Static task
static1
Behavioral task
behavioral1
Sample
ecc6ba81c1e89e3156dcb36e4f41c1207e8d0a72bf17c5e2609ba82bc44ce50f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ecc6ba81c1e89e3156dcb36e4f41c1207e8d0a72bf17c5e2609ba82bc44ce50f.exe
Resource
win10v2004-20230915-en
General
-
Target
ecc6ba81c1e89e3156dcb36e4f41c1207e8d0a72bf17c5e2609ba82bc44ce50f
-
Size
312KB
-
MD5
785b307bba2ce6389cbaa30ef5b4d389
-
SHA1
60c7c7d4b4c2e0d07dcb8a89f472de81a3e1afc2
-
SHA256
ecc6ba81c1e89e3156dcb36e4f41c1207e8d0a72bf17c5e2609ba82bc44ce50f
-
SHA512
ac4d1f7c63a2ce24a3c0391afae2ccb62c49a7b1e2c2ca7090a3f9ab0b8e417b2ba44f6991862319db41d2d4a783e408cd2e302c215e9682f089afda3df0ad65
-
SSDEEP
3072:gN7p0CpYnJON6+GoKBguiOte2tw3bJF3jd3jmWyNzXIumAp15OfCzjBgZ:g5p0CpX4+GGuHe2ufjmWyNrBmiOfdZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ecc6ba81c1e89e3156dcb36e4f41c1207e8d0a72bf17c5e2609ba82bc44ce50f
Files
-
ecc6ba81c1e89e3156dcb36e4f41c1207e8d0a72bf17c5e2609ba82bc44ce50f.exe windows:6 windows x64
2128a51fc06297ff41c0e2e1a3a9c158
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
TerminateProcess
GetModuleFileNameW
GetEnvironmentVariableW
CreateMutexW
ReleaseMutex
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
GetLastError
Process32NextW
GlobalAlloc
Process32FirstW
CloseHandle
SetCurrentDirectoryW
GlobalLock
CreateProcessW
GlobalUnlock
GetExitCodeProcess
RtlLookupFunctionEntry
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
user32
GetMessageW
DefWindowProcW
LoadMenuW
DestroyWindow
MessageBoxW
CreateWindowExW
UpdateWindow
GetWindowLongPtrW
RegisterClassExW
LoadAcceleratorsW
TrackPopupMenu
LoadStringW
GetSubMenu
OpenClipboard
DispatchMessageW
CloseClipboard
EndDialog
EmptyClipboard
RegisterWindowMessageW
SetForegroundWindow
DialogBoxParamW
PostQuitMessage
SetClipboardData
GetCursorPos
LoadCursorW
BeginPaint
EndPaint
LoadIconW
DestroyMenu
TranslateAcceleratorW
TranslateMessage
shell32
Shell_NotifyIconW
ShellExecuteW
msvcp140
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memcmp
memset
__current_exception_context
__current_exception
_CxxThrowException
__C_specific_handler
__std_terminate
__std_exception_copy
__std_exception_destroy
memmove
api-ms-win-crt-stdio-l1-1-0
fputc
fflush
__p__commode
_fseeki64
fread
fsetpos
ungetc
setvbuf
fgetpos
_set_fmode
fwrite
fclose
fgetc
_get_stream_buffer_pointers
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-convert-l1-1-0
strtoull
strtoll
strtod
api-ms-win-crt-string-l1-1-0
strcpy_s
wcscpy_s
wcscat_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_errno
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_invalid_parameter_noinfo_noreturn
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_set_app_type
api-ms-win-crt-math-l1-1-0
_dclass
__setusermatherr
Sections
.text Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 239KB - Virtual size: 239KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ