Static task
static1
Behavioral task
behavioral1
Sample
09185550875462590bdf5a88ddb62b6b.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
09185550875462590bdf5a88ddb62b6b.exe
Resource
win10v2004-20231023-en
General
-
Target
09185550875462590bdf5a88ddb62b6b.exe
-
Size
2.7MB
-
MD5
09185550875462590bdf5a88ddb62b6b
-
SHA1
87edf56574bf927c08f036948d154f2499b0ac91
-
SHA256
ed89f0f68d4144988f61d163f97595a89b43dd56617ae3af728a070407fabf39
-
SHA512
2ed16cfa8ef19b29d15b7c722b9ae53fe4bee6ac6b2820757e5b54daa6198ddbda579a590d9205e1b182eef65b4bb3b363a3d06a4400de815ae7a9aa5d245222
-
SSDEEP
49152:i8lNSlrqfNG035AjxM/V48vkD6pA560hKbkNBuadn4+1Iyr/i9KMXF6B6tR52VI/:isl35Ajx0kz9+I7y
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09185550875462590bdf5a88ddb62b6b.exe
Files
-
09185550875462590bdf5a88ddb62b6b.exe.exe windows:5 windows x86
89b531beddc86df0685aab06577d3422
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
send
connect
gethostbyname
recv
socket
shutdown
bind
getsockname
closesocket
select
__WSAFDIsSet
WSAGetLastError
htons
inet_addr
ntohs
inet_ntoa
WSAIoctl
ioctlsocket
setsockopt
getsockopt
WSAStartup
kernel32
Process32First
SetConsoleScreenBufferSize
OpenProcess
Sleep
GetConsoleWindow
TerminateProcess
SetConsoleTitleA
CreateDirectoryA
GetStdHandle
FindFirstFileA
RemoveDirectoryA
CopyFileA
FindClose
GetLocalTime
Process32Next
GetConsoleScreenBufferInfo
FindNextFileA
CreateToolhelp32Snapshot
CloseHandle
DeleteFileA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTickCount
GetSystemTimeAsFileTime
GetACP
GetOEMCP
GetComputerNameW
FormatMessageA
GetLastError
SetConsoleTextAttribute
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToFileTime
CompareFileTime
GetSystemTime
CreateSemaphoreA
WaitForSingleObject
ReleaseSemaphore
GetCurrentThreadId
GetProcAddress
GetFullPathNameW
GetCurrentDirectoryA
GetCurrentDirectoryW
DeleteFileW
GetFileAttributesW
CreateDirectoryW
CreateFileW
SetFileAttributesW
MoveFileW
SetFilePointer
CreateThread
SetEndOfFile
ReadFile
WriteFile
GetFileSize
LoadLibraryW
FreeLibrary
LoadLibraryA
GetVersionExA
SetLastError
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
IsProcessorFeaturePresent
QueryPerformanceCounter
user32
SetWindowLongA
GetWindowLongA
SetWindowPos
GetSystemMetrics
advapi32
RegOpenKeyExA
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
CryptExportKey
CryptDestroyKey
CryptCreateHash
CryptSetHashParam
CryptDestroyHash
CryptSignHashA
CryptGenRandom
CryptReleaseContext
CryptGetUserKey
CryptGetProvParam
CryptAcquireContextA
shell32
ShellExecuteA
msvcp100
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xout_of_range@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
msvcr100
_onexit
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_CxxThrowException
_lock
__dllonexit
_unlock
_filelengthi64
fputc
rename
sprintf
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
memmove
_unlock_file
ungetc
fgetpos
_fseeki64
memchr
fflush
system
fgetc
fopen_s
fsetpos
fopen
setvbuf
_lock_file
rand
srand
??3@YAXPAX@Z
memcpy_s
fwrite
ftell
_localtime64
fseek
fclose
_time64
??2@YAPAXI@Z
__CxxFrameHandler3
memset
strchr
memcpy
_stricmp
tolower
strstr
wcsstr
strncmp
free
_dupenv_s
atoi
_strnicmp
toupper
fprintf
_localtime64_s
_mktime64
_tzset
_atoi64
towlower
towupper
isalnum
_fileno
_telli64
_chsize_s
ferror
fread
_filelength
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 713KB - Virtual size: 712KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 63KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 175KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ