Static task
static1
Behavioral task
behavioral1
Sample
a86ba50a39028dca66ccfb5bd17e3c64c1a45fce78e601be3697642f85bebcea.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
a86ba50a39028dca66ccfb5bd17e3c64c1a45fce78e601be3697642f85bebcea.exe
Resource
win10v2004-20231020-en
General
-
Target
a86ba50a39028dca66ccfb5bd17e3c64c1a45fce78e601be3697642f85bebcea
-
Size
1.9MB
-
MD5
429e3fb63a2a800e146e427309addbf4
-
SHA1
7c5371fe8f84f13c73f9c74bc4ca8701334da2fd
-
SHA256
a86ba50a39028dca66ccfb5bd17e3c64c1a45fce78e601be3697642f85bebcea
-
SHA512
4ba5820432bcdd5bcf9e32e4466af79cc807e4c587155959d71069331d439f805987601a69d1a8862e5c64d872389dc10ec4c57461c74bcbd4393ff022302fbc
-
SSDEEP
49152:jrkmGVe0LxAzwuV89DkTPGVrLTY36PcFkJfNGiPUs5S:e9xAzQ9QTugnF4G
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a86ba50a39028dca66ccfb5bd17e3c64c1a45fce78e601be3697642f85bebcea
Files
-
a86ba50a39028dca66ccfb5bd17e3c64c1a45fce78e601be3697642f85bebcea.exe windows:6 windows x86
7e8040c3593adb75563918097925958d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
GetAdaptersInfo
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
credui
CredUIPromptForCredentialsW
CredUIParseUserNameW
CredUIConfirmCredentialsW
winhttp
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpWriteData
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSetCredentials
WinHttpQueryAuthSchemes
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
psapi
GetProcessMemoryInfo
GetModuleFileNameExW
GetProcessImageFileNameW
comctl32
InitCommonControlsEx
_TrackMouseEvent
dbghelp
MiniDumpWriteDump
ws2_32
sendto
recvfrom
getpeername
select
__WSAFDIsSet
accept
getsockopt
WSASetLastError
send
recv
freeaddrinfo
connect
htonl
ntohl
getaddrinfo
WSAStartup
htons
bind
closesocket
ioctlsocket
getsockname
listen
setsockopt
socket
WSACleanup
WSAGetLastError
WSAIoctl
ntohs
gethostname
crypt32
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFindCertificateInStore
user32
CopyRect
DrawFocusRect
GetSysColor
InflateRect
GetWindowLongW
SetWindowLongW
LoadIconW
DrawIconEx
SystemParametersInfoW
MonitorFromWindow
ScreenToClient
MessageBeep
GetWindowRect
GetMonitorInfoW
GetWindowTextLengthW
SetWindowTextW
GetProcessWindowStation
GetUserObjectInformationW
EndPaint
BeginPaint
UpdateWindow
DrawTextW
EnableMenuItem
GetSystemMenu
GetSystemMetrics
EnableWindow
KillTimer
SetTimer
SetFocus
GetDialogBaseUnits
CheckDlgButton
GetDlgItem
EndDialog
DialogBoxIndirectParamW
InvalidateRect
SetWindowPos
MoveWindow
ShowWindow
IsWindow
GetClientRect
GetDesktopWindow
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
LoadStringW
MessageBoxW
SendMessageW
GetWindowTextW
EnumWindows
DestroyIcon
LoadImageW
UnregisterClassW
PostMessageW
CallWindowProcW
advapi32
RegCloseKey
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CredWriteW
CredFree
CredReadW
CredDeleteW
gdi32
CreateDCW
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject
GetStockObject
RoundRect
SelectObject
SetBkColor
SetBkMode
SetTextColor
ExtTextOutW
CreateSolidBrush
wldap32
ord200
ord30
ord79
ord35
ord33
ord41
ord301
ord32
ord27
ord26
ord22
ord50
ord143
ord46
ord211
ord60
normaliz
IdnToAscii
kernel32
IsDebuggerPresent
Sleep
VerSetConditionMask
MoveFileW
CopyFileW
GetFullPathNameW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
WaitForMultipleObjects
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
SetFileTime
ResetEvent
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
FlushInstructionCache
SetLastError
GetFileType
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GlobalMemoryStatus
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetTickCount64
SleepEx
GetEnvironmentVariableW
SetConsoleTextAttribute
GetStdHandle
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
CreateEventA
GetCurrentThreadId
SetUnhandledExceptionFilter
GetCurrentProcessId
VirtualFree
VirtualAlloc
LoadLibraryA
FormatMessageA
MultiByteToWideChar
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
SetThreadUILanguage
FindResourceExW
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
DuplicateHandle
FindNextFileW
FindFirstFileW
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
FindClose
GetModuleFileNameW
ReadProcessMemory
GlobalFree
Module32NextW
PeekNamedPipe
ExpandEnvironmentStringsA
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
Module32FirstW
CreateToolhelp32Snapshot
DebugBreakProcess
DebugSetProcessKillOnExit
GetProcAddress
UnhandledExceptionFilter
GetModuleHandleW
WriteProcessMemory
GetVersionExW
GetOverlappedResult
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
OpenThread
OpenEventW
CreateEventW
WaitForSingleObject
SetEvent
DebugActiveProcessStop
DebugActiveProcess
WaitForDebugEvent
ContinueDebugEvent
FindResourceW
LoadLibraryW
SizeofResource
LockResource
LoadResource
FreeLibrary
OpenFileMappingW
VirtualQuery
WideCharToMultiByte
SystemTimeToFileTime
FileTimeToSystemTime
CloseHandle
SetErrorMode
OpenProcess
GlobalMemoryStatusEx
LocalFree
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateFileW
DeleteFileW
FlushFileBuffers
GetFileAttributesExW
GetFileInformationByHandle
GetFileSize
GetTempFileNameW
ReadFile
SetFilePointer
WriteFile
GetTempPathW
GetLastError
WaitForSingleObjectEx
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetSystemTime
GetLocalTime
GetSystemInfo
GetTickCount
GetSystemDirectoryW
GetComputerNameExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetStartupInfoW
shell32
ord165
CommandLineToArgvW
DuplicateIcon
SHGetFileInfoW
ShellExecuteW
SHGetFolderPathW
ole32
StringFromCLSID
CoCreateGuid
CoTaskMemFree
CoInitializeEx
CoCreateInstance
msvcp140
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?setf@ios_base@std@@QAEHHH@Z
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
vcruntime140
_except_handler4_common
__std_exception_destroy
__vcrt_InitializeCriticalSectionEx
memchr
strrchr
_CxxThrowException
__CxxFrameHandler3
__std_terminate
wcsstr
strstr
strchr
wcschr
wcsrchr
memmove
memset
memcpy
_except_handler3
_purecall
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_get_wide_winmain_command_line
raise
_initialize_wide_environment
_c_exit
abort
_invalid_parameter_noinfo_noreturn
strerror_s
_initialize_onexit_table
strerror
_configure_wide_argv
_register_thread_local_exe_atexit_callback
_errno
terminate
_register_onexit_function
__sys_nerr
_crt_atexit
_controlfp_s
_wassert
_beginthreadex
_set_app_type
_seh_filter_exe
signal
_beginthread
_exit
_cexit
api-ms-win-crt-string-l1-1-0
strpbrk
isupper
isxdigit
islower
isprint
isgraph
strspn
strcspn
_strdup
strcmp
strlen
wcsnlen
wcslen
wcscpy
memmove_s
memcpy_s
isdigit
isalpha
isalnum
_wcslwr_s
_wcslwr
isspace
iswalnum
_wcsicmp
strncpy
_strnicmp
strncmp
_stricmp
wcsncmp
tolower
wcsncpy_s
toupper
wcsncpy
wmemcpy_s
api-ms-win-crt-convert-l1-1-0
strtoll
wcstombs
_itow
atoi
mbstowcs
wcstoul
_strtoui64
_strtoi64
strtoul
strtol
strtod
wcstombs_s
_wtoi
api-ms-win-crt-filesystem-l1-1-0
_wmakepath_s
_wfullpath
_stat64
_fstat64
_wsplitpath_s
_fstat64i32
_stat64i32
api-ms-win-crt-utility-l1-1-0
qsort
rand
srand
ldiv
api-ms-win-crt-stdio-l1-1-0
_open_osfhandle
_chsize
_write
_fseeki64
fread
_wopen
_lseeki64
fopen
fclose
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vswprintf
_set_fmode
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
feof
ferror
fgets
ftell
_setmode
__p__commode
_open
fseek
__stdio_common_vsscanf
_fileno
_wfopen
fputs
_close
_read
fputc
fwrite
setbuf
_ftelli64
fflush
api-ms-win-crt-heap-l1-1-0
malloc
realloc
_set_new_mode
free
_callnewh
_recalloc
calloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
ceil
_fdopen
_except1
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 388KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 634KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 29B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ