Static task
static1
Behavioral task
behavioral1
Sample
7ca3e1653d45d1cceefe1f7805fccc500dbc71d99c4b0a024d1a76c868eef124.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7ca3e1653d45d1cceefe1f7805fccc500dbc71d99c4b0a024d1a76c868eef124.exe
Resource
win10v2004-20230915-en
General
-
Target
7ca3e1653d45d1cceefe1f7805fccc500dbc71d99c4b0a024d1a76c868eef124
-
Size
980KB
-
MD5
2a847a0912551d1661816006136fe8ae
-
SHA1
3925182c87f838cd75e57baf566ba4951c17df04
-
SHA256
7ca3e1653d45d1cceefe1f7805fccc500dbc71d99c4b0a024d1a76c868eef124
-
SHA512
e19d7a7c7b2df5b40705e3bf652c0d7b22ba459170bd8dcbf35cbe4fb63527ee9110468e232e964dd91739ea62ea0ef046375e28e67d5404591e9e4ba2e450f6
-
SSDEEP
24576:Xi4lkgR3vlGWcWIDefy4boBzyEgRo5ouRfoZyTSHRyUfTEHRfCR:XnEAwfoaSxyUIHRqR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ca3e1653d45d1cceefe1f7805fccc500dbc71d99c4b0a024d1a76c868eef124
Files
-
7ca3e1653d45d1cceefe1f7805fccc500dbc71d99c4b0a024d1a76c868eef124.exe windows:5 windows x86
070878608c71ccb14ec443e5181caa60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
gdiplus
GdipFree
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipGetImageWidth
GdipCloneImage
GdipBitmapLockBits
GdipSaveImageToFile
GdipGetImagePaletteSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromFile
GdipDisposeImage
GdipGetImageEncodersSize
GdipAlloc
GdipDrawImageI
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImagePalette
GdipCreateBitmapFromFileICM
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
av_codec
?EncodeToJpeg@@YAHPAEHIII0HW4cJpgSize@@@Z
?ConvertToI420@@YAHIIIPAE0@Z
?aacGetEncodedDataLen@@YAHPAXH@Z
?aacDoEncodeAudio@@YAHPAXHPADH1PAH@Z
?aacStopAudioEncoder@@YAHPAX@Z
?aacInitAudioEncoder@@YAHPAPAXHW4enAudioFormat@@@Z
?InitVideoEncoder@@YAHHHPAPAX@Z
?DoEncodeVideo@@YAHPAXPAE1PAKPAW4tVFrameFlag@@2@Z
?StopVideoEncoder@@YAHPAX@Z
?g711DecodeAudioData@@YAHPBDHPAPADPAH@Z
?AjustVideoEncoder@@YAHPAXII@Z
av_matrix
?SetCaptureDevice@CAudioCaptureEx@@QAEHPAD@Z
?SetSampleRate@CAudioCaptureEx@@QAEHJ@Z
?StartCapture@CAudioCaptureEx@@QAEXXZ
?StopCapture@CAudioCaptureEx@@QAEXXZ
?SetCaptureDevice@CAudioCaptureEx@@QAEHJ@Z
?StopEncode@CAudioCaptureEx@@QAEXXZ
?GetPcmDb@CAudioCaptureEx@@QAENXZ
??0CAudioPlayer@@QAE@XZ
?IsStart@CAudioPlayer@@QAEHXZ
?Start@CAudioPlayer@@QAEHI@Z
?GetCaptureName@CAudioCaptureEx@@QAEHJPAD@Z
?GetCaptureCount@CAudioCaptureEx@@QAEHXZ
?SetAudioEvent@CAudioCaptureEx@@QAEXPAVIWinAudioEvent@@@Z
?InitCapture@CAudioCaptureEx@@QAEHH@Z
??1CAudioCaptureEx@@QAE@XZ
??0CAudioCaptureEx@@QAE@XZ
??0IWinAudioEvent@@QAE@XZ
??1IWinAudioEvent@@UAE@XZ
??0IWinVideoEvent@@QAE@XZ
??1IWinVideoEvent@@UAE@XZ
?StartEncode@CAudioCaptureEx@@QAEXXZ
?SetPTZ@CVideoCapture@@QAEHHHH@Z
??1CAudioPlayer@@UAE@XZ
?EnableNightVision@CVideoCapture@@QAEXH@Z
?EnumVideoCaptureDev_USB@CVideoCapture@@SAHXZ
?Stop@CAudioPlayer@@QAEXXZ
?SetSysLanguage@CVideoCapture@@QAEXH@Z
?SetQuality@CVideoCapture@@QAEXH@Z
?SetFrameRate@CVideoCapture@@QAEHI@Z
?GetFrameHeight@CVideoCapture@@QAEIXZ
?GetFrameWidth@CVideoCapture@@QAEIXZ
?SetCaptureFormat@CVideoCapture@@QAEHIII@Z
?CaptureOneIFrame@CVideoCapture@@QAEXXZ
?GetOneFrameImage@CVideoCapture@@QAEHPAPAEW4tJpgSize@@H@Z
?GetOneFrameYUVData@CVideoCapture@@QAEHPAPAEH@Z
?StopPutRaw@CVideoCapture@@QAEXXZ
?StartPutRaw@CVideoCapture@@QAEXXZ
?StopEncode@CVideoCapture@@QAEXXZ
?StartEncode@CVideoCapture@@QAEXXZ
?CloseCapture@CVideoCapture@@QAEXXZ
?Stop@CVideoCapture@@QAEXXZ
?Run@CVideoCapture@@QAEJXZ
?StartCapture@CVideoCapture@@QAEJI@Z
?SetVideoEncodeEvent@CVideoCapture@@QAEXPAVIWinVideoEvent@@@Z
?SetCameraIndex@CVideoCapture@@QAEXE@Z
?InitCapture@CVideoCapture@@QAEJPAUHWND__@@0I@Z
??1CVideoCapture@@QAE@XZ
??0CVideoCapture@@QAE@XZ
?GetPlayNumDevs@CAudioPlayer@@QAEHXZ
?Play@CAudioPlayer@@QAEHPADI@Z
rvs_streamer
?RvsQueryInterface@@YAHIPAPAX@Z
?RvsLog@@YAXW4enum_RVS_LOG_LEVEL@@PADHPBDZZ
libutilities
iTrd_Json_CreateNumber
?ICH_SetLogFilePathName@@YA_NPBD@Z
?ICH_StopLog@@YAXXZ
?ICH_SetLogLevel@@YAXJ@Z
?ICH_StartLog@@YAXXZ
iTrd_Json_Print
iTrd_Json_GetInteger
iTrd_Json_DePrint
iTrd_Json_GetString
iTrd_Json_AddItemToArray
iTrd_Json_CreateString
iTrd_Json_GetObjectItem
iTrd_Json_Parse
iTrd_Json_GetArraySize
iTrd_Json_CreateObject
iTrd_Json_Delete
iTrd_Json_AddItemToObject
iTrd_Json_CreateArray
iTrd_Json_GetArrayItem
?ICH_WriteLog@@YAXJPBDJ0ZZ
mfc90u
ord2633
ord2638
ord2621
ord2623
ord2625
ord2619
ord2635
ord2615
ord971
ord969
ord960
ord5683
ord5685
ord6466
ord1728
ord2646
ord2645
ord2647
ord2644
ord2643
ord4702
ord5154
ord3743
ord4603
ord6800
ord5512
ord2074
ord4664
ord1493
ord4345
ord4910
ord1751
ord1186
ord1155
ord1137
ord1675
ord639
ord5663
ord5680
ord4347
ord5674
ord3217
ord2087
ord1098
ord266
ord1440
ord5209
ord4109
ord5293
ord5296
ord4378
ord4800
ord4805
ord4802
ord4820
ord4823
ord4807
ord5418
ord5214
ord4622
ord5224
ord4865
ord4866
ord3681
ord4693
ord5016
ord4596
ord4589
ord6410
ord3354
ord3670
ord589
ord6482
ord4213
ord5830
ord6741
ord5548
ord1048
ord4527
ord6035
ord2206
ord2251
ord4747
ord6803
ord4173
ord6801
ord4967
ord4211
ord2447
ord6018
ord4996
ord5676
ord4423
ord794
ord4043
ord4448
ord1220
ord2969
ord1753
ord1686
ord5656
ord5616
ord5349
ord4945
ord4946
ord5356
ord4987
ord5487
ord4861
ord4789
ord2617
ord5279
ord5407
ord4955
ord4904
ord5408
ord4942
ord5105
ord5384
ord5228
ord436
ord4797
ord4798
ord5400
ord5230
ord5142
ord4785
ord5239
ord5491
ord5401
ord5079
ord5382
ord4933
ord5397
ord683
ord4810
ord4549
ord1376
ord2194
ord4550
ord4681
ord4905
ord4348
ord2891
ord4071
ord4081
ord4080
ord2764
ord2893
ord2774
ord3115
ord2966
ord4728
ord3112
ord2983
ord2771
ord801
ord2640
ord2630
ord2375
ord3140
ord2368
ord1641
ord6802
ord1088
ord4174
ord6804
ord5404
ord6604
ord5938
ord6780
ord6635
ord3830
ord4009
ord3736
ord333
ord595
ord1727
ord5625
ord1442
ord2901
ord2904
ord6579
ord4543
ord6065
ord4398
ord2360
ord6275
ord3682
ord4516
ord1486
ord2612
ord2610
ord2628
ord967
ord965
ord4741
ord4774
ord5664
ord2069
ord5602
ord797
ord1754
ord6411
ord3355
ord3286
ord1108
ord2596
ord3543
ord1354
ord2106
ord1254
ord3537
ord3654
ord1719
ord2283
ord778
ord4660
ord3515
ord374
ord1809
ord1810
ord2208
ord5008
ord5324
ord5167
ord4631
ord5653
ord4682
ord1492
ord6408
ord3353
ord5632
ord5182
ord4000
ord404
ord3729
ord5535
ord3187
ord5770
ord4927
ord1688
ord1272
ord2100
ord2271
ord1063
ord3622
ord525
ord2971
ord6095
ord6547
ord4541
ord4410
ord6558
ord899
ord5767
ord6811
ord5778
ord6822
ord3674
ord3741
ord4530
ord6311
ord3637
ord3589
ord636
ord1255
ord1256
ord1243
ord586
ord3753
ord1047
ord2123
ord790
ord1678
ord686
ord3488
ord2702
ord5851
ord6376
ord6577
ord1261
ord320
ord2084
ord1313
ord2326
ord6813
ord1552
ord663
ord6187
ord2470
ord524
ord744
ord1250
ord2478
ord4044
ord3528
ord654
ord1599
ord2504
ord1183
ord1938
ord265
ord430
ord2537
ord4131
ord909
ord2694
ord3185
ord296
ord280
ord286
ord1533
ord1496
ord4319
ord3496
ord1667
ord2277
ord4510
ord1601
ord2103
ord615
ord4654
ord1937
ord2909
ord2593
ord2597
ord5497
ord6476
ord290
ord3486
ord3794
ord1353
ord367
ord2097
ord6091
ord1314
ord2695
ord4324
ord813
ord935
ord938
ord1603
ord6659
ord5979
ord6687
ord4405
ord799
ord4707
ord1248
ord600
ord811
ord4442
ord6630
ord1607
ord285
ord3220
ord5650
ord1791
ord1792
ord2139
ord4179
ord3226
ord2592
msvcr90
__CxxFrameHandler3
_strdup
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
abort
_endthreadex
strchr
_errno
realloc
tolower
strncmp
_mktime64
strerror
abs
_wcsnicmp
_fdopen
_open_osfhandle
setvbuf
wcslen
__iob_func
fseek
ftell
fopen_s
fputs
fputc
_purecall
_beginthreadex
fwrite
_i64toa
ferror
fclose
strrchr
strcmp
fprintf
fread
fopen
sscanf
wcsncpy
wcscat
wcscpy
ldiv
_snprintf
islower
isdigit
strcat
labs
_time64
_wtol
memcpy_s
srand
rand
memset
_recalloc
strncpy
wprintf
atoi
_resetstkoflw
strcpy
strstr
strlen
_localtime64_s
malloc
_swprintf
calloc
free
memcmp
memmove
_atoi64
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
sprintf
memmove_s
memcpy
printf
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
_CxxThrowException
kernel32
ResumeThread
CreateDirectoryW
OutputDebugStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetLastError
GetLocalTime
CloseHandle
GlobalMemoryStatus
lstrlenA
FreeLibrary
WaitForSingleObject
GetTickCount
SetThreadUILanguage
GlobalAlloc
WideCharToMultiByte
LoadLibraryW
CopyFileW
GetVersionExW
LeaveCriticalSection
lstrcpynW
IsProcessorFeaturePresent
GetFileAttributesW
CreateFileW
MultiByteToWideChar
lstrlenW
CreateDirectoryA
InterlockedExchange
SetThreadLocale
GetProcAddress
EnterCriticalSection
GlobalFree
DeviceIoControl
GetSystemInfo
GetUserDefaultUILanguage
WinExec
DeleteFileW
SetFileAttributesW
CreateThread
InitializeCriticalSection
DeleteCriticalSection
GetSystemPowerStatus
RaiseException
CreateFileA
IsDebuggerPresent
UnhandledExceptionFilter
GetSystemTimeAsFileTime
QueryPerformanceCounter
InterlockedCompareExchange
lstrcpyW
SetLastError
GetModuleHandleW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetStdHandle
GetStartupInfoW
GetModuleFileNameW
TerminateProcess
OpenProcess
CreateProcessW
AllocConsole
OutputDebugStringA
FreeResource
CreateMutexW
CreateEventW
LockResource
ResetEvent
GlobalUnlock
MulDiv
SizeofResource
SetEvent
GlobalLock
LoadResource
FindResourceW
ReadFile
WriteFile
CreateNamedPipeW
ReleaseMutex
Sleep
GetTempPathA
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
LoadLibraryA
GetCurrentProcess
SetUnhandledExceptionFilter
user32
GetMessageW
RegisterHotKey
DestroyMenu
SendMessageW
UnregisterHotKey
CreatePopupMenu
InsertMenuW
PostMessageW
FindWindowW
wsprintfW
GetClassInfoW
TranslateMessage
EnableWindow
GetSystemMetrics
SetRect
MessageBeep
InflateRect
CopyImage
LoadBitmapW
SetRectEmpty
DrawFrameControl
SetCapture
CopyIcon
DestroyCursor
GetCursor
ReleaseCapture
DefWindowProcW
IsWindowVisible
FillRect
GetDC
DispatchMessageW
ReleaseDC
GetSysColor
CopyRect
GetKeyState
SetCursor
LoadCursorW
PtInRect
DrawTextW
GetParent
GetDlgCtrlID
InvalidateRect
GetSystemMenu
SetTimer
GetWindowRect
LockWorkStation
TrackPopupMenu
RegisterWindowMessageW
IsIconic
LoadImageW
KillTimer
SetForegroundWindow
DrawIcon
GetClientRect
LoadIconW
OffsetRect
GetWindowLongW
AppendMenuW
SetWindowLongW
RegisterDeviceNotificationW
SetWindowPos
GetCursorPos
LoadStringW
gdi32
GetDeviceCaps
GetPixel
PlgBlt
Rectangle
CreateCompatibleBitmap
PtInRegion
SetBkColor
GetCurrentObject
CreatePolygonRgn
GetTextExtentPoint32W
CreateSolidBrush
CreateFontIndirectW
BitBlt
PatBlt
SetPixel
CreateBitmap
DeleteDC
CreateDIBSection
StretchBlt
SetDIBColorTable
DeleteObject
SelectObject
CreateCompatibleDC
GetDIBColorTable
GetObjectW
GetStockObject
FillRgn
CreateFontW
msimg32
AlphaBlend
TransparentBlt
advapi32
RegQueryValueW
RegQueryValueExA
RegQueryValueExW
RegCreateKeyExA
RegOpenKeyExA
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegDeleteValueW
RegSetValueExW
RegCloseKey
RegSetValueExA
shell32
SHFileOperationW
SHBrowseForFolderW
ShellExecuteW
SHGetFolderPathA
SHGetFolderPathW
SHGetPathFromIDListW
Shell_NotifyIconW
comctl32
ord8
ImageList_Add
_TrackMouseEvent
ord17
InitCommonControlsEx
shlwapi
PathIsDirectoryA
PathFindExtensionW
StrStrIW
PathIsDirectoryW
ole32
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
oleaut32
SysFreeString
OleLoadPicture
msvcp90
?length@?$char_traits@D@std@@SAIPBD@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?width@ios_base@std@@QAEHH@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?uncaught_exception@std@@YA_NXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
winmm
mciGetErrorStringW
mciSendCommandW
ws2_32
htons
connect
WSACleanup
htonl
ntohl
WSAStartup
closesocket
WSAGetLastError
send
gethostbyname
recv
socket
Sections
.text Size: 434KB - Virtual size: 433KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 211KB - Virtual size: 222KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 195KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ