Static task
static1
Behavioral task
behavioral1
Sample
c357e4e185d19f09682c304769a56b58a33d6c3c0af32c679d5abd4503bd8859.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
c357e4e185d19f09682c304769a56b58a33d6c3c0af32c679d5abd4503bd8859.exe
Resource
win10v2004-20231023-en
General
-
Target
c357e4e185d19f09682c304769a56b58a33d6c3c0af32c679d5abd4503bd8859
-
Size
1.9MB
-
MD5
da5fbb47c9542192bdca3321d43d8071
-
SHA1
78cd1bc497e4745cce5e3e4c765fde5439ec35c5
-
SHA256
c357e4e185d19f09682c304769a56b58a33d6c3c0af32c679d5abd4503bd8859
-
SHA512
125aa99e2601466e322d785a5ded4c55a105b75b74c1f3dd592c1b506abdf4f05728f2b2c518a50ec8921f66c8debbf98ba2261c3788aeafc83a6fbc6932462e
-
SSDEEP
49152:hz1IaC5EyEfRXh0uczZnZrZzRp/ae2ucP+:hzCf5oKu4nXae2uD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c357e4e185d19f09682c304769a56b58a33d6c3c0af32c679d5abd4503bd8859
Files
-
c357e4e185d19f09682c304769a56b58a33d6c3c0af32c679d5abd4503bd8859.exe windows:4 windows x86
dfef40fcb453e1f1f2d0f8fc9081e9c1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileStringW
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
WaitNamedPipeW
FreeLibrary
LocalAlloc
SetFilePointer
WaitForSingleObject
GetExitCodeThread
SetFileAttributesW
GetLocalTime
OutputDebugStringW
GetFileInformationByHandle
FileTimeToSystemTime
GetTempPathW
GetModuleHandleW
WriteFile
lstrlenW
DeleteCriticalSection
ReadFile
GetFileSize
CreateFileW
lstrlenA
FindClose
FindNextFileW
MoveFileExA
SetLastError
FormatMessageA
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
GetEnvironmentVariableA
SleepEx
QueryPerformanceFrequency
GetModuleHandleA
LoadLibraryA
GetSystemDirectoryA
DeleteFileW
FindFirstFileW
GetLastError
CreateDirectoryW
GetFileAttributesW
GetModuleFileNameW
MoveFileExW
RemoveDirectoryW
WideCharToMultiByte
CloseHandle
InitializeCriticalSection
LocalFree
GetTickCount
ReleaseMutex
MultiByteToWideChar
CreateMutexW
GlobalMemoryStatus
GetVersion
FlushConsoleInputBuffer
GetSystemTime
Sleep
GetProcAddress
LoadLibraryW
FindResourceExW
LoadResource
LockResource
SizeofResource
SystemTimeToFileTime
HeapDestroy
HeapAlloc
FindResourceW
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
user32
wsprintfW
GetDesktopWindow
UnregisterClassA
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptDecrypt
CryptSetHashParam
CryptSignHashA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyW
RegCreateKeyExW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CryptEnumProvidersA
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextA
CryptGetUserKey
CryptExportKey
CryptDestroyHash
RegSetValueExW
CryptCreateHash
shell32
SHFileOperationW
ShellExecuteW
ShellExecuteExW
shlwapi
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
msvcp80
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?str@?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
msvcr80
ferror
_stricmp
isspace
tolower
isalpha
isalnum
strchr
strncmp
_wtol
wcscpy_s
wcsncmp
strncpy
rand
srand
_fileno
_fstat64i32
memset
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
abort
_open
_close
_unlink
_write
_read
_access
_strdup
fputc
ftell
_wfopen_s
_vsnprintf_s
fprintf
atoi
malloc
wcsncpy
__RTDynamicCast
_snwprintf
_vsnwprintf_s
wcsstr
wcstok
_wstat32
_recalloc
calloc
free
iswspace
vswprintf_s
_vscwprintf
_wcsicmp
_wcslwr_s
_wtoi
wcschr
_CxxThrowException
__CxxFrameHandler3
_strtoi64
_gmtime64
__sys_nerr
fgets
strspn
strcspn
wcspbrk
wcsspn
wcsrchr
wcscspn
fseek
fwrite
??_V@YAXPAX@Z
vsprintf_s
_vscprintf
fclose
fread
memcpy_s
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_beginthreadex
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
_purecall
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
memmove_s
??3@YAXPAX@Z
_stat64i32
getenv
signal
_getch
isxdigit
isdigit
_setmode
_vsnprintf
raise
strcmp
_strnicmp
_lseeki64
printf
isupper
toupper
_wfopen
_wcslwr
realloc
__iob_func
memcpy
_errno
_mbspbrk
strstr
fopen
strerror
strtoul
strtol
strrchr
_stat64
feof
memmove
_time64
sscanf
qsort
fputs
strcpy_s
strncpy_s
sprintf_s
strcat_s
sprintf
setvbuf
fflush
strpbrk
_getpid
memchr
_fstat64
floor
wldap32
ord32
ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord200
ord30
ord26
ord50
ord143
ord217
ord211
ord22
ord60
ws2_32
send
WSACleanup
WSAStartup
recv
WSAIoctl
setsockopt
getsockname
htons
ntohs
bind
WSASetLastError
connect
socket
getpeername
getsockopt
closesocket
shutdown
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
accept
listen
sendto
recvfrom
__WSAFDIsSet
select
ioctlsocket
gethostname
WSAGetLastError
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 348KB - Virtual size: 345KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE