Static task
static1
Behavioral task
behavioral1
Sample
81202529443a234489720c0030b05d3b5c28fe046a412953e95110699cc9b7cf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
81202529443a234489720c0030b05d3b5c28fe046a412953e95110699cc9b7cf.exe
Resource
win10v2004-20230915-en
General
-
Target
81202529443a234489720c0030b05d3b5c28fe046a412953e95110699cc9b7cf
-
Size
1.9MB
-
MD5
9c4d00f7f009321ec98e5c5212731874
-
SHA1
501bd0da22998cd9ecc4929e1ef5ca5dae3f99b9
-
SHA256
81202529443a234489720c0030b05d3b5c28fe046a412953e95110699cc9b7cf
-
SHA512
8fac8d0f612f36bcd146524f329c97823c184121888626be8b0457eec198daf9a743fa782b064d3f009d22aeb27263d8e132f36948c3c6b00d542c2844ac3ef9
-
SSDEEP
49152:NJdJ9PG+xhm1nTXzGoUcIsfE48hMTohE4j:H9PG+xhm1jbfE48iohEU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81202529443a234489720c0030b05d3b5c28fe046a412953e95110699cc9b7cf
Files
-
81202529443a234489720c0030b05d3b5c28fe046a412953e95110699cc9b7cf.exe windows:4 windows x86
63261a47ac47840655f2c71a99855950
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHSetValueA
StrStrIW
wvnsprintfW
SHGetValueA
PathIsRootW
PathFindFileNameW
SHGetValueW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
PathIsDirectoryW
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
kernel32
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetExitCodeThread
ResumeThread
FindNextFileW
SetLastError
GetFullPathNameW
FindFirstFileW
FindClose
GetCommandLineW
VirtualProtect
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcpyW
DebugBreak
OutputDebugStringW
lstrlenA
FlushInstructionCache
GetCurrentProcess
FlushFileBuffers
WriteFile
ReadFile
GetFileSize
CreateFileW
FreeResource
GlobalUnlock
LockResource
SizeofResource
LoadResource
FindResourceW
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
CreateMutexW
GetLastError
CloseHandle
GetModuleHandleW
GetVersionExW
GetDiskFreeSpaceExW
GlobalFree
GlobalLock
GlobalAlloc
GetFileSizeEx
GetPrivateProfileIntW
GetPrivateProfileStringW
FreeLibrary
LoadLibraryW
SetFilePointer
GetExitCodeProcess
GetFileAttributesExW
TerminateProcess
GetSystemDirectoryW
CopyFileW
MultiByteToWideChar
Module32FirstW
DeviceIoControl
OpenProcess
WideCharToMultiByte
GetVersion
MulDiv
GetModuleFileNameW
WaitForSingleObject
CreateThread
CreateEventW
SetEvent
GetLongPathNameW
CreateSemaphoreW
GetTempPathW
GetCurrentProcessId
InterlockedDecrement
GetTempFileNameW
GetTickCount
RemoveDirectoryW
SetErrorMode
SetUnhandledExceptionFilter
Sleep
SetWaitableTimer
DeleteFileW
MoveFileExW
InterlockedIncrement
GetProcAddress
lstrlenW
LocalFree
SetFilePointerEx
SetEndOfFile
GetLocalTime
CreateFileA
GetSystemTimeAsFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetCurrentThread
ReleaseMutex
ReleaseSemaphore
WaitForMultipleObjects
GetThreadTimes
GetStartupInfoW
lstrcmpiA
lstrcmpA
GetFileType
GetModuleHandleA
QueryPerformanceFrequency
QueryPerformanceCounter
ResetEvent
InterlockedExchangeAdd
CreateWaitableTimerW
MoveFileW
user32
GetWindowLongW
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
CreateDialogParamW
GetDlgItemTextW
IsDlgButtonChecked
SetWindowPos
EndDialog
DestroyWindow
DefWindowProcW
SetWindowLongW
wvsprintfW
PostMessageW
SendMessageW
PeekMessageW
GetMessageW
BeginPaint
EndPaint
SetCursor
GetSysColor
IsWindowEnabled
GetDC
GetParent
GetWindowTextW
GetScrollInfo
MoveWindow
GetScrollRange
GetScrollPos
SetScrollPos
SetFocus
SetScrollInfo
ShowScrollBar
GetCursorPos
TranslateMessage
DispatchMessageW
SetForegroundWindow
CheckDlgButton
UnhookWindowsHookEx
CallNextHookEx
ShowWindow
GetActiveWindow
ScreenToClient
DrawTextW
GetSystemMenu
EnableMenuItem
DestroyMenu
GetWindowPlacement
BringWindowToTop
LoadIconW
SetWindowTextW
LoadImageW
ReleaseDC
GetSystemMetrics
UnregisterClassW
CharUpperW
DialogBoxParamW
LoadStringW
CharNextW
MessageBoxW
SetWindowsHookExW
FindWindowExW
UpdateWindow
PostQuitMessage
IsDialogMessageW
KillTimer
CreateWindowExW
CallWindowProcW
InvalidateRect
RedrawWindow
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
IsWindow
IsWindowVisible
IsIconic
ExitWindowsEx
EnableWindow
OffsetRect
GetDlgItem
PtInRect
CopyRect
CharLowerW
SetDlgItemTextW
SetTimer
gdi32
CreateFontIndirectW
SetTextColor
SelectObject
SetBkMode
DeleteDC
CreateCompatibleDC
ExtTextOutW
SetBkColor
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
DeleteObject
advapi32
RegEnumKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegSetValueExW
RegEnumKeyExA
shell32
SHCreateDirectoryExW
ShellExecuteW
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
Shell_NotifyIconW
SHBrowseForFolderW
SHGetSpecialFolderPathW
ole32
OleRun
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
CLSIDFromProgID
CreateStreamOnHGlobal
oleaut32
SafeArrayCreate
VariantInit
SafeArrayPutElement
OleLoadPicture
VariantClear
SysAllocString
VariantChangeType
SysFreeString
SafeArrayDestroy
GetErrorInfo
comctl32
InitCommonControlsEx
msimg32
TransparentBlt
msvcp60
?nothrow@std@@3Unothrow_t@1@B
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0logic_error@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??_7out_of_range@std@@6B@
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xran@std@@YAXXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Xlen@std@@YAXXZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
ws2_32
WSAStartup
htons
htonl
ntohs
ntohl
inet_addr
inet_ntoa
gethostbyname
WSAGetLastError
recv
send
setsockopt
closesocket
connect
WSACleanup
bind
WSAAsyncSelect
WSASetLastError
WSAAsyncGetHostByName
WSACancelAsyncRequest
recvfrom
sendto
getpeername
shutdown
listen
accept
ioctlsocket
gethostname
socket
setupapi
SetupIterateCabinetW
wininet
HttpOpenRequestW
InternetOpenUrlW
InternetErrorDlg
InternetConnectW
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetOpenW
HttpSendRequestW
HttpQueryInfoW
InternetCloseHandle
msvcrt
calloc
strchr
strtol
strncpy
_endthreadex
sprintf
ctime
fprintf
fwprintf
fflush
setlocale
memchr
_strnicmp
isspace
_atoi64
_wtoi64
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_strlwr
strncat
isprint
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_exit
_XcptFilter
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_wcsupr
_itoa
strncmp
_callnewh
toupper
tolower
atoi
_CIpow
_wstat
swscanf
_vsnprintf
_except_handler3
_vsnwprintf
_errno
_CxxThrowException
isdigit
__RTDynamicCast
wprintf
_purecall
_ftol
_wfopen
fread
fclose
wcsncmp
wcstok
_wcsnicmp
printf
exit
malloc
wcscmp
_wsplitpath
time
srand
rand
_wtoi
iswdigit
realloc
_wcsicmp
wcsstr
wcscat
free
swprintf
wcsrchr
wcscpy
_snwprintf
wcslen
_beginthreadex
__CxxFrameHandler
??2@YAPAXI@Z
memmove
iswspace
wcsncpy
wcsncat
psapi
EnumProcessModules
GetModuleFileNameExW
iphlpapi
GetAdaptersInfo
GetNetworkParams
netapi32
Netbios
secur32
AcquireCredentialsHandleA
InitializeSecurityContextA
FreeCredentialsHandle
winhttp
WinHttpGetIEProxyConfigForCurrentUser
Sections
.text Size: 632KB - Virtual size: 630KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 334KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ