Static task
static1
Behavioral task
behavioral1
Sample
81a09ab0481334a18d03b80e2986ac77c557865f1e7e4199159e2c5d6513ea88.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
81a09ab0481334a18d03b80e2986ac77c557865f1e7e4199159e2c5d6513ea88.exe
Resource
win10v2004-20230915-en
General
-
Target
81a09ab0481334a18d03b80e2986ac77c557865f1e7e4199159e2c5d6513ea88
-
Size
567KB
-
MD5
b7446837762f998c595097d465ae62cf
-
SHA1
d7804327c5787f1bb329c95d6183e7bd5098e594
-
SHA256
81a09ab0481334a18d03b80e2986ac77c557865f1e7e4199159e2c5d6513ea88
-
SHA512
17bf529c0b16b3b113d8f226edf41421d90800f787048caecd4ecf0f0bfab2a6d1db5dc7558afc873ee82b57ad7d6691ba2cc01e8a4fbb2a1aa0e63c2b8785bc
-
SSDEEP
12288:8EzsHlGOc9oMi3O3KSiydWzFfJ4T8YcHGSeiqdlyqj8ua:pObMFWzFh4T0HG4qdn8ua
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81a09ab0481334a18d03b80e2986ac77c557865f1e7e4199159e2c5d6513ea88
Files
-
81a09ab0481334a18d03b80e2986ac77c557865f1e7e4199159e2c5d6513ea88.exe windows:6 windows x86
c8b66f1f8241fc030b632288a77777e5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundW
liteav
getLocalRecordShareInstance
createTXNetworkProxy
destroyTXNetworkProxy
destroyTXVodPlayer
createTXLivePlayer
getTRTCShareInstance
destroyLocalRecordShareInstance
shlwapi
PathFileExistsW
kernel32
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetEvent
WaitForSingleObjectEx
GetCommandLineW
WideCharToMultiByte
GetStdHandle
SetConsoleMode
GetConsoleMode
ReadConsoleInputW
CreateThread
ExitProcess
GetCurrentProcess
CreateFileW
GetFileAttributesW
GetCurrentThreadId
GetLastError
OutputDebugStringW
CloseHandle
LoadLibraryW
HeapSetInformation
GetLocalTime
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
IsDebuggerPresent
SetUnhandledExceptionFilter
CreateDirectoryW
GetModuleFileNameW
DeleteFileW
VirtualQuery
CreateMutexW
ReleaseMutex
FreeConsole
ResetEvent
GetModuleFileNameA
GetModuleHandleExW
LoadLibraryExA
MultiByteToWideChar
LoadLibraryA
GetShortPathNameW
InitializeCriticalSection
DeleteCriticalSection
lstrcpyA
lstrcpynA
CreateEventW
LeaveCriticalSection
EnterCriticalSection
InitializeSListHead
SetProcessDEPPolicy
AllocConsole
user32
SendMessageTimeoutW
RegisterClassExW
ShowWindow
SetTimer
GetWindowLongW
CallWindowProcW
DestroyWindow
CreateWindowExW
IsWindow
RegisterClassW
LoadCursorW
SetWindowLongW
PostQuitMessage
GetMessageW
DispatchMessageW
DefWindowProcW
MessageBoxW
PostMessageW
TranslateMessage
gdi32
GetStockObject
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetFolderPathW
ole32
CoUninitialize
CoInitialize
msvcp140
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPBD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?_Xinvalid_argument@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Thrd_id
_Thrd_join
_Mtx_unlock
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
vcruntime140
_CxxThrowException
__RTDynamicCast
memchr
memcpy
memmove
_except_handler4_common
memset
__CxxFrameHandler3
__std_exception_destroy
__std_exception_copy
_purecall
__std_type_info_name
__std_terminate
strchr
strstr
wcsrchr
api-ms-win-crt-runtime-l1-1-0
_c_exit
_exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
_cexit
exit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_controlfp_s
_errno
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo
terminate
api-ms-win-crt-string-l1-1-0
strncmp
tolower
strtok
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
setlocale
api-ms-win-crt-stdio-l1-1-0
fgetc
fgetpos
setvbuf
fputc
fsetpos
_fseeki64
_get_stream_buffer_pointers
fputwc
ungetwc
fgetwc
__stdio_common_vfwprintf
__p__commode
__acrt_iob_func
_wfreopen_s
__stdio_common_vfprintf
fread
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fseek
fputws
fclose
fflush
_set_fmode
_wfsopen
ungetc
__stdio_common_vswprintf_s
fwrite
api-ms-win-crt-math-l1-1-0
__setusermatherr
_except1
_dtest
api-ms-win-crt-heap-l1-1-0
free
malloc
_callnewh
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_wfindfirst64i32
_findclose
_wfindnext64i32
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
strtol
atol
_wtoi
api-ms-win-crt-utility-l1-1-0
rand
srand
Sections
.text Size: 237KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 165KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 83KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE