Static task
static1
Behavioral task
behavioral1
Sample
18922346b57cc0b2b09164f172b88a2a244ef6de072c37f0baa651b8cfbf544d.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
18922346b57cc0b2b09164f172b88a2a244ef6de072c37f0baa651b8cfbf544d.exe
Resource
win10v2004-20231023-en
General
-
Target
18922346b57cc0b2b09164f172b88a2a244ef6de072c37f0baa651b8cfbf544d
-
Size
735KB
-
MD5
b124cc119f206b59c2a0c4ce6367e876
-
SHA1
21148dccb64cd9cdcf9cdaad66cbf6cf950376a6
-
SHA256
18922346b57cc0b2b09164f172b88a2a244ef6de072c37f0baa651b8cfbf544d
-
SHA512
3cc49a4943311fa40a98bb041dee78ad82e565faf07c1132ea1a53803ade5e791ae04980681eabe81357aa26990b6b27586673848cff9cc56afd285f5bda3f86
-
SSDEEP
12288:+tMn/0pX5pd6rJyrojrYPDkMqdGrOv+70ASeyjjO:Wlrd6wDkHdGSgo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 18922346b57cc0b2b09164f172b88a2a244ef6de072c37f0baa651b8cfbf544d
Files
-
18922346b57cc0b2b09164f172b88a2a244ef6de072c37f0baa651b8cfbf544d.exe windows:6 windows x86
12829534654af5c2f91895540117ca7f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
datacalc
?LELCount@@YANQAN0@Z
?MToFL@@YANAAN0000@Z
?FLToM@@YANAAN0000@Z
?UELCount@@YANQAN0@Z
pcomm
ord2
ord6
ord19
ord20
ord4
pressuredaq
?DataCollection@@YAXPAX@Z
explosion
?set_ignite_time@@YAHN@Z
?CFG_Pa@@YANH@Z
?ComputerUnCtrl@@YAXPAX@Z
?valve_control@@YAHHH@Z
?gonglv_control@@YAHHNNNN@Z
?ComputerCtrl@@YAXXZ
?TEMP_LINK@@YA_NPAD00@Z
?Configuration_FL1000@@YAXXZ
?pid_control@@YAHHNNN@Z
?explosion@@YAHPAX@Z
?Initialize1@@YAHXZ
?Finalize@@YAHXZ
mfc110ud
ord15938
ord6652
ord7391
ord10735
ord4445
ord12705
ord12755
ord13012
ord10855
ord14774
ord6617
ord14546
ord12997
ord9967
ord9020
ord3355
ord15437
ord3037
ord14308
ord14638
ord5562
ord11151
ord3202
ord14964
ord13892
ord4984
ord2880
ord1233
ord4745
ord4695
ord16926
ord6371
ord6361
ord12108
ord11922
ord12410
ord12873
ord12874
ord11027
ord13502
ord11642
ord10870
ord6871
ord12543
ord13700
ord13687
ord13645
ord12600
ord12686
ord11820
ord11821
ord8867
ord11367
ord13340
ord12557
ord11808
ord2721
ord2725
ord9741
ord7019
ord16697
ord3532
ord291
ord286
ord296
ord1932
ord7072
ord3513
ord5523
ord14882
ord10386
ord537
ord1251
ord5574
ord269
ord968
ord966
ord4163
ord1516
ord375
ord3825
ord15098
ord15096
ord15095
ord10450
ord9929
ord9930
ord14387
ord3059
ord5507
ord957
ord1508
ord617
ord10006
ord4527
ord4556
ord16781
ord5242
ord8317
ord10402
ord1306
ord4261
ord10405
ord7522
ord9226
ord15029
ord9565
ord15676
ord6430
ord15583
ord5869
ord5868
ord5870
ord5867
ord5866
ord11772
ord15750
ord6291
ord4737
ord9846
ord11176
ord11191
ord11181
ord11649
ord11654
ord11193
ord13505
ord11713
ord8151
ord10884
ord13922
ord13886
ord11132
ord14854
ord3163
ord12852
ord14947
ord13020
ord13023
ord2471
ord2560
ord2557
ord7426
ord6620
ord8508
ord546
ord1257
ord2886
ord4996
ord12181
ord11195
ord3706
ord13978
ord10570
ord10562
ord15981
ord7419
ord899
ord898
ord3861
ord14540
ord9592
ord1680
ord1482
ord938
ord946
ord947
ord1899
ord1507
ord593
ord6920
ord6978
ord15848
ord6741
ord6569
ord15634
ord6089
ord9513
ord4464
ord4436
ord9506
ord1290
ord6919
ord1065
ord6297
ord15842
ord9522
ord1577
ord16120
ord7608
ord12811
ord9017
ord3925
ord10408
ord9573
ord14414
ord12367
ord13100
ord8108
ord3792
ord4862
ord10792
ord8868
ord8395
ord384
ord1172
ord579
ord3715
ord2011
ord1280
ord8509
ord549
ord3707
ord9970
ord5873
ord5874
ord7297
ord14351
ord1996
ord7095
ord15909
ord15919
ord7100
ord15917
ord7099
ord5208
ord4625
ord3033
ord5330
ord13171
ord7122
ord10471
ord11016
ord1259
ord2887
ord4997
ord9720
ord10871
ord13559
ord13554
ord6362
ord13979
ord4424
ord5437
ord13901
ord10896
ord13879
ord13236
ord12076
ord10965
ord11088
ord10832
ord5206
ord1054
ord15793
ord3467
ord16048
ord16042
ord8289
ord1570
ord1072
ord10060
ord9046
ord1583
ord16347
ord15932
ord15784
ord377
ord4191
ord9774
ord4549
ord15343
ord16357
ord16730
ord7768
ord3676
ord10783
ord3927
ord15100
ord10449
ord270
ord1852
ord5141
ord5522
ord10767
ord8496
ord16226
ord8773
ord1047
ord3789
ord3912
ord15377
ord6003
ord16095
ord16162
ord1565
ord4377
ord9381
ord14060
ord13806
ord2329
ord13759
ord13758
ord2087
ord16877
ord14431
ord9439
ord17086
ord7597
ord17088
ord7599
ord17087
ord7598
ord16186
ord10046
ord1089
ord8131
ord1176
ord390
ord4434
ord7069
ord14053
ord9730
ord14071
ord14021
ord11133
ord16595
ord16980
ord6869
ord11921
ord1653
ord1643
ord9016
ord11822
ord11818
ord11815
ord11083
ord15316
ord7544
ord4700
ord1249
ord534
ord12769
ord13328
ord9593
ord6358
ord6114
ord10457
ord1213
ord4452
ord3826
ord480
ord1168
ord370
ord4475
ord1569
ord1053
ord5880
ord13974
ord488
ord7809
ord11041
ord4389
ord8856
ord3837
ord8805
ord1641
ord1174
ord5622
ord2287
ord15518
ord388
ord4264
ord4274
ord1664
ord1662
ord3895
ord3894
ord3721
ord3720
ord7865
ord7296
ord7420
ord15983
ord5096
ord2972
ord3258
ord1601
ord14022
ord10915
ord15688
ord16486
ord1096
ord8142
ord10867
ord1255
ord4166
ord542
ord2468
ord1238
ord519
ord10850
ord10383
ord5308
ord9895
ord9233
ord13872
ord6425
ord1665
ord3371
ord16079
ord16389
ord511
ord8492
ord9854
ord4431
ord2469
ord8864
ord2512
ord2633
ord1033
ord10054
ord267
ord11029
ord9994
ord2535
ord13433
ord5093
ord2969
ord15752
ord9913
ord16383
ord6422
ord4384
ord15354
ord5700
ord16922
ord4396
ord1139
ord292
ord302
ord6004
ord1876
ord10894
ord13975
ord492
ord8480
ord1218
ord1170
ord15419
ord6087
ord378
ord13930
ord7418
ord15979
ord3257
ord10868
ord4977
ord2873
ord1216
ord10691
ord12746
ord13136
ord12149
ord4699
ord3960
ord3961
ord3695
ord3696
ord3846
ord3843
ord11926
ord9721
ord11957
ord11959
ord11958
ord11956
ord11960
ord6708
ord13482
ord13483
ord10796
ord13887
ord4418
ord13706
ord17007
ord10614
ord5331
ord3034
ord4679
ord8318
ord12732
ord3801
ord16135
ord14080
ord14078
ord1963
ord1972
ord1980
ord1976
msvcr110d
_initterm_e
_invalid_parameter
memcpy
memcpy_s
_errno
calloc
_recalloc
strcpy
wcscpy
wcsncpy_s
_snwprintf_s
_vsnwprintf_s
_snprintf_s
_vsnprintf_s
_CrtDbgReport
_gmtime64_s
_mktime64
_time64
memcmp
memmove_s
_wcsicmp
memset
strlen
memmove
fclose
_wsplitpath_s
_wmakepath_s
_except_handler4_common
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
?terminate@@YAXXZ
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
??1type_info@@UAE@XZ
_CRT_RTC_INITW
_onexit
__dllonexit
_calloc_dbg
_unlock
_lock
_commode
_fmode
_wcmdln
_initterm
_purecall
__setusermatherr
_configthreadlocale
_cexit
_exit
_CrtSetCheckCount
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
wcscpy_s
fabs
_localtime64_s
exit
wcsftime
strcpy_s
sscanf_s
wcslen
_wtof
__CxxFrameHandler3
_CxxThrowException
??1bad_cast@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
_CrtDbgReportW
free
_unlock_file
_lock_file
ungetc
setvbuf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
kernel32
LocalFree
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
VirtualAlloc
GetSystemInfo
GetCurrentThread
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
OpenEventW
OutputDebugStringW
lstrlenW
MulDiv
MultiByteToWideChar
GetLocalTime
GetTickCount
CopyFileW
GetLastError
CreateMutexW
InterlockedIncrement
InterlockedDecrement
GetCurrentDirectoryW
CloseHandle
SetEvent
WaitForSingleObject
CreateEventW
CreateThread
TerminateThread
GetNativeSystemInfo
InitializeCriticalSectionEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
RaiseException
GetProcAddress
LoadLibraryExW
lstrlenA
LoadLibraryW
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
Sleep
WideCharToMultiByte
WritePrivateProfileStringW
GetPrivateProfileStringW
OutputDebugStringA
IsDebuggerPresent
DecodePointer
EncodePointer
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
user32
OffsetRect
SubtractRect
UnionRect
IsRectEmpty
InflateRect
CopyRect
SetRectEmpty
SetRect
IntersectRect
PtInRect
PeekMessageW
LoadImageW
GetSysColor
SetCursor
LoadIconW
GetCursorPos
MessageBoxW
GetWindowRect
SetWindowLongW
GetWindowLongW
SetLayeredWindowAttributes
IsWindow
EqualRect
gdi32
GetStockObject
GetObjectW
DeleteObject
CreateSolidBrush
shell32
ShellExecuteW
oleaut32
VariantChangeType
VariantInit
GetErrorInfo
SysFreeString
VariantClear
SysAllocString
SetErrorInfo
CreateErrorInfo
msvcp110d
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
??0id@locale@std@@QAE@I@Z
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??1_Container_base12@std@@QAE@XZ
??0_Container_base12@std@@QAE@XZ
?_Debug_message@std@@YAXPB_W0I@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?id@?$ctype@D@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??Bios_base@std@@QBEPAXXZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
??2@YAPAXIABU_DebugHeapTag_t@std@@PADH@Z
??3@YAXPAXABU_DebugHeapTag_t@std@@PADH@Z
?_DebugHeapTag_func@std@@YAABU_DebugHeapTag_t@1@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
advapi32
SetThreadToken
RevertToSelf
OpenThreadToken
Sections
.text Size: 338KB - Virtual size: 338KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 284KB - Virtual size: 283KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ