Static task
static1
Behavioral task
behavioral1
Sample
f5c50cbfeb910ebe8942b78d5ab4cf58a59c6cce49fb42ae17392b68b9a316a6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f5c50cbfeb910ebe8942b78d5ab4cf58a59c6cce49fb42ae17392b68b9a316a6.exe
Resource
win10v2004-20230915-en
General
-
Target
f5c50cbfeb910ebe8942b78d5ab4cf58a59c6cce49fb42ae17392b68b9a316a6
-
Size
372KB
-
MD5
eebfbb376f69b9befc045c5654525a32
-
SHA1
a34cfc736dbf8edeb29427cd390947ab9af1a806
-
SHA256
f5c50cbfeb910ebe8942b78d5ab4cf58a59c6cce49fb42ae17392b68b9a316a6
-
SHA512
bf4cac0747053f6fd2523bdfaa466cd941f2d2e84f994ebed8a9b9ff3e376400ae49760233d000851340798e95dea1b030e16d316d71c0cdcbefa672cb151f4d
-
SSDEEP
6144:sNPnGE3VISkVovIbYG5zgTBRbt1cxgF5q4McDN7I7t+vIXD0+Ex//azStVh:sBnBObvzgTjbtmge4Mcp7IJ+QTnEx/y2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f5c50cbfeb910ebe8942b78d5ab4cf58a59c6cce49fb42ae17392b68b9a316a6
Files
-
f5c50cbfeb910ebe8942b78d5ab4cf58a59c6cce49fb42ae17392b68b9a316a6.exe windows:5 windows x86
5dc58b74a56a67ca02f5bb5ac0819db6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
dbghelp
SymInitialize
SymSetOptions
SymCleanup
SymGetModuleInfoW
SymLoadModule
wininet
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetOpenUrlA
InternetOpenA
psapi
GetModuleFileNameExW
GetModuleFileNameExA
comctl32
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx
tinyxml
?ToDocument@TiXmlDocument@@UAEPAV1@XZ
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z
?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ
?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?GetText@TiXmlElement@@QBEPBDXZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?Value@TiXmlNode@@QBEPBDXZ
?ToDocument@TiXmlDocument@@UBEPBV1@XZ
?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ
??1TiXmlDocument@@UAE@XZ
?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
??0TiXmlDocument@@QAE@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
DeviceIoControl
SetFileAttributesW
GetSystemTimeAsFileTime
GetCurrentProcess
GetProcessTimes
QueryPerformanceCounter
OutputDebugStringW
InitializeSListHead
IsProcessorFeaturePresent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
MoveFileW
GetCurrentThreadId
GetCurrentProcessId
VirtualAlloc
GetThreadSelectorEntry
WritePrivateProfileStringW
GetPrivateProfileIntW
GetFileSize
GetVersionExW
CreateDirectoryW
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
GetModuleHandleW
HeapDestroy
HeapSize
HeapReAlloc
SetErrorMode
MultiByteToWideChar
GetCommandLineW
GetTickCount
SetCurrentDirectoryW
ReadProcessMemory
WriteProcessMemory
CloseHandle
OpenProcess
GetLastError
VirtualQueryEx
CreateFileA
GetModuleFileNameW
GetWindowsDirectoryW
OpenThread
CreateThread
GetLocalTime
TerminateProcess
SetEvent
CreateProcessW
FreeLibrary
WaitForSingleObject
lstrlenW
lstrcatW
DeleteFileW
CopyFileW
LoadLibraryW
FindFirstFileW
FindNextFileW
FindClose
lstrcpyW
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
Sleep
IsDBCSLeadByte
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeResource
CreateEventW
GetFileAttributesW
CreateFileW
GetProcAddress
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
InitializeCriticalSectionAndSpinCount
RaiseException
DeleteCriticalSection
GetVolumePathNamesForVolumeNameW
FindFirstVolumeW
QueryDosDeviceW
FindNextVolumeW
FindVolumeClose
GetDiskFreeSpaceExW
GetPrivateProfileSectionW
GetSystemDefaultLCID
ReadFile
SetFilePointer
GetTempPathW
VirtualFree
user32
DrawTextW
ReleaseDC
GetGuiResources
IsWindow
CreatePopupMenu
TrackPopupMenu
DestroyMenu
DefWindowProcW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
DestroyWindow
GetMenuItemCount
GetDC
EnableWindow
SendDlgItemMessageW
SetTimer
CallWindowProcW
GetKeyState
GetWindowTextLengthW
GetDesktopWindow
PostMessageW
EnumChildWindows
GetWindowLongW
EnumWindows
GetClassNameW
BeginPaint
DialogBoxParamW
GetSystemMenu
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetWindowTextW
GetWindowThreadProcessId
DrawIconEx
GetClientRect
ShowWindow
RegisterClipboardFormatW
InvalidateRect
MapDialogRect
GetWindowRect
MapWindowPoints
SetWindowLongW
LoadImageW
SetWindowPos
SetWindowTextW
SendMessageW
LoadIconW
EndDialog
GetDlgItem
ClientToScreen
KillTimer
EndPaint
EnableMenuItem
SetDlgItemTextW
GetSysColorBrush
GetMenuItemID
gdi32
CreateFontW
SelectObject
GetStockObject
SetTextColor
SetBkMode
DeleteObject
advapi32
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
shell32
ShellExecuteW
ShellExecuteExW
ord155
SHBindToParent
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderPathW
ole32
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
DoDragDrop
oleaut32
SysAllocStringByteLen
SysFreeString
SysAllocString
SysStringLen
SysStringByteLen
gdiplus
GdiplusShutdown
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRectI
GdipDisposeImage
GdipCloneImage
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusStartup
GdipFree
GdipAlloc
shlwapi
PathFileExistsW
msvcp140
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?_BADOFF@std@@3_JB
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
crypt32
CertGetNameStringW
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvCertFromChain
WinVerifyTrust
WTHelperGetProvSignerFromChain
iphlpapi
GetAdaptersInfo
GetAdaptersAddresses
netapi32
Netbios
vcruntime140
memmove
memset
memcpy
wcsrchr
wcschr
wcsstr
memcmp
__std_terminate
__CxxFrameHandler3
strchr
strrchr
memchr
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_purecall
api-ms-win-crt-string-l1-1-0
wcscmp
_wcslwr_s
wcsncpy
wcsncmp
strnlen
wcsnlen
tolower
wmemcpy_s
wcscpy_s
_wcsicmp
iswspace
strcmp
strlen
wcscpy
wcscat
wcscat_s
wcslen
iswalpha
iswdigit
towlower
strncmp
strncpy_s
isspace
isalnum
iswalnum
api-ms-win-crt-runtime-l1-1-0
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_beginthreadex
_set_app_type
__p___wargv
__p___argc
_configure_wide_argv
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_get_wide_winmain_command_line
_controlfp_s
_initterm
_initterm_e
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_errno
_invalid_parameter_noinfo
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-stdio-l1-1-0
fclose
ftell
fseek
_wfopen
fread
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__stdio_common_vsprintf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
_set_fmode
__stdio_common_vswscanf
__p__commode
fwrite
api-ms-win-crt-convert-l1-1-0
strtoul
_wtoi
atoi
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
api-ms-win-crt-time-l1-1-0
_time64
_gmtime32
_time32
api-ms-win-crt-multibyte-l1-1-0
_mbschr
_mbsstr
_mbscmp
_mbsrchr
_mbsicmp
_mbslwr_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 147KB - Virtual size: 147KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE