Static task
static1
Behavioral task
behavioral1
Sample
6332bb412a070de363ee59b66e1a6b6ec994296a6844d505fca5acf5eeae511e.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6332bb412a070de363ee59b66e1a6b6ec994296a6844d505fca5acf5eeae511e.exe
Resource
win10v2004-20230915-en
General
-
Target
6332bb412a070de363ee59b66e1a6b6ec994296a6844d505fca5acf5eeae511e
-
Size
936KB
-
MD5
c021b89786b1d20cb6a0532b287e01d9
-
SHA1
ca118c8c7a10ea42b266face1bdcc785f0903dd0
-
SHA256
6332bb412a070de363ee59b66e1a6b6ec994296a6844d505fca5acf5eeae511e
-
SHA512
f83211079fabab4fdad009738275cdc3ee464fb8f95d4ed4b0963cec1a367f22e05e599e4a6f413f0db06f6be273f245c7dba83524423797b594e3a2b3069f1a
-
SSDEEP
12288:Apk4KmREl54ltnNW0ucHZHk97lyKckoumF4ps0LYJmmh7tUwmuNvYJ+v6BomtCCQ:Yk4KmRElSltnNW0FhUKjdv6BoE/UdT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6332bb412a070de363ee59b66e1a6b6ec994296a6844d505fca5acf5eeae511e
Files
-
6332bb412a070de363ee59b66e1a6b6ec994296a6844d505fca5acf5eeae511e.exe windows:4 windows x86
a10717f5abc8995548165aab978e3970
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
ord410
ord412
ord413
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
gdiplus
GdipDeleteFont
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipGetSmoothingMode
GdipDrawPath
GdipFillPath
GdipDeletePath
GdipCreatePath
GdipSetSmoothingMode
GdiplusShutdown
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipDisposeImage
GdipClosePathFigure
GdipAddPathArcI
GdipLoadImageFromStream
GdiplusStartup
GdipDrawString
GdipSetTextRenderingHint
GdipReleaseDC
GdipMeasureString
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipCreateSolidFill
GdipGetDC
GdipDrawLineI
GdipCloneImage
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDeletePen
GdipCreatePen1
GdipDrawImageRectI
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushFromRectI
GdipDeleteGraphics
GdipCreateFromHDC
winhttp
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetOption
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpSetStatusCallback
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpSetTimeouts
WinHttpWriteData
urlmon
IsValidURL
crypt32
CryptUnprotectData
CryptProtectData
depot
GetDllHandle
kernel32
UnhandledExceptionFilter
GetStartupInfoW
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
HeapSize
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GlobalAlloc
GlobalFree
SetFilePointerEx
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryA
SetLastError
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
CopyFileW
InterlockedExchange
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
GetCurrentThreadId
RaiseException
GetLastError
FreeLibrary
FindResourceW
LoadResource
SizeofResource
LockResource
LoadLibraryW
GetModuleHandleW
GetProcAddress
MoveFileW
lstrlenW
GetFileAttributesW
CreateDirectoryW
DeleteFileW
GetModuleFileNameA
SetFileAttributesW
SystemTimeToFileTime
CreateFileW
SetFileTime
WideCharToMultiByte
LocalFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
WaitForSingleObjectEx
CreateThread
CloseHandle
SetEvent
ResetEvent
GetSystemTimeAsFileTime
FormatMessageW
FindResourceExW
GetProcessHeap
Sleep
HeapFree
WaitForSingleObject
GetUserDefaultUILanguage
MultiByteToWideChar
MulDiv
CreateMutexW
InitializeCriticalSection
lstrlenA
GetFullPathNameW
GetTempPathW
GetTempFileNameW
TryEnterCriticalSection
InterlockedCompareExchange
CreatePipe
DuplicateHandle
CreateProcessW
GetExitCodeProcess
GetStdHandle
SetStdHandle
TerminateProcess
ReadFile
GetSystemInfo
ResumeThread
ExitThread
GetTickCount
GetQueuedCompletionStatus
GetCurrentThread
GetProcessTimes
GetFileType
FlushFileBuffers
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
GetLocalTime
HeapReAlloc
HeapAlloc
SetErrorMode
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
user32
GetSysColor
IsWindowEnabled
InvalidateRect
TrackMouseEvent
BeginPaint
GetSysColorBrush
ScrollWindowEx
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollInfo
GetScrollInfo
PtInRect
SetCursor
RedrawWindow
DialogBoxIndirectParamW
GetDoubleClickTime
MessageBeep
PostQuitMessage
TrackPopupMenu
GetCursorPos
PostMessageW
CreatePopupMenu
SetForegroundWindow
GetWindowPlacement
IsWindowVisible
GetFocus
RegisterWindowMessageW
DestroyMenu
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
FindWindowExW
AllowSetForegroundWindow
CharNextW
ScreenToClient
GetDlgCtrlID
GetSystemMetrics
GetKeyState
KillTimer
ShowWindow
wsprintfW
CharUpperW
InflateRect
GetClassNameW
GetAncestor
FillRect
MessageBoxW
GetLastActivePopup
DestroyIcon
EnableWindow
DrawTextW
GetWindowTextLengthW
GetParent
LoadCursorW
UnregisterClassA
AppendMenuW
GetWindowTextW
SetTimer
IsWindow
GetWindow
SystemParametersInfoW
SetWindowPos
SetFocus
LoadIconW
GetDC
SetWindowTextW
ReleaseDC
CreateWindowExW
GetWindowLongW
SetWindowLongW
DestroyWindow
EndDialog
CallWindowProcW
DefWindowProcW
GetClassInfoExW
RegisterClassExW
LockWindowUpdate
GetDesktopWindow
MoveWindow
MapWindowPoints
GetWindowRect
GetDlgItem
SetDlgItemTextW
GetClientRect
SendMessageW
IsRectEmpty
EndPaint
GetNextDlgTabItem
gdi32
DeleteDC
DeleteObject
SetBkMode
SetBkColor
SetTextColor
GetObjectW
CreateFontIndirectW
SelectObject
GetLayout
SetLayout
GetStockObject
GetObjectA
RestoreDC
DPtoLP
SetWindowOrgEx
SetViewportOrgEx
ModifyWorldTransform
SetGraphicsMode
SaveDC
GetTextExtentPoint32W
GetTextMetricsW
GetPixel
BitBlt
CreateSolidBrush
GetDeviceCaps
CreateBitmap
CreateCompatibleDC
comdlg32
GetOpenFileNameW
advapi32
FreeSid
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
RegDeleteValueW
RegCreateKeyW
RegSetValueExW
CryptReleaseContext
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CheckTokenMembership
CryptCreateHash
AllocateAndInitializeSid
shell32
Shell_NotifyIconW
SHGetFolderPathA
ShellExecuteW
ShellExecuteExW
SHGetFolderLocation
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
ole32
CoCreateInstance
CoUninitialize
StringFromGUID2
CoCreateGuid
CoInitializeEx
CoTaskMemFree
oleaut32
VariantTimeToSystemTime
msvcp80
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?copy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPA_WII@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
shlwapi
StrCmpNIW
StrCmpIW
StrStrIW
msvcr80
??3@YAXPAX@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_invalid_parameter_noinfo
_recalloc
swprintf_s
?what@exception@std@@UBEPBDXZ
memcpy_s
memmove_s
??0exception@std@@QAE@XZ
free
??_V@YAXPAX@Z
_vsnwprintf_s
wcschr
wcscat_s
wcsncpy_s
wcsrchr
wcscpy_s
strrchr
isalnum
_wcsnicmp
_CxxThrowException
wcstol
tolower
_purecall
_wsplitpath_s
_time64
_beginthreadex
_wtoi
wcsncpy
_wtof
_snwprintf
wcsstr
_resetstkoflw
malloc
rand
_itow
_wtoi64
_i64tow
__RTDynamicCast
_swab
realloc
_getpid
isspace
strchr
fopen
fgets
strncmp
fclose
memset
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcsicmp
srand
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
memcpy
__CxxFrameHandler3
_snprintf
sprintf
_vswprintf_c_l
??0exception@std@@QAE@ABQBDH@Z
ws2_32
WSAStartup
iphlpapi
GetAdaptersInfo
Sections
.text Size: 680KB - Virtual size: 676KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ