Static task
static1
Behavioral task
behavioral1
Sample
2285ca85437d52abcae3bef0a78f7cc41cda0c076a3f0fc28f71d8fd93d935f1.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2285ca85437d52abcae3bef0a78f7cc41cda0c076a3f0fc28f71d8fd93d935f1.exe
Resource
win10v2004-20230915-en
General
-
Target
2285ca85437d52abcae3bef0a78f7cc41cda0c076a3f0fc28f71d8fd93d935f1
-
Size
920KB
-
MD5
89fcb439af820770f236b127f5a15581
-
SHA1
abb60f121cc977088ba6134f5a3f18b2c594ddda
-
SHA256
2285ca85437d52abcae3bef0a78f7cc41cda0c076a3f0fc28f71d8fd93d935f1
-
SHA512
62f1e1ccf8f9b31d7e082ddeae82858b46088aa796fc6da0a1eb122c57d2f6eda40946f26fb6550d1ecaa8d37eb8045b77555047e8cf6e6c32f8a312e55cb23c
-
SSDEEP
24576:GZw/2XrHMQ/mF7lCxwNyINoXwOrobJS1oBL4hzBoyzk+V:G5xF1JhzBoyF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2285ca85437d52abcae3bef0a78f7cc41cda0c076a3f0fc28f71d8fd93d935f1
Files
-
2285ca85437d52abcae3bef0a78f7cc41cda0c076a3f0fc28f71d8fd93d935f1.exe windows:4 windows x86
b74f16c2004f2a8abc4df44bc34f4ad9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
ord410
ord412
ord413
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
gdiplus
GdipDeleteFont
GdipAlloc
GdipFree
GdipCreateBitmapFromStream
GdipGetSmoothingMode
GdipDrawPath
GdipFillPath
GdipDeletePath
GdipCreatePath
GdipSetSmoothingMode
GdiplusShutdown
GdipFillRectangle
GdipCreateLineBrushFromRect
GdipDisposeImage
GdipClosePathFigure
GdipAddPathArcI
GdipLoadImageFromStream
GdiplusStartup
GdipDrawString
GdipSetTextRenderingHint
GdipReleaseDC
GdipMeasureString
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipCreateSolidFill
GdipGetDC
GdipDrawLineI
GdipCloneImage
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDeletePen
GdipCreatePen1
GdipDrawImageRectI
GdipFillRectangleI
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushFromRectI
GdipDeleteGraphics
GdipCreateFromHDC
winhttp
WinHttpAddRequestHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpQueryOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpSetOption
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpCrackUrl
WinHttpSetStatusCallback
WinHttpCloseHandle
WinHttpOpen
WinHttpConnect
WinHttpSetTimeouts
WinHttpWriteData
urlmon
IsValidURL
crypt32
CryptUnprotectData
CryptProtectData
depot
GetDllHandle
kernel32
UnhandledExceptionFilter
GetStartupInfoW
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
HeapSize
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GlobalAlloc
GlobalFree
SetFilePointerEx
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
LoadLibraryA
SetLastError
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameW
CopyFileW
InterlockedExchange
LeaveCriticalSection
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
GetCurrentThreadId
RaiseException
GetLastError
FreeLibrary
FindResourceW
LoadResource
SizeofResource
LockResource
LoadLibraryW
GetModuleHandleW
GetProcAddress
MoveFileW
lstrlenW
GetFileAttributesW
CreateDirectoryW
DeleteFileW
GetModuleFileNameA
SetFileAttributesW
SystemTimeToFileTime
CreateFileW
SetFileTime
WideCharToMultiByte
LocalFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
WaitForSingleObjectEx
CreateThread
CloseHandle
SetEvent
ResetEvent
GetSystemTimeAsFileTime
FormatMessageW
FindResourceExW
GetProcessHeap
Sleep
HeapFree
WaitForSingleObject
GetUserDefaultUILanguage
MultiByteToWideChar
MulDiv
CreateMutexW
InitializeCriticalSection
lstrlenA
GetFullPathNameW
GetTempPathW
GetTempFileNameW
TryEnterCriticalSection
InterlockedCompareExchange
CreatePipe
DuplicateHandle
CreateProcessW
GetExitCodeProcess
GetStdHandle
SetStdHandle
TerminateProcess
ReadFile
GetSystemInfo
ResumeThread
ExitThread
GetTickCount
GetQueuedCompletionStatus
GetCurrentThread
GetProcessTimes
GetFileType
FlushFileBuffers
WriteFile
SetFilePointer
SetEndOfFile
GetFileSize
GetLocalTime
HeapReAlloc
HeapAlloc
SetErrorMode
CreateFileMappingW
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
user32
GetSysColor
IsWindowEnabled
InvalidateRect
TrackMouseEvent
BeginPaint
GetSysColorBrush
ScrollWindowEx
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollInfo
GetScrollInfo
PtInRect
SetCursor
RedrawWindow
DialogBoxIndirectParamW
GetDoubleClickTime
MessageBeep
PostQuitMessage
TrackPopupMenu
GetCursorPos
PostMessageW
CreatePopupMenu
SetForegroundWindow
GetWindowPlacement
IsWindowVisible
GetFocus
RegisterWindowMessageW
DestroyMenu
DispatchMessageW
TranslateMessage
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
FindWindowExW
AllowSetForegroundWindow
CharNextW
ScreenToClient
GetDlgCtrlID
GetSystemMetrics
GetKeyState
KillTimer
ShowWindow
wsprintfW
CharUpperW
InflateRect
GetClassNameW
GetAncestor
FillRect
MessageBoxW
GetLastActivePopup
DestroyIcon
EnableWindow
DrawTextW
GetWindowTextLengthW
GetParent
LoadCursorW
UnregisterClassA
AppendMenuW
GetWindowTextW
SetTimer
IsWindow
GetWindow
SystemParametersInfoW
SetWindowPos
SetFocus
LoadIconW
GetDC
SetWindowTextW
ReleaseDC
CreateWindowExW
GetWindowLongW
SetWindowLongW
DestroyWindow
EndDialog
CallWindowProcW
DefWindowProcW
GetClassInfoExW
RegisterClassExW
LockWindowUpdate
GetDesktopWindow
MoveWindow
MapWindowPoints
GetWindowRect
GetDlgItem
SetDlgItemTextW
GetClientRect
SendMessageW
IsRectEmpty
EndPaint
GetNextDlgTabItem
gdi32
DeleteDC
DeleteObject
SetBkMode
SetBkColor
SetTextColor
GetObjectW
CreateFontIndirectW
SelectObject
GetLayout
SetLayout
GetStockObject
GetObjectA
RestoreDC
DPtoLP
SetWindowOrgEx
SetViewportOrgEx
ModifyWorldTransform
SetGraphicsMode
SaveDC
GetTextExtentPoint32W
GetTextMetricsW
GetPixel
BitBlt
CreateSolidBrush
GetDeviceCaps
CreateBitmap
CreateCompatibleDC
comdlg32
GetOpenFileNameW
advapi32
FreeSid
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
RegDeleteValueW
RegCreateKeyW
RegSetValueExW
CryptReleaseContext
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CheckTokenMembership
CryptCreateHash
AllocateAndInitializeSid
shell32
Shell_NotifyIconW
SHGetFolderPathA
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteW
ShellExecuteExW
SHGetFolderLocation
SHGetPathFromIDListW
ole32
CoCreateInstance
CoUninitialize
StringFromGUID2
CoCreateGuid
CoInitializeEx
CoTaskMemFree
oleaut32
VariantTimeToSystemTime
msvcp80
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?copy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPA_WII@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
shlwapi
StrCmpNIW
StrCmpIW
StrStrIW
msvcr80
??3@YAXPAX@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_invalid_parameter_noinfo
_recalloc
swprintf_s
?what@exception@std@@UBEPBDXZ
memcpy_s
memmove_s
??0exception@std@@QAE@XZ
free
??_V@YAXPAX@Z
_vsnwprintf_s
wcschr
wcscat_s
wcsncpy_s
wcsrchr
wcscpy_s
strrchr
isalnum
_wcsnicmp
wcstol
_CxxThrowException
tolower
_purecall
_wsplitpath_s
_time64
_beginthreadex
_wtoi
wcsncpy
_wtof
_snwprintf
wcsstr
_resetstkoflw
malloc
_wcsicmp
rand
_itow
_wtoi64
_i64tow
__RTDynamicCast
_swab
realloc
_getpid
isspace
strchr
fopen
fgets
strncmp
fclose
memset
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
srand
_snprintf
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
memcpy
__CxxFrameHandler3
sprintf
_vswprintf_c_l
??0exception@std@@QAE@ABQBDH@Z
ws2_32
WSAStartup
iphlpapi
GetAdaptersInfo
Sections
.text Size: 668KB - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ