Static task
static1
Behavioral task
behavioral1
Sample
6e156898baa9964e7ab26975d9abfe389469614d774fec58771f8758d520a171.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6e156898baa9964e7ab26975d9abfe389469614d774fec58771f8758d520a171.exe
Resource
win10v2004-20230915-en
General
-
Target
6e156898baa9964e7ab26975d9abfe389469614d774fec58771f8758d520a171
-
Size
8.2MB
-
MD5
2d1a772e10f5c2abe22af3a263801b73
-
SHA1
2db856ea8b29607193358fb03bc5f357cf7b9c07
-
SHA256
6e156898baa9964e7ab26975d9abfe389469614d774fec58771f8758d520a171
-
SHA512
e45e3f3cb337a319d3cd3278613de5fdd838e8a47fca11c460ea558063d8381f5ed162722eedfd3b2a3bc5e55a971810c5fe05c51a7f4c060e678f93e3f3eada
-
SSDEEP
196608:m6y6sOBHEnFY73GB15J4lXk+mHL/XUDUt62NcF:muGFMGBBS0+6vM2Nc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e156898baa9964e7ab26975d9abfe389469614d774fec58771f8758d520a171
Files
-
6e156898baa9964e7ab26975d9abfe389469614d774fec58771f8758d520a171.exe windows:6 windows x64
68aec5b9798160df15abc9698e0de80f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptImportKey
CryptReleaseContext
GetSidIdentifierAuthority
GetSidSubAuthority
GetSidSubAuthorityCount
GetUserNameA
LookupAccountNameA
user32
FindWindowA
GetAsyncKeyState
GetForegroundWindow
GetWindowThreadProcessId
IsWindow
MessageBoxA
ShowWindow
kernel32
Beep
CloseHandle
CreateFileA
DeleteCriticalSection
EnterCriticalSection
FindResourceA
FormatMessageA
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetFileSizeEx
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileStringA
GetProcAddress
GetStartupInfoW
GetStdHandle
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetTempPathA
GetTickCount
GlobalUnlock
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadResource
LockResource
MoveFileExA
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleTextAttribute
SetLastError
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepEx
TerminateProcess
UnhandledExceptionFilter
VerSetConditionMask
VerifyVersionInfoA
WaitForMultipleObjects
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
WritePrivateProfileStringA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
msvcp140
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?flags@ios_base@std@@QEBAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$ctype@D@std@@2V0locale@2@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?uncaught_exception@std@@YA_NXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Query_perf_frequency
_Thrd_detach
_Thrd_sleep
_Xtime_get_ticks
ws2_32
WSACleanup
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringA
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore
wldap32
ord301
ord45
ord22
ord32
ord26
ord30
ord35
ord143
ord200
ord41
ord33
ord27
ord50
ord211
ord60
ord217
ord46
ord79
normaliz
IdnToAscii
IdnToUnicode
vcruntime140
_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_destroy_list
memchr
memcmp
memcpy
memmove
memset
strchr
strrchr
strstr
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__stdio_common_vswprintf_s
_close
_lseeki64
_open
_read
_set_fmode
_write
fclose
feof
fflush
fgets
fopen
fputc
fputs
fread
fseek
ftell
fwrite
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__sys_nerr
_beginthreadex
_c_exit
_cexit
_configure_narrow_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_get_initial_narrow_environment
_getpid
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_dll
_seh_filter_exe
_set_app_type
exit
strerror
system
terminate
api-ms-win-crt-filesystem-l1-1-0
_access
_fstat64
_stat64
_unlink
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-string-l1-1-0
_strdup
isalnum
isupper
strcat
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
strpbrk
strspn
strtok
tolower
api-ms-win-crt-convert-l1-1-0
atoi
strtol
strtoll
strtoul
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 494KB - Virtual size: 494KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.retplne Size: 512B - Virtual size: 92B
.rsrc Size: 7.6MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ