Static task
static1
Behavioral task
behavioral1
Sample
26f044d1b79e3103a498e39ede78c15b561d2855e313392c7e24aa8ef6fcd69d.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
26f044d1b79e3103a498e39ede78c15b561d2855e313392c7e24aa8ef6fcd69d.exe
Resource
win10v2004-20231020-en
General
-
Target
26f044d1b79e3103a498e39ede78c15b561d2855e313392c7e24aa8ef6fcd69d
-
Size
505KB
-
MD5
81b03be517fd9c9b25a4d17edbfdedf6
-
SHA1
82aac226e17d0bf1dfb6c34636d4c593b1c03156
-
SHA256
26f044d1b79e3103a498e39ede78c15b561d2855e313392c7e24aa8ef6fcd69d
-
SHA512
08fc2ebea5f713ee0b7a9774ccc09de7a542b711d02f94f8c12bc59b4c3c166fe261876eac29622bd87b1e663f28532fda71253ea77340eff9faf4312c0e8552
-
SSDEEP
6144:qW3cLGM1WaF8KlsjWExmwjmcTSHixXIen2sNBg3yKoTvehCQMeuqHDynXLJa6JXO:DcL9lodzXImNoCKgvCyn7Ja6AM08
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26f044d1b79e3103a498e39ede78c15b561d2855e313392c7e24aa8ef6fcd69d
Files
-
26f044d1b79e3103a498e39ede78c15b561d2855e313392c7e24aa8ef6fcd69d.exe windows:6 windows x64
2e43c8435422f4702e25342f49d2ab78
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
MultiByteToWideChar
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
LoadLibraryA
AcquireSRWLockExclusive
Process32NextW
WaitForSingleObject
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateThread
CreateProcessA
GetProcAddress
CloseHandle
SleepConditionVariableSRW
GetLastError
CreateToolhelp32Snapshot
GetModuleHandleA
GetFullPathNameA
SetConsoleTitleA
GetCurrentProcessId
Process32FirstW
Sleep
ReleaseSRWLockExclusive
WakeAllConditionVariable
user32
DefWindowProcW
GetWindow
SetWindowPos
SetWindowLongPtrW
CreateWindowExW
RegisterClassExW
ShowWindow
GetSystemMetrics
DispatchMessageW
PeekMessageW
TranslateMessage
GetWindowDC
SetWindowLongW
PostQuitMessage
UpdateWindow
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetKeyState
GetAsyncKeyState
GetWindowLongW
GetCursorPos
GetMessageExtraInfo
ScreenToClient
GetCapture
SetCursorPos
GetClientRect
SetCursor
SetCapture
LoadCursorW
GetForegroundWindow
TrackMouseEvent
ClientToScreen
IsWindowUnicode
ReleaseCapture
gdi32
GetDeviceCaps
advapi32
StartServiceW
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
OpenServiceA
CreateServiceA
msvcp140
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Xlength_error@std@@YAXPEBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?good@ios_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception_context
memmove
memcpy
memcmp
memchr
__current_exception
__C_specific_handler
strstr
__std_terminate
__std_exception_copy
__std_exception_destroy
memset
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vfprintf
ftell
fflush
fclose
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
fseek
__p__commode
__acrt_iob_func
api-ms-win-crt-runtime-l1-1-0
_cexit
terminate
_seh_filter_exe
_set_app_type
_crt_atexit
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_invalid_parameter_noinfo_noreturn
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
system
_configure_narrow_argv
_getpid
_initialize_narrow_environment
_initialize_onexit_table
api-ms-win-crt-utility-l1-1-0
qsort
srand
rand
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-string-l1-1-0
strncmp
strcmp
strncpy
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
malloc
free
api-ms-win-crt-math-l1-1-0
sqrtf
fmodf
cosf
ceilf
acosf
sinf
tanf
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 287KB - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 135KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ