Static task
static1
Behavioral task
behavioral1
Sample
072d1c0e701edb4c9ab1ce41d4c283d2c7ce1a485714ad869850bdb25de6c38a.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
072d1c0e701edb4c9ab1ce41d4c283d2c7ce1a485714ad869850bdb25de6c38a.exe
Resource
win10v2004-20230915-en
General
-
Target
072d1c0e701edb4c9ab1ce41d4c283d2c7ce1a485714ad869850bdb25de6c38a
-
Size
1.8MB
-
MD5
2237bd7e826638351ce957fee4976d5f
-
SHA1
4079da7e8a9304630dcad0b7a22f32db468cf3cd
-
SHA256
072d1c0e701edb4c9ab1ce41d4c283d2c7ce1a485714ad869850bdb25de6c38a
-
SHA512
a3d87c568d88f5ab6a4dca4c66fa8dfada418acf852c7c7f145db29d90a28783b4694e587d1d41a24db982d59fea25bc09baf36d41f6d21baa0a9907da32e61f
-
SSDEEP
49152:rAPLifHLwIxpgeShwTlAAaqZWowRb/gPb:0DeSM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 072d1c0e701edb4c9ab1ce41d4c283d2c7ce1a485714ad869850bdb25de6c38a
Files
-
072d1c0e701edb4c9ab1ce41d4c283d2c7ce1a485714ad869850bdb25de6c38a.exe windows:6 windows x64
5dcc79b5cf37762cb7fc183af9f3229d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
DeleteCriticalSection
CreateFileW
GetFileSizeEx
ReadFile
WriteFile
CloseHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemInfo
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
GetLocalTime
WaitForSingleObject
VirtualAlloc
VirtualFree
GetLastError
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitOnceBeginInitialize
InitOnceComplete
GetCPInfoExW
InitializeCriticalSectionEx
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
OutputDebugStringA
GetModuleHandleW
FindResourceW
LoadResource
LockResource
LeaveCriticalSection
SizeofResource
user32
KillTimer
SendMessageW
IsIconic
EnumWindows
IsWindowVisible
SetTimer
SetCursorPos
DefWindowProcW
PostMessageW
GetWindowRect
SetWindowPos
SetWindowLongPtrW
EnumDisplayMonitors
CreateWindowExW
GetWindowLongPtrW
RegisterClassExW
ShowWindow
GetMonitorInfoW
LoadIconW
UpdateLayeredWindow
PostQuitMessage
UpdateWindow
GetMessageW
SetCursor
MessageBoxW
SetClipboardData
LoadCursorW
EmptyClipboard
CloseClipboard
GetDC
OpenClipboard
DispatchMessageW
TranslateMessage
GetWindowTextLengthW
GetSystemMetrics
ReleaseDC
dwmapi
DwmGetWindowAttribute
DwmSetWindowAttribute
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
gdi32
GetDIBits
SetDIBits
BitBlt
CreateCompatibleBitmap
DeleteObject
DeleteDC
StretchBlt
CreateCompatibleDC
SelectObject
ole32
CoTaskMemFree
CoCreateInstance
msvcp140
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?id@?$numpunct@_W@std@@2V0locale@2@A
_Xtime_get_ticks
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mbrtowc
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$numpunct@D@std@@2V0locale@2@A
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__RTDynamicCast
_CxxThrowException
__std_exception_destroy
__current_exception_context
__current_exception
__std_exception_copy
__C_specific_handler
memcpy
__std_terminate
_purecall
memset
memcmp
memmove
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_exit
_invalid_parameter_noinfo_noreturn
_c_exit
_register_thread_local_exe_atexit_callback
_configure_wide_argv
_get_wide_winmain_command_line
abort
terminate
_seh_filter_exe
_beginthreadex
_cexit
_set_app_type
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_wide_environment
api-ms-win-crt-heap-l1-1-0
free
calloc
realloc
_set_new_mode
malloc
_callnewh
api-ms-win-crt-string-l1-1-0
strnlen
toupper
api-ms-win-crt-math-l1-1-0
cbrt
tan
_fdclass
sqrt
sqrtf
cos
atan2
_dclass
copysign
pow
_ldsign
_fdsign
sin
_dsign
_ldclass
__setusermatherr
fmod
floor
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vsprintf
__p__commode
_set_fmode
fputs
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 296KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ