Static task
static1
Behavioral task
behavioral1
Sample
a6f8bd4a44308578b70ae40e2d08f2c11fa70bfdac741f01911ea19246debb29.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
a6f8bd4a44308578b70ae40e2d08f2c11fa70bfdac741f01911ea19246debb29.exe
Resource
win10v2004-20231020-en
General
-
Target
a6f8bd4a44308578b70ae40e2d08f2c11fa70bfdac741f01911ea19246debb29
-
Size
184KB
-
MD5
f81a27363d9ac643dac29e82536763fe
-
SHA1
4a356a37eba8e344999a04afa6c998f2ee6151dd
-
SHA256
a6f8bd4a44308578b70ae40e2d08f2c11fa70bfdac741f01911ea19246debb29
-
SHA512
75ee92c381f8c7b3c006e37fe96793dc887a5e37b141a457eb7e794abac4e0cf42d6ecbac8b9f4b28b3e1af4da58a3752ba258cea677fbfe625566fc2b33311e
-
SSDEEP
1536:r5b3ZQFOxhbVlHJd0wb6KnvOIIZI7HZOiLkqIkxF6uY8j9fR4hIIfriWYcF:r5CFOrpd0w+KiID0CkUzlMIIzQ2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a6f8bd4a44308578b70ae40e2d08f2c11fa70bfdac741f01911ea19246debb29
Files
-
a6f8bd4a44308578b70ae40e2d08f2c11fa70bfdac741f01911ea19246debb29.exe windows:4 windows x86
ac704ddc8a4a20c1145aa9186da4f9d7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEvent
CloseHandle
WaitForSingleObject
CreateThread
CreateEventA
Sleep
lstrcmpiA
GetCommandLineA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LoadLibraryA
lstrcpyA
lstrcatA
WideCharToMultiByte
LeaveCriticalSection
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
GetStartupInfoA
LocalFree
GetLastError
FindFirstFileA
FindNextFileA
ReleaseMutex
CreateMutexA
HeapFree
GetProcessHeap
HeapAlloc
GlobalFree
GetShortPathNameA
lstrlenW
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
lstrlenA
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetModuleFileNameA
VirtualQuery
LoadLibraryExA
GetProcAddress
EnterCriticalSection
FreeLibrary
user32
IsChild
SetWindowLongA
DefWindowProcA
GetWindowLongA
DestroyWindow
PostMessageA
GetClientRect
PostThreadMessageA
CreateWindowExA
CallWindowProcA
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
CharNextA
UnionRect
PtInRect
GetKeyState
InvalidateRect
GetParent
ShowWindow
SetFocus
IsWindow
BeginPaint
EndPaint
GetFocus
SetWindowPos
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
GetDC
ReleaseDC
GetMessageA
DispatchMessageA
gdi32
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
TextOutA
SetTextAlign
Rectangle
CreateRectRgnIndirect
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
CreateMetaFileA
RestoreDC
ole32
CoRegisterClassObject
CoUninitialize
WriteClassStm
OleSaveToStream
CoCreateInstance
OleRegEnumVerbs
CoRevokeClassObject
CoInitialize
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
OleLoadFromStream
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysAllocStringByteLen
OleCreatePropertyFrame
SysStringByteLen
VariantChangeType
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocStringLen
VariantClear
SysAllocString
VariantInit
shlwapi
PathAddBackslashA
PathAppendA
PathRemoveFileSpecA
msvcp60
??1bad_cast@std@@UAE@XZ
??_7bad_cast@std@@6B@
??1_Lockit@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0_Lockit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0bad_cast@std@@QAE@PBD@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
msvcrt
memcmp
_CxxThrowException
_purecall
_access
free
??2@YAPAXI@Z
strlen
mbstowcs
memset
_mkdir
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??8type_info@@QBEHABV0@@Z
memcpy
realloc
malloc
strncpy
fclose
fflush
fwrite
fopen
__CxxFrameHandler
_ftol
wcslen
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strcmp
comdlg32
GetOpenFileNameA
GetSaveFileNameA
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Sections
.text Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ