Static task
static1
Behavioral task
behavioral1
Sample
2194e2358df385704a517908387d815fc32a623c9da88abdf7a54e686dbdfd66.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
2194e2358df385704a517908387d815fc32a623c9da88abdf7a54e686dbdfd66.exe
Resource
win10v2004-20231023-en
General
-
Target
2194e2358df385704a517908387d815fc32a623c9da88abdf7a54e686dbdfd66
-
Size
438KB
-
MD5
12134e43e33907cdbe0efd5241d1ca02
-
SHA1
c8fe9bb74df9d2843279c2776bab44e1ad907d17
-
SHA256
2194e2358df385704a517908387d815fc32a623c9da88abdf7a54e686dbdfd66
-
SHA512
ccba137c34eb3b5cb454072393828da0614d71f1165194e1ee9f1f847c38db2c513024ceb6604c98f51593a0a0d5d401cba4721afa32b7b6f6555508b4de609e
-
SSDEEP
12288:Duv2FllxRAlN3CyDPh2kKuMazW/Cf1SW70:DuVlN3CyDP3JMaz8Cf150
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2194e2358df385704a517908387d815fc32a623c9da88abdf7a54e686dbdfd66
Files
-
2194e2358df385704a517908387d815fc32a623c9da88abdf7a54e686dbdfd66.exe windows:6 windows x86
e2e70bee5456c30f47dfcab80d878145
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
WSAIoctl
setsockopt
socket
WSAStartup
__WSAFDIsSet
WSASetLastError
ntohs
WSACloseEvent
WSACreateEvent
select
accept
bind
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
ioctlsocket
gethostname
send
WSACleanup
connect
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
getsockopt
crypt32
CryptStringToBinaryA
CertFreeCertificateContext
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
wldap32
ord143
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord217
ord45
ord60
ord211
ord46
normaliz
IdnToAscii
kernel32
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
CloseHandle
ReadFile
WaitForMultipleObjects
SleepEx
CreateFileA
GetFileSizeEx
PeekNamedPipe
MoveFileExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetCurrentProcessId
FormatMessageW
SetLastError
GetLastError
WideCharToMultiByte
MultiByteToWideChar
Sleep
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetTickCount
QueryPerformanceCounter
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
VerSetConditionMask
GetComputerNameW
VerifyVersionInfoW
advapi32
CryptImportKey
GetUserNameW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?good@ios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
iphlpapi
GetAdaptersInfo
bcrypt
BCryptGenRandom
vcruntime140
_except_handler4_common
__current_exception_context
__current_exception
strstr
memmove
_CxxThrowException
strrchr
memcpy
strchr
memset
__std_terminate
__std_exception_copy
__std_exception_destroy
__CxxFrameHandler3
memchr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fputc
_lseeki64
fflush
fgets
_open
fopen
__stdio_common_vsprintf
__p__commode
__stdio_common_vsscanf
fclose
ftell
fgetc
feof
ungetc
fputs
fsetpos
fwrite
fseek
fread
__acrt_iob_func
_read
setvbuf
fgetpos
_close
_fseeki64
_get_stream_buffer_pointers
_write
api-ms-win-crt-filesystem-l1-1-0
_fstat64
_stat64
_mkdir
_unlock_file
_unlink
_access
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
_ctime64
strftime
_gmtime64
api-ms-win-crt-string-l1-1-0
strncpy
strpbrk
strspn
_strdup
isdigit
strcspn
strncmp
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_errno
_register_onexit_function
_crt_atexit
_register_thread_local_exe_atexit_callback
terminate
__sys_nerr
_controlfp_s
_invalid_parameter_noinfo_noreturn
_c_exit
_cexit
_beginthreadex
__p___argv
__sys_errlist
__p___argc
_exit
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
realloc
_set_new_mode
calloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtol
wcstombs
atoi
strtoll
strtoul
api-ms-win-crt-math-l1-1-0
_fdopen
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 352KB - Virtual size: 351KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ