Static task
static1
Behavioral task
behavioral1
Sample
076c06946cfd5d6111e3e10b9e98b0efd6e45eee4a39ab756aacabbf73a1114f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
076c06946cfd5d6111e3e10b9e98b0efd6e45eee4a39ab756aacabbf73a1114f.exe
Resource
win10v2004-20230915-en
General
-
Target
076c06946cfd5d6111e3e10b9e98b0efd6e45eee4a39ab756aacabbf73a1114f
-
Size
748KB
-
MD5
1dac25322407d1cb37c32fe1d6704656
-
SHA1
603ea45f92027d1a5ef186b38e21d21a8b8b1c3d
-
SHA256
076c06946cfd5d6111e3e10b9e98b0efd6e45eee4a39ab756aacabbf73a1114f
-
SHA512
0d1b243960b9f4fac16ebc17224a99f79e59dab37b518a1a7776342fc02af3f55cf32fb1a84c41d9ed9854d73ac2c268e5b0c603d95cb0b6157de7c00ee378e7
-
SSDEEP
12288:bXbYyahEujUY2NAcv257EvZDA3Tq5fdl+YL3YN7de74McEY2kPUPJzwyerzZruMn:bWC4p/CQEErrYF2/sYPIj6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 076c06946cfd5d6111e3e10b9e98b0efd6e45eee4a39ab756aacabbf73a1114f
Files
-
076c06946cfd5d6111e3e10b9e98b0efd6e45eee4a39ab756aacabbf73a1114f.exe windows:6 windows x86
e970e4135ca0942eeb6b4ef846acee12
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
cpprest_2_10
??1win32_encryption@details@web@@QAE@XZ
??0uri@web@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?PUT@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?to_string@_http_request@details@http@web@@UBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?set_request_uri@_http_request@details@http@web@@QAEXABVuri@4@@Z
??0_http_request@details@http@web@@QAE@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?to_string@_http_response@details@http@web@@UBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?_complete@http_msg_base@details@http@web@@UAEX_KABVexception_ptr@std@@@Z
?to_string@http_msg_base@details@http@web@@UBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?extract_string@http_msg_base@details@http@web@@QAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?set_body@http_msg_base@details@http@web@@QAEXABV?$basic_istream@E@streams@Concurrency@@_KABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0http_msg_base@details@http@web@@QAE@XZ
?POST@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
?request@http_client@client@http@web@@QAE?AV?$task@Vhttp_response@http@web@@@Concurrency@@Vhttp_request@34@ABVcancellation_token@6@@Z
??1http_client@client@http@web@@QAE@XZ
??0http_client@client@http@web@@QAE@ABVuri@3@ABVhttp_client_config@123@@Z
?PATCH@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
??Avalue@json@web@@QAEAAV012@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?serialize@value@json@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?string@value@json@web@@SA?AV123@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??4value@json@web@@QAEAAV012@$$QAV012@@Z
??0value@json@web@@QAE@XZ
?append_query_encode_impl@uri_builder@web@@AAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_string@uri_builder@web@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?append_path@uri_builder@web@@QAEAAV12@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@Z
?to_utf16string@conversions@utility@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?to_utf8string@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?utf16_to_utf8@conversions@utility@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?GET@methods@http@web@@2V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@B
yaml-cpp
??_7BadSubscript@YAML@@6B@
??6YAML@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@AAV12@ABVNode@0@@Z
??1Node@YAML@@QAE@XZ
??0Node@YAML@@AAE@AAVnode@detail@1@V?$shared_ptr@Vmemory_holder@detail@YAML@@@std@@@Z
??0Node@YAML@@QAE@ABV01@@Z
?Load@YAML@@YA?AVNode@1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?create_node@memory_holder@detail@YAML@@QAEAAVnode@23@XZ
??0memory_holder@detail@YAML@@QAE@XZ
?IsScalar@Node@YAML@@QBE_NXZ
??0InvalidNode@YAML@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0RepresentationException@YAML@@QAE@ABUMark@1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1InvalidNode@YAML@@UAE@XZ
??1BadSubscript@YAML@@UAE@XZ
?convert_to_map@node_data@detail@YAML@@AAEXABV?$shared_ptr@Vmemory_holder@detail@YAML@@@std@@@Z
?insert_map_pair@node_data@detail@YAML@@AAEXAAVnode@23@0@Z
?set_scalar@node_data@detail@YAML@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?EnsureNodeExists@Node@YAML@@ABEXXZ
?merge@memory_holder@detail@YAML@@QAEXAAV123@@Z
??0BadSubscript@YAML@@QAE@ABV01@@Z
??1memory_holder@detail@YAML@@QAE@XZ
?push_back@Node@YAML@@QAEXABV12@@Z
?AssignData@Node@YAML@@AAEXABV12@@Z
?Assign@Node@YAML@@AAEXPBD@Z
?Scalar@Node@YAML@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??0Exception@YAML@@QAE@ABV01@@Z
??0RepresentationException@YAML@@QAE@ABV01@@Z
??0Node@YAML@@QAE@XZ
??0InvalidNode@YAML@@QAE@ABV01@@Z
?mark_defined@node_data@detail@YAML@@QAEXXZ
kernel32
HeapSize
CreateFileW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
HeapFree
HeapAlloc
WriteFile
GetStdHandle
ExitProcess
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
ResetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
GetCurrentThread
TerminateProcess
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
lstrcmpW
FormatMessageW
GetLastError
CreateThread
CreateProcessA
CreateMutexA
SetCurrentDirectoryA
CreateEventW
LoadLibraryA
LockResource
FindResourceExW
LoadResource
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
FreeLibrary
GetLocalTime
GetCurrentProcessId
SystemTimeToFileTime
GetTickCount
ReadFile
GetModuleFileNameA
FindClose
GetModuleHandleA
MultiByteToWideChar
WritePrivateProfileStringA
GetModuleHandleW
WideCharToMultiByte
GetPrivateProfileStringA
Sleep
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
GetCurrentProcess
SignalObjectAndWait
WaitForSingleObjectEx
SetEvent
CreateTimerQueue
GetCPInfo
SwitchToThread
InitializeCriticalSectionAndSpinCount
SetLastError
DecodePointer
EncodePointer
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
InitOnceBeginInitialize
InitOnceComplete
GetModuleHandleExW
QueueUserWorkItem
IsProcessorFeaturePresent
GetCurrentThreadId
RaiseException
WaitForSingleObject
WriteConsoleW
GetLocaleInfoW
LCMapStringW
user32
PostMessageW
LoadIconW
MessageBoxW
MessageBoxA
shell32
ShellExecuteA
jsoncpp
?asLargestInt@Value@Json@@QBE_JXZ
?asBool@Value@Json@@QBE_NXZ
?size@Value@Json@@QBEIXZ
??AValue@Json@@QAEAAV01@H@Z
??0Reader@Json@@QAE@XZ
?parse@Reader@Json@@QAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAVValue@2@_N@Z
??0Value@Json@@QAE@ABV01@@Z
??0Value@Json@@QAE@W4ValueType@1@@Z
??1Value@Json@@QAE@XZ
?asString@Value@Json@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?asInt@Value@Json@@QBEHXZ
??AValue@Json@@QAEAAV01@PBD@Z
?asInt64@Value@Json@@QBE_JXZ
xcgui
XList_SetItemText
XList_CreateAdapter
XC_CallUiThread
XList_CreateAdapterHeader
XList_EnableMultiSel
_XWnd_RegEvent
XC_IsHELE
XList_DeleteColumnAll
XList_SetItemData
XList_SetItemTemplateXML
XList_AddItemText
XList_AddColumnText
XList_RefreshItem
XEdit_GetTextRow
XComboBox_EnableEdit
XEdit_SetText
XBtn_SetText
XEdit_EnableReadOnly
XComboBox_CreateAdapter
XComboBox_AddItemText
XComboBox_SetSelItem
XComboBox_DeleteItemAll
XWnd_RegEventC1
XComboBox_SetItemInt
XComboBox_GetSelItem
XBtn_SetCheck
XWnd_ShowWindow
XEdit_SetTextInt
XEdit_GetRowCount
XList_GetItemData
XModalWnd_EndModal
XEdit_GetText
XC_IsHWINDOW
XC_LoadLayoutZip
XEdit_EnablePassword
_XEle_RegEvent
XModalWnd_DoModal
XEdit_GetLength
XWnd_KillTimer
XEle_GetBkManager
XWidget_Show
XBkM_Clear
XWnd_Redraw
XBkM_AddImage
XWnd_GetHWND
XWnd_SetTimer
XC_GetObjectByIDName
XImage_LoadZip
XShapeText_SetText
XC_wtoa
XC_atow
XWnd_CloseWindow
XInitXCGUI
XRunXCGUI
XExitXCGUI
XC_EnableAutoExitApp
XC_LoadResourceZip
XC_SetActivateTopWindow
XWnd_AdjustLayout
ws2_32
WSACleanup
WSACreateEvent
WSASocketW
WSAStartup
inet_addr
WSAEventSelect
WSAWaitForMultipleEvents
recvfrom
WSAEnumNetworkEvents
sendto
closesocket
select
getaddrinfo
send
socket
connect
recv
freeaddrinfo
ioctlsocket
setsockopt
WSAGetLastError
Sections
.text Size: 495KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ