCanWrite
NImageCopyToData
nbiometrics
NIrisTypeOf
NBiometricAttributesGetChild
NBiometricAttributesGetAttributeIndexOf
NBiometricAttributesGetAttributeThreshold
NBiometricEngineInitialize
NBiometricAttributesGetAttributeId
NIrisSetImageType
NIrisSetImage
NSubjectGetMatchingResult
NBiometricAttributesGetAttributeValue
NSubjectGetMatchingResultCount
NBiometricTaskGetSubjectCount
NMatchingResultGetScore
NMatchingResultGetId
NBiometricEngineIdentifyAsync
NBiometricTaskAddSubject
NSubjectSetIdN
NSubjectCreateFromFileN
NBiometricEngineClear
NBiometricTaskTypeOf
NSubjectGetIrisCount
NSubjectGetStatus
NBiometricStatusTypeOf
NBiometricTaskGetStatus
NEAttributesRemoveOuterBoundaryPointsCollectionChanged
NBiometricEnginePerformTaskAsync
NBiometricEngineCreateTask
NBiometricSetCaptureOptions
NIrisSetPosition
NSubjectGetIris
NSubjectGetTemplateBuffer
NBiometricAttributesGetQuality
NBiometricEngineCreateTemplateAsync
NIrisRemoveObjectsCollectionChanged
NIrisAddObjectsCollectionChanged
NIrisGetImage
NSubjectAddIris
NSubjectCreate
NBiometricSetFileNameN
NIrisGetObjectCount
NIrisGetObject
NEAttributesIsInnerBoundaryAvailable
NEAttributesGetInnerBoundaryPointCount
NEAttributesGetInnerBoundaryPoint
NEAttributesIsOuterBoundaryAvailable
NEAttributesGetOuterBoundaryPointCount
NEAttributesGetOuterBoundaryPoint
NIrisCreate
NEAttributesAddInnerBoundaryPointsCollectionChanged
NEAttributesAddOuterBoundaryPointsCollectionChanged
NEAttributesRemoveInnerBoundaryPointsCollectionChanged
NBiometricEngineVerifyOfflineAsync
nbiometricclient
NBiometricClientSetUseDeviceManager
NBiometricClientSetIrisScanner
NBiometricClientSetBiometricTypes
NBiometricClientGetIrisScanner
NBiometricClientGetDeviceManager
NBiometricClientCancel
NBiometricClientForce
NBiometricClientCreate
nlicensing
NLicenseObtainComponentsN
NLicenseIsComponentActivatedN
NLicManGetTrialMode
NLicManSetTrialMode
ndevices
NDeviceManagerGetDeviceByIdN
NDeviceManagerGetDevices
NIrisScannerTypeOf
NDeviceGetIdN
NDeviceGetDisplayNameN
kernel32
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsBadReadPtr
LocalAlloc
FormatMessageW
GetLastError
SetLastError
ExitProcess
GetCurrentThreadId
MulDiv
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
LoadLibraryW
GetCommandLineW
LocalFree
GetStdHandle
FreeConsole
AttachConsole
WriteConsoleA
WriteConsoleW
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
ReadConsoleOutputCharacterA
GlobalSize
GlobalHandle
SetErrorMode
MultiByteToWideChar
WideCharToMultiByte
GetSystemTimeAsFileTime
CloseHandle
WaitForSingleObject
GetCurrentProcess
GetCurrentThread
TlsAlloc
TlsSetValue
TlsFree
GetTempPathW
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetEnvironmentVariableW
IsDebuggerPresent
TerminateProcess
GetVersionExW
GetNativeSystemInfo
LoadResource
LockResource
SizeofResource
FindResourceW
IsValidCodePage
GetCPInfo
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetLongPathNameW
GetTempFileNameW
SetCurrentDirectoryW
GetFileType
CopyFileW
SetEvent
CreateEventW
QueryPerformanceCounter
QueryPerformanceFrequency
OutputDebugStringW
ExpandEnvironmentStringsW
WaitForMultipleObjects
GetDriveTypeW
GetLogicalDriveStringsW
RtlCaptureContext
GetACP
IsBadStringPtrA
user32
CreateAcceleratorTableW
GetClassNameW
MessageBeep
GetWindowTextW
IsRectEmpty
GetClassInfoW
SetMenu
RegisterWindowMessageW
GetProcessDefaultLayout
MessageBoxW
DrawIconEx
GetComboBoxInfo
FindWindowExW
ChildWindowFromPoint
DestroyIcon
HideCaret
GetWindowTextLengthW
keybd_event
IsMenu
SetWindowRgn
SetForegroundWindow
GetSystemMenu
CreateDialogIndirectParamW
IsZoomed
BringWindowToTop
IsIconic
FlashWindowEx
SetLayeredWindowAttributes
UnregisterClassW
RegisterClassW
DdeGetLastError
DdeFreeDataHandle
DdeGetData
DdeCreateDataHandle
DdeClientTransaction
DdeNameService
DdePostAdvise
DdeDisconnect
DdeConnect
DdeUninitialize
DdeInitializeW
GetWindowPlacement
GetDialogBaseUnits
CheckMenuRadioItem
GetSysColorBrush
GetMenuItemID
CheckMenuItem
DrawFrameControl
DestroyCursor
TranslateAcceleratorW
LoadCursorW
SetMenuItemInfoW
InsertMenuItemW
SetMenuInfo
RemoveMenu
ModifyMenuW
AppendMenuW
InsertMenuW
GetSubMenu
EnableMenuItem
DestroyMenu
CreatePopupMenu
CreateMenu
DrawMenuBar
GetMenuState
KillTimer
UnionRect
LoadImageW
LoadIconW
LoadBitmapW
GetIconInfo
CreateIconIndirect
IsClipboardFormatAvailable
OffsetRect
CopyRect
SetRectEmpty
SetRect
DrawFocusRect
DrawStateW
DrawTextW
GetDlgItem
CreateDialogParamW
SystemParametersInfoW
GetScrollInfo
SetScrollInfo
IsDialogMessageW
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
SetParent
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
GetDoubleClickTime
GetCaretBlinkTime
GetMessageW
PostThreadMessageW
ValidateRect
GetWindowDC
BeginPaint
EndPaint
GetDesktopWindow
ValidateRgn
RegisterClipboardFormatW
GetClipboardFormatNameW
ChangeDisplaySettingsExW
EnumDisplaySettingsW
MonitorFromPoint
PtInRect
InflateRect
FillRect
GetSysColor
ChildWindowFromPointEx
WindowFromPoint
MonitorFromWindow
GetMonitorInfoW
EnumDisplayMonitors
wsprintfW
DestroyAcceleratorTable
MapWindowPoints
DdeCreateStringHandleW
DdeQueryStringW
DdeFreeStringHandle
MsgWaitForMultipleObjects
DrawEdge
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetWindowRect
GetClientRect
SetWindowTextW
EnableScrollBar
ScrollWindow
RedrawWindow
InvalidateRect
GetUpdateRgn
ReleaseDC
GetDC
UpdateWindow
GetMenuItemInfoW
TrackPopupMenu
GetMenuItemCount
GetSystemMetrics
IsWindowEnabled
EnableWindow
ReleaseCapture
SetCapture
GetCapture
MapVirtualKeyW
VkKeyScanW
GetAsyncKeyState
GetKeyState
GetFocus
GetActiveWindow
SetFocus
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
MoveWindow
AnimateWindow
ShowWindow
DestroyWindow
IsWindow
CreateWindowExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
SendMessageW
GetMessageTime
GetMessagePos
UnregisterHotKey
RegisterHotKey
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
SetTimer
CallNextHookEx
gdi32
SetBrushOrgEx
GetTextMetricsW
SelectPalette
GdiFlush
DeleteObject
SelectObject
RealizePalette
GetDeviceCaps
ExcludeClipRect
CreateRectRgn
CreateFontIndirectW
GetOutlineTextMetricsW
EndPage
StartPage
EndDoc
StartDocW
SetAbortProc
EnumFontFamiliesExW
GetSystemPaletteEntries
CreateDCW
PlayEnhMetaFile
GetEnhMetaFileHeader
GetEnhMetaFileW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
SetViewportOrgEx
SetDIBColorTable
GetDIBColorTable
CreateDIBSection
GetDIBits
CreateDIBitmap
GetTextExtentExPointW
GetCharABCWidthsW
CreateRectRgnIndirect
GetPaletteEntries
GetNearestPaletteIndex
CreatePalette
RectInRegion
PtInRegion
GetRgnBox
EqualRgn
CombineRgn
MoveToEx
LineTo
GetBkColor
SetWindowOrgEx
SetWindowExtEx
SetViewportExtEx
PolyBezier
Polyline
Polygon
LPtoDP
DPtoLP
CreatePolygonRgn
ExtTextOutW
ModifyWorldTransform
SetWorldTransform
GetWorldTransform
SetROP2
StretchDIBits
SetPolyFillMode
SetPixel
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
ExtSelectClipRgn
SelectClipRgn
RoundRect
Rectangle
PolyPolygon
Pie
MaskBlt
GetPixel
GetObjectType
GetClipBox
ExtFloodFill
Ellipse
Arc
CreatePatternBrush
CreateHatchBrush
CreateICW
OffsetRgn
GetRegionData
ExtCreateRegion
GetTextExtentPoint32W
SetStretchBltMode
StretchBlt
ExtCreatePen
GetStockObject
CreatePen
GetObjectW
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmapIndirect
CreateBitmap
BitBlt
SetTextColor
SetBkMode
SetBkColor
GetWindowExtEx
GetViewportExtEx
GetGraphicsMode
CreateSolidBrush
winspool.drv
DocumentPropertiesW
OpenPrinterW
ClosePrinter
GetPrinterW
comdlg32
ChooseFontW
CommDlgExtendedError
GetSaveFileNameW
PageSetupDlgW
PrintDlgW
GetOpenFileNameW
advapi32
RegCreateKeyExW
RegSetValueExW
RegCloseKey
GetUserNameW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
shell32
DragQueryPoint
DragFinish
SHGetFolderPathW
ord6
SHGetFileInfoW
CommandLineToArgvW
ExtractIconExW
ExtractIconW
DragAcceptFiles
DragQueryFileW
ole32
CoLockObjectExternal
OleUninitialize
OleInitialize
RevokeDragDrop
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
ReleaseStgMedium
OleIsCurrentClipboard
OleFlushClipboard
OleGetClipboard
OleSetClipboard
RegisterDragDrop
oleaut32
SysFreeString
SysAllocString
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAJ@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrSwap@@YAXPEAX0@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_Xout_of_range@std@@YAXPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
oleacc
LresultFromObject
uxtheme
DrawThemeBackground
GetThemeBackgroundContentRect
IsThemeBackgroundPartiallyTransparent
GetThemeColor
DrawThemeParentBackground
GetThemeMargins
GetThemePartSize
GetThemeInt
GetThemeSysColor
GetThemeSysFont
SetWindowTheme
GetThemeBackgroundExtent
GetCurrentThemeName
IsThemeActive
IsAppThemed
GetThemeFont
IsThemePartDefined
OpenThemeData
CloseThemeData
msimg32
GradientFill
AlphaBlend
shlwapi
SHAutoComplete
vcruntime140
__RTDynamicCast
__std_exception_destroy
__std_exception_copy
__intrinsic_setjmp
_set_se_translator
wcsstr
longjmp
__CxxFrameHandler3
__std_terminate
__RTtypeid
__std_type_info_compare
_purecall
__std_type_info_name
wcschr
__C_specific_handler
memcpy
memmove
memset
memcmp
_CxxThrowException
strchr
strstr
api-ms-win-crt-stdio-l1-1-0
fread
_fileno
_get_osfhandle
_open_osfhandle
clearerr
feof
ferror
_fseeki64
_ftelli64
fwrite
fclose
_wsopen_dispatch
__p__commode
__stdio_common_vsscanf
_close
_read
_write
_lseeki64
_telli64
__stdio_common_vswprintf_s
__stdio_common_vswprintf
__stdio_common_vswprintf_p
__stdio_common_vswscanf
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func
fflush
_wfopen
__stdio_common_vfwprintf
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
realloc
malloc
free
calloc
api-ms-win-crt-runtime-l1-1-0
_initterm
exit
_set_app_type
_seh_filter_exe
terminate
_initterm_e
_exit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_get_narrow_winmain_command_line
_invalid_parameter_noinfo_noreturn
_c_exit
_errno
abort
_cexit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-string-l1-1-0
towupper
toupper
isspace
tolower
_strdup
strncpy
iswprint
strncmp
iswalnum
wcsncpy
_wcsicmp
wcspbrk
towlower
strcmp
iswalpha
iswxdigit
iswspace
iswdigit
api-ms-win-crt-math-l1-1-0
atan2f
ceilf
cosf
floorf
fmodf
pow
sinf
acosf
tanf
_fdopen
fmod
floor
cos
ceil
atan2
lround
log10
sqrtf
lroundf
sqrt
sin
__setusermatherr
api-ms-win-crt-convert-l1-1-0
atof
_wtol
_wcstoui64
_wcstoi64
wcstoul
_wtoi
wcstol
_wcstod_l
wcstod
strtoll
strtol
api-ms-win-crt-time-l1-1-0
wcsftime
_get_timezone
_time64
_gmtime64
_localtime64
_mktime64
_tzset
api-ms-win-crt-utility-l1-1-0
bsearch
qsort
api-ms-win-crt-environment-l1-1-0
_wgetenv
_wgetcwd
getenv
api-ms-win-crt-filesystem-l1-1-0
_wrename
_wremove
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_free_locale
setlocale
_create_locale
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 84KB - Virtual size: 269KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 125KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ