Static task
static1
Behavioral task
behavioral1
Sample
b3ec446f34773c2524977df77f576cd570c1f2bce6a083120b7160dd9d8f6bb7.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b3ec446f34773c2524977df77f576cd570c1f2bce6a083120b7160dd9d8f6bb7.exe
Resource
win10v2004-20230915-en
General
-
Target
b3ec446f34773c2524977df77f576cd570c1f2bce6a083120b7160dd9d8f6bb7
-
Size
127KB
-
MD5
2e06786c8f9be8b8d8898131ff38cdf8
-
SHA1
4e33bc01a6911f8b99b19dacf1fa999a03c89606
-
SHA256
b3ec446f34773c2524977df77f576cd570c1f2bce6a083120b7160dd9d8f6bb7
-
SHA512
8272cb8e2e88a5f9ec36f001f9cfb919704aae4217b37f416faad756c53d6bab36367fa9acf8909fa43505a8ae12c611bf8b10961f6580399259b158e279f9b5
-
SSDEEP
3072:/vQrPfff6DTVISVbJuGvUtWjqxDYzFwdq7CnzAq14:/vQrPnf6nVIeb9jj1qV4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3ec446f34773c2524977df77f576cd570c1f2bce6a083120b7160dd9d8f6bb7
Files
-
b3ec446f34773c2524977df77f576cd570c1f2bce6a083120b7160dd9d8f6bb7.exe windows:5 windows x86
6dd862d221ca968269872da9b615496c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
xgraphic32
UnlockBitmapBits
CreateMemBitmap
DeleteBitmap
LockBitmapBits
renderservice
InitServerByCommandLine
DestroyServerChannel
?ReadSerialize@@YA_NPAXAAJ@Z
?ReadSerialize@@YA_NPAXAA_N@Z
?ReadSerialize@@YA_NPAXAAUtagVARIANT@@@Z
CreateServerChannel
?ReadSerialize@@YA_NPAXAAUtagDISPPARAMS@@@Z
?DestroySerialize@@YAXPAX@Z
rsSetChannelMessageProc
?CreateSerialize@@YAPAXXZ
?WriteSerialize@@YA_NPAXABI@Z
?WriteSerialize@@YA_NPAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WriteSerialize@@YA_NPAXABUtagDISPPARAMS@@@Z
rsSendChannelMessageSync
rsSendChannelMessage
?ReadSerialize@@YA_NPAXAAH@Z
?ReadSerialize@@YA_NPAXAAK@Z
?WriteSerialize@@YA_NPAXABUtagSIZE@@@Z
?WriteSerialize@@YA_NPAXAB_N@Z
?ReadSerialize@@YA_NPAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ReadSerialize@@YA_NPAXAAI@Z
ark
arkLoadApplicationInstance
arkDestroyRootView
arkHTTPSetDownloadDirectory
arkEndApp
arkStartApp
arkModuleRequireDLL
arkDispatchTaskSync
arkCreateDispatchQueue
arkGetPixelScale
arkGetDispatchQueueLabel
arkGetScriptEngine
arkDispatchTaskAsync
arkCloseDispatchQueue
arkModuleCallbackRegister
arkDestroyContainer
arkGetApplicationID
arkSetStoragePath
arkBindRootView
arkCreateContainerCanvasFromBitmap
arkReleaseApplicationInstance
arkHTTPSetLogCallback
arkCreateRootView
arkBitmapCreateFromData
arkRunApplicationInstance
arkSetLogCallback
arkCreateContainer
arkCreateApplicationInstance
arkCanvasDestroy
arkBitmapDestroy
arkNotify
arkSetApplicationCallback
arkHTTPStartup
arkGetCurrentDispatchQueue
arkGetSrcAppName
arkipc
IPCStartup
IPCCleanup
kernel32
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetSystemTimeAsFileTime
DeleteCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetLastError
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
GetModuleHandleW
CreateProcessW
CloseHandle
GetCurrentProcessId
CreateEventW
DuplicateHandle
GetCurrentThreadId
WaitForSingleObject
GetModuleFileNameW
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
TerminateProcess
GetCurrentProcess
EnterCriticalSection
WriteProcessMemory
SearchPathW
user32
WaitMessage
DispatchMessageW
PeekMessageW
TranslateMessage
PostMessageW
oleaut32
SysAllocString
VariantClear
SysFreeString
msvcp140
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
vcruntime140
__CxxFrameHandler3
memchr
memcpy
memcmp
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memmove
memset
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
_set_fmode
__p__commode
__stdio_common_vswprintf
api-ms-win-crt-string-l1-1-0
strlen
wcslen
api-ms-win-crt-filesystem-l1-1-0
_wmakepath
_wsplitpath
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 74KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE