Static task
static1
Behavioral task
behavioral1
Sample
idat.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
idat.exe
Resource
win10v2004-20230915-en
General
-
Target
idat.exe
-
Size
1.6MB
-
MD5
25a7418e4c8f36d2ddbe660523f60dae
-
SHA1
6a6c446d92364886cdd75cff0397ba0e78f672b5
-
SHA256
62909823f1a52bd8d7dff649b1ad51846fa24ce3ac3ca79809d20bfa3a9fb92c
-
SHA512
2cd8f49865188aca6eebf3e58c43a6f772279d30ec4e4fb21525ea27199cf2a9a5081ba33807c6138809126a085c0ce19055b7c48c4a617cf0a28ed1b82219f2
-
SSDEEP
49152:/Ha4lNgRK7jwMeBDLQ/Ymfyxkvr0TcKnoi2omYF:/ERKvsDvD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource idat.exe
Files
-
idat.exe.exe windows:6 windows x64
557d28ef6c183c267d036c9602633f51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ida
simpleline_place_t__serialize
simpleline_place_t__deserialize
simpleline_place_t__id
simpleline_place_t__name
simpleline_place_t__toea
simpleline_place_t__enter
simpleline_place_t__leave
simpleline_place_t__rebase
idaplace_t__print
idaplace_t__touval
idaplace_t__clone
idaplace_t__copyfrom
idaplace_t__makeplace
idaplace_t__compare
idaplace_t__compare2
idaplace_t__adjust
idaplace_t__prev
idaplace_t__next
idaplace_t__beginning
idaplace_t__ending
idaplace_t__generate
idaplace_t__serialize
idaplace_t__deserialize
idaplace_t__id
idaplace_t__name
idaplace_t__toea
idaplace_t__enter
idaplace_t__leave
idaplace_t__rebase
internal_register_place_class
register_loc_converter2
str2ea_ex
b2a_width
b2a32
b2a64
netnode_valobj
netnode_set
netnode_delblob
netnode_exist
dbg_get_input_path
tag_on
tag_off
calc_prefix_color
install_user_defined_prefix
prev_head
is_loaded
visit_patched_bytes
del_items
get_default_radix
create_data
get_opinfo
set_opinfo
get_custom_data_format
find_custom_data_format
update_hidden_range
add_hidden_range
get_hidden_range
add_func_ex
calc_thunk_func_target
realtoasc
eadd
ecmp
lock_segm
setup_selector
sel2para
add_segm_ex
del_segm
get_next_seg
get_first_seg
set_segm_end
set_segm_start
move_segm_start
change_segment_status
take_memory_snapshot
is_miniidb
set_segm_base
set_segm_name
get_segm_name
get_segm_class
set_segm_class
get_segm_base
set_segm_addressing
update_segm
get_dtype_size
create_insn
bitrange_t_extract_using_bitrange
bitrange_t_inject_using_bitrange
parse_config_value
is_ret_insn
get_ash
str2reg
set_processor_type
set_dbgmem_source
invalidate_dbgmem_config
is_debugger_on
is_debugger_memory
inform_idc_about_debthread
set_dbg_pointer
get_loader_name
get_debugger_plugins
is_trusted_idb
set_path
is_database_ext
reg_delete
qerrcode
auto_mark_range
eval_expr
set_debug_name
del_debug_names
get_debug_names
demangle_name
get_spd
get_fixups
get_struc_size
get_struc_next_offset
get_struc_first_offset
get_member
get_member_by_name
get_member_name
read_ioports
open_linput
gen_decorate_name
code_highlight_block
errorexit
get_fchunk
lnar_size
get_entry_qty
get_entry_ordinal
get_entry
get_entry_name
extend_sign
enumplace_t__print
enumplace_t__touval
enumplace_t__clone
enumplace_t__copyfrom
enumplace_t__makeplace
enumplace_t__compare
enumplace_t__compare2
enumplace_t__adjust
enumplace_t__prev
enumplace_t__next
enumplace_t__beginning
enumplace_t__ending
enumplace_t__generate
enumplace_t__serialize
enumplace_t__deserialize
enumplace_t__id
enumplace_t__name
enumplace_t__toea
enumplace_t__enter
enumplace_t__leave
enumplace_t__rebase
num2str_uint64
numop2str
get_radix
get_module_data
get_enum_qty
getn_enum
get_enum_idx
get_enum
is_bf
get_enum_name2
get_enum_width
set_enum_width
get_enum_cmt
get_enum_flag
get_enum_member_by_name
get_enum_member_value
get_enum_member_enum
get_enum_member_bmask
get_enum_member
get_first_bmask
get_last_bmask
get_next_bmask
get_first_enum_member
get_last_enum_member
get_enum_member_name
get_enum_member_cmt
get_first_serial_enum_member
get_last_serial_enum_member
get_next_serial_enum_member
get_enum_member_serial
add_enum
del_enum
set_enum_idx
set_enum_bf
set_enum_name
set_enum_cmt
set_enum_flag
add_enum_member
del_enum_member
set_enum_member_name
set_bmask_name
get_bmask_name
set_bmask_cmt
get_bmask_cmt
resolve_typedef
get_named_type
import_type
clear_tinfo_t
get_tinfo_pdata
deserialize_tinfo
begin_type_updating
end_type_updating
choose_named_type
skip_utf8
get_undo_state
linearray_t_ending
linearray_t_down
qstrftime64
qtime64
qexit
set_database_flag
get_license_attr
llong_scan
memrev
strrpl
get_dbctx_id
is_ident
get_segm_by_sel
ea2str
str2ea
atos
num2str_uint32
reg_delete_subkey
clr_abits
get_aflags
lock_func_range
getn_func
get_func_qty
get_func_num
get_prev_func
del_func
set_func_start
set_func_end
reanalyze_function
find_func_bounds
calc_func_size
append_func_tail
remove_func_tail
func_parent_iterator_set
get_first_fcref_to
get_next_fcref_to
reanalyze_callers
get_std_dirtree
set_name
set_frame_size
get_frame_retsize
update_fpd
get_root_filename
gen_flow_graph
gen_simple_call_chart
setup_graph_subsystem
convert_encoding
get_encoding_name
get_default_encoding_idx
tag_remove
next_addr
prev_addr
prev_not_tail
nbits
get_wide_byte
patch_byte
hexplace_t__print
hexplace_t__touval
hexplace_t__clone
hexplace_t__copyfrom
hexplace_t__makeplace
hexplace_t__compare
hexplace_t__compare2
hexplace_t__adjust
hexplace_t__prev
hexplace_t__next
hexplace_t__beginning
hexplace_t__ending
hexplace_t__generate
hexplace_t__serialize
hexplace_t__deserialize
hexplace_t__id
hexplace_t__name
hexplace_t__toea
hexplace_t__enter
hexplace_t__leave
hexplace_t__rebase
hexplace_t__out_one_item
hexplace_t__ea2str
lookup_loc_converter2
create_outctx
asctoreal
segtype
base2file
enable_auto
launch_process
get_tinfo
prev_visea
get_next_func
set_target_assembler
get_plugins
invoke_plugin
get_undo_param
set_undo_param
register_undo_handler
cancel_undo_point
get_undo_action_label
get_redo_action_label
perform_undo
perform_redo
reset_undo
get_undo_info
lochist_t_current_index
lochist_t_size
is_varmember
make_name_auto
copy_tinfo_t
print_tinfo
calc_func_metadata
extract_type_from_metadata
get_server_connection
apply_metadata
revert_metadata
has_backup_metadata
get_import_module_qty
get_import_module_name
enum_import_names
qthread_self
qthread_equal
is_main_thread
qfopen
qflush
switch_dbctx
netnode_supdel
add_encoding
get_encoding_bpu
init_database
get_place_class
get_dirty_infos
set_module_data
clr_module_data
create_undo_point
get_strlist_options
qunlink
build_loaders_list
free_loaders_list
get_loader_name_from_dll
load_binary_file
load_nonbinary_file
process_archive
get_basic_file_type
get_file_type_name
get_idp_descs
set_default_dataseg
qstrncat
sanitize_file_name
qisdir
swap_value
show_auto
auto_is_ok
call_system
get_outfile_encoding_idx
get_wide_word
get_original_byte
get_original_word
patch_word
patch_bytes
can_define_item
parse_binpat_str
print_fpval
get_func_chunknum
plan_to_apply_idasgn
gen_file
load_ids_module
find_plugin
run_plugin
get_fileregion_offset
reload_file
build_snapshot_tree
update_snapshot_attributes
idcv_object
set_idcv_attr
add_idc_gvar
for_all_extlangs
compile_idc_file
call_idc_func
get_snippet_api
interr_should_throw
netnode_get_name
ea2node
node2ea
get_strid
get_final_alignment
get_refinfo
tag_skipcode
is_off
is_stkvar
get_immvals
get_frame
is_valid_cp
extract_name
notify_dirtree
lochist_t_clear
bookmarks_t_get
bookmarks_t_get_desc
bookmarks_t_set_desc
bookmarks_t_size
bookmarks_t_erase
bookmarks_t_get_dirtree_id
get_fileregion_ea
calc_reference_data
allocate_selector
find_selector
get_segm_num
get_prev_seg
get_last_seg
move_segm
set_segment_translations
get_segment_translations
get_segment_alignment
get_segment_combination
get_segm_para
get_view_options
dto_copy_from_inf
atob64
get_item_color
get_custom_data_type_ids
get_op_tinfo
get_encoding_qty
rename_encoding
set_default_encoding_idx
is_invsign
is_bnot
is_defarg
is_suspop
print_strlit_type
get_custom_data_type
get_cmt
add_mapping
del_mapping
get_mappings_qty
get_mapping
print_optype_description
read_regargs
format_charlit
cfg_get_cc_parm
is_problem_present
get_struc_name
simpleline_place_t__generate
reorder_dummy_names
get_sreg
get_fixup
get_next_fixup_ea
get_fixup_desc
idcv_string
print_idcv
cleanup_argloc
get_compilers
set_compiler
get_abi_name
get_tinfo_details
get_tinfo_property
dump_func_type_data
calc_default_sizeof_ldbl
next_not_tail
next_visea
bin_search2
xrefblk_t_first_to
xrefblk_t_next_to
get_func_name
get_problem_desc
get_problem
forget_problem
get_problem_name
find_error
find_notype
find_unknown
find_defined
find_suspop
find_data
find_code
find_not_func
find_imm
search
prev_utf8_char
rangeset_t_intersect
set_abits
set_visible_segm
get_segment_cmt
set_segment_cmt
update_extra_cmt
get_extra_cmt
delete_extra_cmts
get_qword
get_wide_dword
get_manual_insn
set_manual_insn
set_forced_operand
get_forced_operand
set_cmt
getn_hidden_range
get_hidden_range_qty
get_next_hidden_range
shell32
ShellExecuteExA
ws2_32
setsockopt
sendto
recvfrom
htons
bind
socket
WSAStartup
WSACleanup
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
SysStringLen
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
user32
GetKeyboardState
MessageBeep
WinHelpA
WinHelpW
IsWindow
ShowWindow
IsIconic
mouse_event
GetForegroundWindow
SetForegroundWindow
GetWindowRect
FindWindowW
MessageBoxA
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetClipboardData
IsClipboardFormatAvailable
kernel32
FillConsoleOutputCharacterA
GetModuleFileNameA
GetProcAddress
LoadLibraryW
MultiByteToWideChar
WaitForSingleObject
Sleep
GetExitCodeProcess
GetVersion
GetModuleHandleW
GetConsoleTitleW
RaiseException
SetConsoleTitleW
SleepEx
CreateFileA
DeleteFileA
CloseHandle
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetLocalTime
VirtualAlloc
FreeLibrary
GlobalAlloc
GlobalLock
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetConsoleCtrlHandler
WriteConsoleInputA
GetNumberOfConsoleMouseButtons
SetConsoleMode
ReadConsoleInputW
ReadConsoleInputA
ReadConsoleA
PeekConsoleInputA
GetConsoleMode
ReadConsoleOutputA
SetFileApisToOEM
GlobalFree
GetTickCount
GetStdHandle
WriteConsoleOutputW
WriteConsoleOutputA
SetConsoleOutputCP
SetConsoleCP
GetConsoleOutputCP
SetConsoleWindowInfo
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleScreenBufferSize
GetConsoleCursorInfo
GetLargestConsoleWindowSize
GetConsoleScreenBufferInfo
FillConsoleOutputAttribute
GlobalUnlock
GetNumberOfConsoleInputEvents
FlushConsoleInputBuffer
WaitForMultipleObjects
GetModuleHandleA
GetLogicalDrives
GetFileAttributesA
vcruntime140
_purecall
__std_terminate
strchr
strstr
_CxxThrowException
__CxxFrameHandler3
memmove
memcpy
__std_exception_destroy
__std_exception_copy
memchr
memcmp
__C_specific_handler
strrchr
memset
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
abort
exit
_register_thread_local_exe_atexit_callback
_c_exit
__p___wargv
__p___argc
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
terminate
_cexit
_errno
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
strspn
isxdigit
islower
strcmp
isalnum
tolower
toupper
ispunct
isdigit
isupper
isalpha
towupper
strpbrk
_towlower_l
strncmp
isspace
_strnicmp
_stricmp
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
strtol
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__acrt_iob_func
__stdio_common_vfprintf
ferror
__p__commode
_getcwd
api-ms-win-crt-filesystem-l1-1-0
_getdrive
_chdrive
_chdir
_splitpath
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-locale-l1-1-0
_create_locale
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 422KB - Virtual size: 421KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ