Static task
static1
Behavioral task
behavioral1
Sample
BTD5-Win.exe
Resource
win10v2004-20231023-en
General
-
Target
BTD5-Win.exe
-
Size
9.0MB
-
MD5
28e81870d11b4d20b5b18ead685564e7
-
SHA1
9b4be40642e8bfb22f71cdac1eb3bbc8b7cd7e18
-
SHA256
dc39dc303a39bf88e913c4f1100af334ddb5a97cb441410d25bf92cff0d5ce2a
-
SHA512
51ecc2ce90609b8f49edf6dfaa01e220a3e82eb3d8ca9a45916f20c80e7552fffe53e5bbde00ca14780510bc89a2b2622cf60a4180c64a27e28b0f9cab84592f
-
SSDEEP
196608:eX3HkMrwSWftvFmjTzDJnJkw8MwtCxZ7H:eH7wTMjTxJP8beH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BTD5-Win.exe
Files
-
BTD5-Win.exe.exe windows:6 windows x86
ad5a58a5352d5fdcf6f928fd99a91945
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
opengl32
wglCreateContext
wglGetCurrentContext
wglGetProcAddress
wglMakeCurrent
wglDeleteContext
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
comctl32
InitCommonControlsEx
steam_api
SteamAPI_IsSteamRunning
SteamAPI_Init
SteamUtils
SteamUser
SteamAPI_RunCallbacks
SteamFriends
SteamMatchmaking
SteamAPI_RegisterCallback
SteamUserStats
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallResult
SteamAPI_Shutdown
SteamAPI_UnregisterCallback
SteamApps
SteamHTMLSurface
SteamRemoteStorage
kernel32
CloseHandle
SetEvent
GetProcessHeap
HeapFree
WaitForSingleObjectEx
HeapAlloc
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
Sleep
GetModuleFileNameW
LoadLibraryW
GetProcAddress
ReleaseSemaphore
DuplicateHandle
GetCurrentProcess
CreateSemaphoreA
GetSystemTimeAsFileTime
K32GetProcessMemoryInfo
QueryPerformanceCounter
RaiseException
QueryPerformanceFrequency
OpenEventA
ResetEvent
GetCurrentProcessId
GetLastError
TlsAlloc
TlsFree
GetTickCount
GetModuleHandleA
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
OutputDebugStringA
SetFilePointer
ReadFile
CreateFileW
GetOverlappedResult
ReadFileEx
CreateEventW
WaitForMultipleObjects
TlsGetValue
SetWaitableTimer
GetQueuedCompletionStatus
CreateEventA
SleepEx
TlsSetValue
WideCharToMultiByte
TerminateThread
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
VerifyVersionInfoW
SetLastError
QueueUserAPC
PostQueuedCompletionStatus
CreateIoCompletionPort
FindResourceW
LoadResource
GetModuleHandleW
SizeofResource
LockResource
GetFileAttributesW
RemoveDirectoryW
DeviceIoControl
CopyFileW
AreFileApisANSI
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
FormatMessageA
FreeLibrary
LoadLibraryA
VerifyVersionInfoA
GetTickCount64
InitializeCriticalSectionEx
GetStdHandle
GetFileType
PeekNamedPipe
ExpandEnvironmentStringsA
GetModuleFileNameA
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
WaitForSingleObject
WaitForMultipleObjectsEx
ResumeThread
CreateWaitableTimerA
SystemTimeToFileTime
FormatMessageW
VerSetConditionMask
user32
GetKeyboardState
SendMessageW
DispatchMessageW
DefWindowProcW
ToUnicode
UpdateWindow
MessageBoxW
AdjustWindowRectEx
CreateWindowExW
ShowWindow
LoadStringW
SetWindowPos
GetDesktopWindow
SetWindowLongW
ReleaseDC
PeekMessageW
SystemParametersInfoW
GetCursorInfo
LoadIconW
RegisterClassExW
LoadImageW
ShowCursor
TranslateMessage
GetDC
GetClientRect
PostMessageW
GetWindowRect
MapVirtualKeyW
SetCursor
DestroyWindow
gdi32
GetDeviceCaps
ChoosePixelFormat
SetPixelFormat
SwapBuffers
shell32
SHGetFolderPathW
ShellExecuteW
ole32
CoCreateInstance
msvcp120
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?id@?$ctype@D@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?toupper@?$ctype@D@std@@QBEDD@Z
??Bid@locale@std@@QAEIXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPBD@Z
?id@?$codecvt@_WDH@std@@2V0locale@2@A
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?classic@locale@std@@SAABV12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7facet@locale@std@@6B@
??_7?$codecvt@_WDH@std@@6B@
??_7codecvt_base@std@@6B@
??_7_Facet_base@std@@6B@
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy
_Mtx_unlock
_Mtx_lock
_Mtx_init
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
_Cnd_init
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Release@_Pad@std@@QAEXXZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
??1_Pad@std@@QAE@XZ
??0_Pad@std@@QAE@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
_Xtime_get_ticks
_Cnd_destroy
_Thrd_detach
_Thrd_sleep
_Xtime_diff_to_millis2
xtime_get
_Cnd_broadcast
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tolower@?$ctype@D@std@@QBEDD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
?exceptions@ios_base@std@@QAEXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Swap_all@_Container_base12@std@@QAEXAAU12@@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?_BADOFF@std@@3_JB
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?do_length@?$codecvt@_WDH@std@@MBEHAAHPBD1I@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
msvcr120
??2@YAPAXI@Z
??8type_info@@QBE_NABV0@@Z
__RTtypeid
srand
_localtime64
_time64
clock
memchr
_gmtime64
_mktime64
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
?terminate@@YAXXZ
atoi
toupper
strtod
fputc
_unlock_file
ungetc
fgetpos
_fseeki64
fflush
_errno
fgetc
fsetpos
setvbuf
_lock_file
memcpy_s
fwrite
fclose
__iob_func
feof
ferror
fopen
fprintf
fread
freopen
getc
free
realloc
strchr
strerror
strncmp
strstr
memcpy
localeconv
ldexp
sprintf
strpbrk
strspn
_CIfmod
_libm_sse2_pow_precise
floor
longjmp
abort
_setjmp3
frexp
strcoll
strftime
?wait@Concurrency@@YAXI@Z
?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ
isspace
strtol
tolower
_vsprintf_p
atof
sscanf
malloc
?before@type_info@@QBE_NABV1@@Z
mbstowcs
rename
remove
sprintf_s
iswprint
isdigit
strncat
_snprintf
calloc
_vsnprintf_s
ftell
fseek
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
puts
fminf
_beginthreadex
rewind
isalnum
isalpha
_CxxThrowException
__CxxFrameHandler3
_stricmp
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
_except1
_vsnprintf
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
strrchr
strncpy
ispunct
memset
_purecall
rand
??_V@YAXPAX@Z
memmove
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
__RTDynamicCast
__sys_nerr
fgets
fputs
qsort
strtoll
_mbschr
_mbsnbcpy
isxdigit
strtoul
_lseeki64
_fstat64
_getpid
getenv
_stat64
isupper
islower
isprint
isgraph
clearerr
_ftelli64
_pclose
_popen
tmpfile
setlocale
system
_difftime64
tmpnam
iscntrl
_HUGE
_CIatan2
_CIcosh
_CIsinh
_CItanh
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_cos_precise
_libm_sse2_exp_precise
_libm_sse2_log10_precise
_libm_sse2_log_precise
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
ceil
_strdup
_read
_write
_strnicmp
_close
_open
__CxxLongjmpUnwind
??3@YAXPAX@Z
ws2_32
WSACleanup
WSAStartup
select
accept
WSAStringToAddressW
listen
getsockopt
closesocket
ioctlsocket
shutdown
freeaddrinfo
bind
setsockopt
connect
WSAAddressToStringW
ntohl
htonl
getaddrinfo
WSARecv
WSASocketW
__WSAFDIsSet
recv
send
getpeername
socket
WSAIoctl
recvfrom
sendto
gethostname
WSASend
WSAGetLastError
htons
ntohs
WSASetLastError
getsockname
winmm
mmioDescend
mmioAscend
mmioAdvance
mmioClose
mmioOpenW
mmioSeek
mmioGetInfo
mmioSetInfo
mmioRead
wininet
InternetGetConnectedState
shlwapi
PathFindFileNameW
PathRemoveExtensionW
advapi32
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptHashData
wldap32
ord41
ord60
ord211
ord46
ord143
ord301
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord50
ord200
ord30
Sections
.text Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 739KB - Virtual size: 832KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 21B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 250KB - Virtual size: 249KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 602KB - Virtual size: 602KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.bind Size: 125KB - Virtual size: 125KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ