Static task
static1
Behavioral task
behavioral1
Sample
c2afb84ff23074e2b1cf8acadb16ad41105c7f50e461058878f07ec5b007cbe6.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c2afb84ff23074e2b1cf8acadb16ad41105c7f50e461058878f07ec5b007cbe6.exe
Resource
win10v2004-20230915-en
General
-
Target
c2afb84ff23074e2b1cf8acadb16ad41105c7f50e461058878f07ec5b007cbe6
-
Size
1.3MB
-
MD5
d409e2b43d183d2840dde5b5e97ba2a3
-
SHA1
6d1f7bf30da15d1c97e316ba8c07e2f57a941311
-
SHA256
c2afb84ff23074e2b1cf8acadb16ad41105c7f50e461058878f07ec5b007cbe6
-
SHA512
ffc5d47ee82f4c4964b31785742bfd8a24d34d90b034aea2be1218c7140de6f123aca693f88503f9fda1e9d13961f90f6b731b0936d8684ff52f487c12ff4f87
-
SSDEEP
24576:gQVpNNQDwLkE1C/p8E5DMhOxsAR8UEDIKb1TYJHpDse3qNwhu9BcHcZA7:jjsEA/p8aDFZ8Jb1TEHpkwgBcHcZA7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c2afb84ff23074e2b1cf8acadb16ad41105c7f50e461058878f07ec5b007cbe6
Files
-
c2afb84ff23074e2b1cf8acadb16ad41105c7f50e461058878f07ec5b007cbe6.exe windows:5 windows x86
e1ee08038f782dddcb726092f8cb7c52
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
shlwapi
PathFileExistsW
PathIsNetworkPathW
crypt32
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptMsgClose
psapi
GetModuleFileNameExW
kernel32
GetProcessHeap
GetModuleHandleW
InterlockedIncrement
MoveFileExW
GetTempPathW
CreateFileW
FileTimeToSystemTime
LocalFree
GetUserDefaultLangID
WriteFile
SetFilePointer
GetCurrentThreadId
GetLocalTime
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
GetModuleHandleExW
WaitForSingleObject
ReleaseMutex
DeleteFileW
MoveFileW
InitializeCriticalSectionAndSpinCount
ReadFile
SetEndOfFile
GetFileSize
GetComputerNameW
GetTickCount
SetEvent
lstrlenW
InterlockedExchange
InterlockedExchangeAdd
SetLastError
LoadLibraryW
GlobalMemoryStatusEx
FreeLibrary
ExpandEnvironmentStringsW
WaitForMultipleObjects
GetCurrentProcess
GetFileAttributesW
CopyFileW
GetLongPathNameW
InterlockedDecrement
GetDriveTypeW
GetDiskFreeSpaceW
GetVolumeInformationW
CreateEventW
ResetEvent
GetModuleFileNameW
GetFileAttributesExW
GetProcAddress
HeapFree
OpenMutexW
GetCurrentProcessId
CloseHandle
GetLastError
Sleep
OpenProcess
CreateProcessW
GetExitCodeProcess
GetACP
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryExW
GetTempFileNameW
DeviceIoControl
FormatMessageW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
GetWindowsDirectoryW
GetCurrentDirectoryW
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
CreateDirectoryW
GetFileSizeEx
ResumeThread
FindClose
FindFirstFileW
CreateMutexW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
SearchPathW
TerminateProcess
GetVersionExW
FindNextFileW
GetFileTime
SetFileTime
HeapAlloc
GlobalFree
GlobalAlloc
FindResourceW
LoadResource
GetSystemInfo
LockResource
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
user32
wsprintfW
SetForegroundWindow
IsWindow
ShowWindow
SendMessageW
IsWindowVisible
GetWindowLongW
advapi32
RegCreateKeyExW
CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ChangeServiceConfig2W
DeleteService
ControlService
StartServiceW
OpenServiceW
shell32
ShellExecuteW
SHChangeNotify
SHGetPathFromIDListW
SHGetFolderPathW
ole32
CoCreateInstance
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?uncaught_exception@std@@YA_NXZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??1_Facet_base@std@@UAE@XZ
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
_Strcoll
??_7facet@locale@std@@6B@
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Xbad_alloc@std@@YAXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
_Strxfrm
??_7_Facet_base@std@@6B@
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
vcruntime140
__std_exception_destroy
__std_exception_copy
strchr
__std_type_info_name
__CxxFrameHandler3
wcsrchr
wcschr
wcsstr
strstr
_except_handler4_common
_CxxThrowException
memset
memmove
memcpy
memchr
_purecall
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswscanf
__stdio_common_vsscanf
_set_fmode
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__p__commode
fclose
fputws
__stdio_common_vsprintf
_wfopen
ftell
fopen
fseek
fread
__stdio_common_vswprintf_s
fwrite
rewind
_wfopen_s
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_errno
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_crt_atexit
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo
_controlfp_s
terminate
_beginthreadex
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
malloc
calloc
realloc
_set_new_mode
free
_callnewh
api-ms-win-crt-convert-l1-1-0
wcstoul
atoi
_wtoi
api-ms-win-crt-locale-l1-1-0
setlocale
_configthreadlocale
api-ms-win-crt-string-l1-1-0
wcsncpy
tolower
_stricmp
_wcsicmp
_wcsnicmp
towlower
towupper
isalnum
api-ms-win-crt-time-l1-1-0
_localtime64_s
_localtime64
_time64
_mktime64
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-filesystem-l1-1-0
_splitpath_s
api-ms-win-crt-math-l1-1-0
_dtest
modf
__setusermatherr
_except1
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ