Static task
static1
Behavioral task
behavioral1
Sample
f01b492fc39af1be0d003477f2d184773c7f482b17d3b7c2f86e20e28d3141e7.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
f01b492fc39af1be0d003477f2d184773c7f482b17d3b7c2f86e20e28d3141e7.exe
Resource
win10v2004-20231023-en
General
-
Target
f01b492fc39af1be0d003477f2d184773c7f482b17d3b7c2f86e20e28d3141e7
-
Size
79KB
-
MD5
94da7495604af7c41d7c5579270026f0
-
SHA1
81d2b8f3dc5ea5c04634cd00f31db9d799378c38
-
SHA256
f01b492fc39af1be0d003477f2d184773c7f482b17d3b7c2f86e20e28d3141e7
-
SHA512
4bd17a1012e32835e4fc3f4db51dde4f687b3fd0f2ba58d803bf89217af0dc6c2ff5f91137b8ceac53f7ffdd266129b91aeb1848f50b978a3954e80b9c552608
-
SSDEEP
768:mjaeBScWkuYg9cY0UwrBfWPZHFm1wv0FfWPyvgzDy+5hRlqy:REScWkLlFWxZoWa4/y+5h3qy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f01b492fc39af1be0d003477f2d184773c7f482b17d3b7c2f86e20e28d3141e7
Files
-
f01b492fc39af1be0d003477f2d184773c7f482b17d3b7c2f86e20e28d3141e7.exe windows:6 windows x64
8ee34c5e914375cd11d42901505b3703
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
GetStartupInfoW
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetCurrentProcessId
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
lstrcpyW
lstrcatW
ExpandEnvironmentStringsW
GetModuleHandleW
SetUnhandledExceptionFilter
CreateDirectoryW
user32
TranslateMessage
MessageBoxW
EndPaint
BeginPaint
DrawTextW
GetClientRect
UpdateWindow
DefWindowProcW
PostMessageW
CreateWindowExW
RegisterClassExW
UnregisterClassW
FillRect
PeekMessageW
PostQuitMessage
DispatchMessageW
ShowWindow
GetSystemMetrics
gdi32
SetBkMode
DeleteObject
CreateSolidBrush
SelectObject
SetTextColor
Polygon
CreatePen
CreateFontW
advapi32
RegCloseKey
RegSetValueExW
RegCreateKeyExW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
urlmon
URLDownloadToFileW
URLOpenBlockingStreamW
msvcp140
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
??Bid@locale@std@@QEAA_KXZ
?good@ios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__current_exception
_CxxThrowException
__C_specific_handler
__std_exception_copy
__std_exception_destroy
__current_exception_context
memcpy
__std_terminate
memmove
api-ms-win-crt-runtime-l1-1-0
_get_narrow_winmain_command_line
_initterm
_initterm_e
_crt_atexit
_exit
_set_app_type
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_beginthreadex
_register_onexit_function
_initialize_onexit_table
_cexit
_invalid_parameter_noinfo_noreturn
terminate
_initialize_narrow_environment
_configure_narrow_argv
exit
api-ms-win-crt-heap-l1-1-0
_callnewh
free
_set_new_mode
malloc
api-ms-win-crt-time-l1-1-0
_time64
_localtime64_s
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ