Static task
static1
Behavioral task
behavioral1
Sample
e89e2e5e7163721ff9cfecfb991428fc2e2723f246624bdc5b82ccb3951ea641.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e89e2e5e7163721ff9cfecfb991428fc2e2723f246624bdc5b82ccb3951ea641.exe
Resource
win10v2004-20230915-en
General
-
Target
e89e2e5e7163721ff9cfecfb991428fc2e2723f246624bdc5b82ccb3951ea641
-
Size
6.3MB
-
MD5
a488999f8c1623cf009937847d9dc6a6
-
SHA1
581fe702b2ffe68a109033acbe3a28dc2532ba0e
-
SHA256
e89e2e5e7163721ff9cfecfb991428fc2e2723f246624bdc5b82ccb3951ea641
-
SHA512
a99eba72c1c53f21247f5b1d6a3bb7919037f3f1a04739c5d1d552f60ed0b6097c6e198ee88c7a88c3dc42eeb0eef8878c6d389d63c9494e57b4ea6e221c5f16
-
SSDEEP
196608:7CVQrGXMTO4IJErPClwon81bQTnQJjiKrvgh+Cg:OVQ9CzJflzn4zaRg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e89e2e5e7163721ff9cfecfb991428fc2e2723f246624bdc5b82ccb3951ea641
Files
-
e89e2e5e7163721ff9cfecfb991428fc2e2723f246624bdc5b82ccb3951ea641.exe windows:5 windows x86
5c4436a7b2572b189c2f1fca5aef48f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetSetOptionW
HttpQueryInfoW
InternetReadFile
InternetCrackUrlW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetCloseHandle
InternetOpenW
kernel32
WriteFile
lstrlenW
CreateFileA
SetFilePointer
DeviceIoControl
InterlockedIncrement
InterlockedDecrement
lstrcpyW
GetACP
GetCurrentDirectoryW
GetModuleHandleW
FreeResource
GetFileType
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
SetFileTime
MulDiv
GetLocalTime
InterlockedCompareExchange
lstrlenA
GetDiskFreeSpaceExW
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
ExitProcess
CloseHandle
GetLastError
CreateProcessW
CopyFileW
GetCurrentThreadId
GetCurrentProcessId
GetTempPathW
GetModuleFileNameW
LocalFree
GetCurrentProcess
InterlockedExchange
GetExitCodeProcess
WaitForSingleObject
GetVersionExW
GetNativeSystemInfo
DeleteFileW
Sleep
CreateDirectoryW
MultiByteToWideChar
InitializeCriticalSection
DeleteCriticalSection
GetTickCount
OutputDebugStringW
RemoveDirectoryW
MoveFileExW
GetSystemDirectoryW
LocalAlloc
HeapFree
HeapAlloc
GetProcessHeap
FreeLibrary
LoadLibraryW
EndUpdateResourceW
UpdateResourceW
BeginUpdateResourceW
ReadFile
GetFileSize
CreateFileW
LockResource
SizeofResource
LoadResource
FindResourceW
OpenProcess
GetProcAddress
LoadLibraryA
Process32NextW
GetSystemTimeAsFileTime
QueryFullProcessImageNameW
Process32FirstW
CreateToolhelp32Snapshot
FindClose
TerminateProcess
FindNextFileW
FindFirstFileW
GetFileAttributesW
WideCharToMultiByte
user32
SetWindowTextW
PostMessageW
SetCursor
LoadCursorW
wvsprintfW
DispatchMessageW
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
ExitWindowsEx
MessageBoxW
PostQuitMessage
InflateRect
OffsetRect
GetWindowLongW
SetWindowLongW
SetWindowPos
LoadStringW
wsprintfW
FindWindowW
GetWindowThreadProcessId
ShowWindow
CreateAcceleratorTableW
MoveWindow
InvalidateRgn
GetWindowTextLengthW
GetWindowTextW
GetSysColor
ClientToScreen
SetCaretPos
ShowCaret
HideCaret
CreateCaret
SetRect
CharPrevW
DrawTextW
FillRect
IntersectRect
CharNextW
SetWindowRgn
IsZoomed
IsIconic
GetClassInfoExW
RegisterClassExW
RegisterClassW
SetPropW
GetPropW
CallWindowProcW
GetSystemMetrics
LoadImageW
MonitorFromWindow
GetMonitorInfoW
EnableWindow
GetKeyState
DefWindowProcW
GetMessageW
GetParent
GetCursorPos
ScreenToClient
GetWindow
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
GetWindowRect
MapWindowPoints
CreateWindowExW
GetFocus
SetFocus
DestroyWindow
ReleaseDC
PtInRect
ReleaseCapture
SetCapture
IsWindow
KillTimer
SetTimer
InvalidateRect
GetClientRect
GetDC
SendMessageW
gdi32
GetObjectA
GetDeviceCaps
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
SetBkMode
SetTextColor
RoundRect
CreatePenIndirect
MoveToEx
LineTo
CreateSolidBrush
SetBkColor
ExtTextOutW
SetStretchBltMode
CreateDIBSection
StretchBlt
CombineRgn
GetClipBox
CreateRectRgnIndirect
ExtSelectClipRgn
SelectClipRgn
CreateRoundRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
SaveDC
BitBlt
RestoreDC
Rectangle
SetWindowOrgEx
DeleteDC
CreatePen
GetStockObject
GetObjectW
CreateFontIndirectW
DeleteObject
SelectObject
GetTextMetricsW
advapi32
LookupPrivilegeValueW
OpenProcessToken
DeregisterEventSource
RegDeleteKeyValueW
RegOpenKeyExW
RegQueryValueExW
DuplicateTokenEx
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegCreateKeyExW
RegSetValueExW
RegCloseKey
StartServiceW
EnumDependentServicesW
ControlService
QueryServiceStatusEx
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ChangeServiceConfigW
RegisterEventSourceW
ReportEventW
AdjustTokenPrivileges
shell32
CommandLineToArgvW
ord165
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHCreateDirectoryExW
SHFileOperationW
ShellExecuteW
SHBrowseForFolderW
SHGetFolderPathW
SHGetSpecialFolderPathW
ole32
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
CoCreateGuid
CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
msvcp90
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?capacity@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI_W@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
??7ios_base@std@@QBE_NXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PB_WHH@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
gdiplus
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipCreateLineBrushI
GdiplusStartup
GdipDrawString
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCreateStringFormat
GdipDeleteStringFormat
GdipDeleteFont
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipCloneBrush
GdiplusShutdown
GdipDeleteGraphics
comctl32
_TrackMouseEvent
ord17
msvcr90
toupper
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
_CxxThrowException
_beginthreadex
__CxxFrameHandler3
??2@YAPAXI@Z
??3@YAXPAX@Z
wcscpy_s
printf
_local_unwind4
_wsplitpath
rand
srand
memcpy
_wtoi64
_wcsicmp
_close
?_wsopen@@YAHPB_WHHH@Z
_wrename
wcsrchr
memmove_s
isalnum
iswalnum
malloc
free
sprintf_s
fprintf
abort
modf
strchr
_finite
sprintf
strstr
realloc
wcstol
wcsncpy
tolower
_wfopen
fwrite
memmove
_vsnprintf_s
isalpha
isspace
strncmp
wcschr
wcslen
wcscat
wcscpy
strlen
wcscmp
_wcsupr
_wcslwr
??0exception@std@@QAE@ABQBD@Z
isdigit
wcstoul
_gmtime64
calloc
strcmp
strcpy
memcmp
wcsncmp
abs
_lrotl
strcpy_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_vsnwprintf
_vswprintf
wcsstr
_wfopen_s
fseek
ftell
rewind
fread
fclose
??_V@YAXPAX@Z
_wcsdup
swprintf_s
memset
_swprintf
_waccess
_wtoi
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_purecall
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
shlwapi
SHDeleteKeyW
PathCombineW
PathFileExistsW
iphlpapi
GetAdaptersInfo
ws2_32
ntohl
ntohs
htonl
htons
Sections
.text Size: 612KB - Virtual size: 611KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 89.3MB - Virtual size: 89.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ