Static task
static1
Behavioral task
behavioral1
Sample
2a069800e1c5ab868df7013a32858c668083e1fb04393801989d41248d3bc548.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2a069800e1c5ab868df7013a32858c668083e1fb04393801989d41248d3bc548.exe
Resource
win10v2004-20230915-en
General
-
Target
2a069800e1c5ab868df7013a32858c668083e1fb04393801989d41248d3bc548
-
Size
172KB
-
MD5
ba7f4ca365bbfcebb1387f4c7713a3ef
-
SHA1
4124b1f8e8f9112cde39a1e4b79031b708b0abc4
-
SHA256
2a069800e1c5ab868df7013a32858c668083e1fb04393801989d41248d3bc548
-
SHA512
feb074beaa1dda3cf375afc8f967a47488e1425b3209f7673be5a5da58fc36a3af4c417f1d3930c62f30dd235c460255d0885735d6a43285e5ca337f31a30665
-
SSDEEP
1536:YFKJYuAZV+ZUsyN1Tmfddo6vPPjzso/mLZpFVe8qwRbMRq9GJPLFbuRWG3Mlx7U7:JYPAzy3TErP0LVvJRbMRq4JTtuRWGcq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a069800e1c5ab868df7013a32858c668083e1fb04393801989d41248d3bc548
Files
-
2a069800e1c5ab868df7013a32858c668083e1fb04393801989d41248d3bc548.exe windows:4 windows x86
3c708f8faf71e996789689d02966fbf8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
LoadLibraryA
Sleep
SetUnhandledExceptionFilter
lstrcmpiA
GetCommandLineA
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
lstrlenA
GetCurrentThreadId
EnterCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
FlushInstructionCache
CreateThread
InterlockedDecrement
LocalFree
GetStartupInfoA
GetModuleHandleA
GetProcAddress
GetLastError
VirtualQuery
GetDiskFreeSpaceExA
MultiByteToWideChar
HeapFree
SetEvent
WideCharToMultiByte
lstrlenW
OpenProcess
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
GetCurrentProcessId
CreateEventA
SystemTimeToFileTime
DeleteFileA
GetModuleFileNameA
CreateDirectoryA
CreateMutexA
OutputDebugStringA
GetLocalTime
GlobalFree
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
GetProcessHeap
HeapAlloc
ReleaseMutex
WaitForSingleObject
CloseHandle
LeaveCriticalSection
user32
wsprintfA
PostMessageA
SendMessageA
MessageBoxA
SetWindowLongA
CallWindowProcA
CreateWindowExA
ShowWindow
SetFocus
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
DestroyWindow
PtInRect
GetKeyState
InvalidateRect
BeginPaint
GetClientRect
EndPaint
IsWindow
GetFocus
IsChild
GetMessageA
DispatchMessageA
UnionRect
CharNextA
PostThreadMessageA
GetWindowLongA
DefWindowProcA
GetParent
GetWindowThreadProcessId
gdi32
CreateMetaFileA
SetWindowExtEx
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
TextOutA
SetTextAlign
Rectangle
RestoreDC
DeleteDC
comdlg32
GetSaveFileNameA
GetOpenFileNameA
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
ole32
CoTaskMemFree
CreateDataAdviseHolder
CoTaskMemAlloc
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoInitialize
CoUninitialize
oleaut32
LoadRegTypeLi
GetErrorInfo
SetErrorInfo
VariantChangeType
SysFreeString
SysAllocString
VariantInit
CreateErrorInfo
OleCreatePropertyFrame
VariantClear
SysStringLen
SysAllocStringLen
wndmanager
ReleaseVideoWindow
CreateVideoWindow
transmanager
CleanupApp
ReleaseTransImp
GetTransModuleImp
InitApp
atl
ord44
ord51
ord50
ord46
ord31
ord27
ord26
ord30
ord58
ord32
ord20
ord17
ord57
ord18
ord21
ord16
ord23
ord43
msvcrt
malloc
realloc
memcmp
_purecall
_mbsrchr
_except_handler3
??1type_info@@UAE@XZ
free
strstr
abs
strcmp
_access
_ftol
memcpy
time
difftime
strcat
fwrite
sprintf
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_controlfp
__set_app_type
__p__fmode
strcpy
wcslen
_CxxThrowException
__p__commode
??2@YAPAXI@Z
??3@YAXPAX@Z
strncpy
strlen
memset
__CxxFrameHandler
_snprintf
fclose
vsprintf
fprintf
fopen
msvcp60
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
winmm
timeKillEvent
timeSetEvent
timeBeginPeriod
PlaySoundA
shlwapi
PathAppendA
PathRemoveFileSpecA
PathAddBackslashA
Sections
.text Size: 108KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ