Static task
static1
Behavioral task
behavioral1
Sample
a905d2d75d0fc2768f2d8e6ac25e53666d1f877bf6854e58c397e3c2f2209d42.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a905d2d75d0fc2768f2d8e6ac25e53666d1f877bf6854e58c397e3c2f2209d42.exe
Resource
win10v2004-20230915-en
General
-
Target
a905d2d75d0fc2768f2d8e6ac25e53666d1f877bf6854e58c397e3c2f2209d42
-
Size
14.3MB
-
MD5
4099fb54f84cad7adf0710d56512b528
-
SHA1
8738e0613f47439ad6563195a841ccbeaadf7b1b
-
SHA256
a905d2d75d0fc2768f2d8e6ac25e53666d1f877bf6854e58c397e3c2f2209d42
-
SHA512
491e8038f0490761fb02c49bf72b1c1c0c85225e18bd33b225bcd381bfdd01d98a7e9efc5ea05d0879ad89aef5b09feb05c47c48fe08180bad8d688133812a9d
-
SSDEEP
393216:ltm1DNRgVbiIeD6KSMhnHcbzKPnVQmCO:4R
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a905d2d75d0fc2768f2d8e6ac25e53666d1f877bf6854e58c397e3c2f2209d42
Files
-
a905d2d75d0fc2768f2d8e6ac25e53666d1f877bf6854e58c397e3c2f2209d42.exe windows:6 windows x64
472394d52cce0e58655a27dcbc9d4905
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvfw32
ICLocate
ICClose
ICDecompress
ICSendMessage
avifil32
AVIFileRelease
AVIFileInfoA
AVIFileInit
AVIFileOpenA
winmm
timeGetTime
mmioOpenA
timeBeginPeriod
mmioDescend
mmioClose
mmioRead
mmioAscend
mmioSeek
timeEndPeriod
dinput8
DirectInput8Create
kernel32
GetTickCount
GlobalAlloc
GlobalLock
GlobalUnlock
OpenMutexA
CreateMutexA
CloseHandle
GetModuleHandleA
IsDebuggerPresent
WideCharToMultiByte
Sleep
GlobalMemoryStatusEx
K32GetProcessMemoryInfo
GetCurrentProcess
SetFileAttributesA
GetConsoleScreenBufferInfo
VerSetConditionMask
VerifyVersionInfoW
GetCurrentThread
LocalFree
FormatMessageA
CreateFileA
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
GetCommandLineA
GetModuleFileNameA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetComputerNameA
GetSystemInfo
UnmapViewOfFile
GetFileSize
CreateFileMappingA
MapViewOfFile
GetFileAttributesA
SetFilePointer
ReadFile
QueryPerformanceCounter
QueryPerformanceFrequency
GetThreadId
RaiseException
GetProcAddress
GetLastError
GetSystemTimeAsFileTime
GetVersion
GetLogicalProcessorInformation
GetSystemTimes
RtlCaptureContext
MultiByteToWideChar
GlobalFree
SwitchToThread
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
LoadLibraryA
OutputDebugStringA
FindFirstFileExW
GetStartupInfoW
FlsAlloc
FlsSetValue
FlsFree
GetProcessTimes
GetCurrentProcessorNumber
VirtualAlloc
VirtualFree
VirtualQuery
GetLargePageMinimum
VirtualUnlock
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetNumaHighestNodeNumber
GetFileInformationByHandleEx
GetModuleHandleW
AreFileApisANSI
FreeLibrary
WriteConsoleA
WriteFile
GetEnvironmentVariableA
CreateEventA
GetNumaNodeProcessorMask
GetFileAttributesExW
FindNextFileW
WaitForSingleObject
InitializeSListHead
SetEvent
IsProcessorFeaturePresent
GetStdHandle
user32
DispatchMessageA
TranslateMessage
PeekMessageA
ClipCursor
MapWindowPoints
LoadCursorA
ShowCursor
ToAscii
ToAsciiEx
MapVirtualKeyA
ToUnicode
RegisterClassA
ToUnicodeEx
GetWindowThreadProcessId
SetForegroundWindow
GetKeyboardState
SetRect
PostMessageA
ScreenToClient
GetCursorPos
PostQuitMessage
SetWindowPos
CreateDialogParamA
SystemParametersInfoA
SendDlgItemMessageA
LoadImageA
DestroyWindow
ShowWindow
GetClipboardData
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
LoadIconA
GetSystemMetrics
GetDesktopWindow
DefWindowProcA
AdjustWindowRect
CreateWindowExA
GetWindowRect
SetWindowLongPtrA
EnumDisplaySettingsA
SetCursorPos
GetWindowLongPtrA
GetAsyncKeyState
GetKeyboardLayout
MessageBoxA
MapVirtualKeyExA
GetClientRect
gdi32
GetStockObject
ole32
CoUninitialize
CoCreateGuid
CoInitializeEx
msvcp140
??_7codecvt_base@std@@6B@
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?narrow@?$ctype@_W@std@@QEBAPEB_WPEB_W0DPEAD@Z
?widen@?$ctype@_W@std@@QEBAPEBDPEBD0PEA_W@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
?_Winerror_map@std@@YAHH@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
_Cnd_unregister_at_thread_exit
_Cnd_register_at_thread_exit
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Cnd_signal
?id@?$numpunct@D@std@@2V0locale@2@A
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
_Last_write_time
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?uncaught_exceptions@std@@YAHXZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
_Xtime_get_ticks
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Xruntime_error@std@@YAXPEBD@Z
_Cnd_init_in_situ
_Thrd_hardware_concurrency
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Cnd_wait
_Cnd_destroy_in_situ
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
_Cnd_broadcast
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??_7facet@locale@std@@6B@
_Strxfrm
_Strcoll
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??_7_Facet_base@std@@6B@
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_frequency
_Query_perf_counter
_Mtx_unlock
_Mtx_lock
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?get_new_handler@std@@YAP6AXXZXZ
_Thrd_yield
?_Random_device@std@@YAIXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
dbghelp
SymGetOptions
SymSetOptions
SymGetLineFromAddr64
SymGetSymFromAddr64
SymGetModuleInfo64
SymInitialize
StackWalk64
MiniDumpWriteDump
SymGetModuleBase64
SymFunctionTableAccess64
SymCleanup
powrprof
CallNtPowerInformation
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
luajit
lua_call
lua_error
lua_insert
lua_rawset
lua_rawseti
lua_getfield
lua_dump
lua_tointeger
lua_objlen
lua_isuserdata
lua_pushlstring
lua_isnumber
lua_typename
lua_getlocal
lua_getinfo
lua_getstack
lua_gc
luaL_newmetatable
lua_equal
lua_pushnumber
lua_setfield
lua_pushinteger
lua_createtable
lua_replace
lua_gettop
lua_settable
lua_pushcclosure
lua_pushlightuserdata
lua_setmetatable
lua_newuserdata
lua_getupvalue
lua_iscfunction
lua_close
lua_atpanic
luaL_openlibs
luaL_newstate
lua_remove
lua_rawget
lua_pcall
luaL_loadbuffer
lua_isstring
luaL_traceback
lua_pushvalue
lua_tolstring
lua_tonumber
lua_pushboolean
lua_pushnil
lua_next
lua_type
lua_settop
lua_toboolean
lua_gettable
lua_pushstring
lua_getmetatable
lua_touserdata
lua_rawgeti
vcruntime140
__RTDynamicCast
__RTCastToVoid
memcmp
memmove
__std_exception_copy
__std_exception_destroy
_purecall
strstr
__C_specific_handler
strrchr
strchr
_set_purecall_handler
memcpy
memset
__std_terminate
__std_type_info_compare
__std_type_info_name
__RTtypeid
__current_exception
__current_exception_context
_CxxThrowException
memchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-time-l1-1-0
strftime
_localtime64
asctime
_strtime
_strdate
_tzset
_time64
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_c_exit
abort
_errno
__sys_errlist
_exit
_configure_narrow_argv
_initterm_e
_invalid_parameter_noinfo
_initterm
_get_narrow_winmain_command_line
terminate
_initialize_narrow_environment
_initialize_onexit_table
_controlfp
_clearfp
_set_new_handler
_register_onexit_function
_set_invalid_parameter_handler
signal
_set_abort_behavior
set_terminate
quick_exit
_beginthreadex
exit
_crt_atexit
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
api-ms-win-crt-string-l1-1-0
isspace
tolower
strcat_s
isprint
_strupr
strcpy_s
strncpy_s
strncmp
isalpha
isalnum
strcmp
toupper
strncpy
iswspace
_strlwr
isdigit
strtok
_strlwr_s
strcspn
_stricmp
strncat_s
api-ms-win-crt-stdio-l1-1-0
setvbuf
fflush
_wfopen
fputs
ungetc
fputc
fgetc
fsetpos
_fseeki64
_set_fmode
__stdio_common_vsscanf
__stdio_common_vsprintf
ftell
fgetpos
fwrite
fread
_get_stream_buffer_pointers
__acrt_iob_func
__stdio_common_vfprintf
fclose
__stdio_common_vsnprintf_s
__p__commode
__stdio_common_vsprintf_s
fopen
fseek
_sopen_dispatch
api-ms-win-crt-convert-l1-1-0
mbstowcs
_itoa
wcstombs
atof
atoi
strtol
wcstombs_s
api-ms-win-crt-math-l1-1-0
tanf
sqrtf
sqrt
sinf
sin
powf
pow
logf
log
modff
fmodf
floorf
floor
expf
exp
cosf
cos
_fdsign
ceilf
atanf
atan2f
atan
_ldsign
_dsign
asinf
acosf
_ldclass
_copysign
_fdclass
_dclass
_fdopen
_fpclass
ldexp
__setusermatherr
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_findnext64i32
_stat64i32
_lock_file
_findclose
_unlink
_findfirst64i32
_splitpath
rename
api-ms-win-crt-heap-l1-1-0
realloc
calloc
free
malloc
_set_new_mode
_heapwalk
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
openal32
alBufferData
alDeleteBuffers
alDeleteSources
alGenBuffers
alGenSources
alGetError
alGetProcAddress
alGetSourcei
alGetString
alIsExtensionPresent
alIsSource
alListener3f
alListenerf
alListenerfv
alSource3f
alSource3i
alSourcePlay
alSourceQueueBuffers
alSourceStop
alSourceUnqueueBuffers
alSourcef
alSourcei
alcCloseDevice
alcCreateContext
alcDestroyContext
alcGetContextsDevice
alcGetCurrentContext
alcGetError
alcGetIntegerv
alcGetString
alcIsExtensionPresent
alcMakeContextCurrent
alcOpenDevice
d3dx9_43
D3DXMatrixOrthoOffCenterLH
D3DXMatrixInverse
D3DXDeclaratorFromFVF
D3DXGetDeclLength
D3DXGetDeclVertexSize
D3DXGetFVFVertexSize
d3dx11_43
D3DX11CreateTextureFromMemory
D3DX11GetImageInfoFromMemory
D3DX11SaveTextureToMemory
D3DX11FilterTexture
D3DX11LoadTextureFromTexture
d3d11
D3D11CreateDevice
d3dcompiler_47
D3DReflect
D3DGetInputSignatureBlob
D3DDisassemble
D3DCompile
dxgi
CreateDXGIFactory1
advapi32
LookupPrivilegeValueA
OpenProcessToken
GetUserNameA
AdjustTokenPrivileges
shell32
ShellExecuteA
Sections
.text Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.1MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 217KB - Virtual size: 216KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ