??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Static task
static1
Behavioral task
behavioral1
Sample
ef8bfac714686a129a7c5ba9ebf70093019f0da11cc179750e75d74226b169d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
ef8bfac714686a129a7c5ba9ebf70093019f0da11cc179750e75d74226b169d0.exe
Resource
win10v2004-20231023-en
General
-
Target
ef8bfac714686a129a7c5ba9ebf70093019f0da11cc179750e75d74226b169d0
-
Size
1.4MB
-
MD5
f02c080c6183791a6180ea3635980b87
-
SHA1
42d70884dcb62597ec020733ef32064a81ab61ee
-
SHA256
ef8bfac714686a129a7c5ba9ebf70093019f0da11cc179750e75d74226b169d0
-
SHA512
a47d6c329d63084f178aac32f7d0a2c3845cf54e7ab22d27c23c2277396d7bf8a5aa76fa46e811326f5e571feb3a552b2783739a8604d2f3383b3a31cdb7ca37
-
SSDEEP
24576:LZwZ64P1PuHnBEGmHScU4CbaP4adLg/R9YX+:LZJ4PsOjHSc4ba/dLgp9YX+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef8bfac714686a129a7c5ba9ebf70093019f0da11cc179750e75d74226b169d0
Files
-
ef8bfac714686a129a7c5ba9ebf70093019f0da11cc179750e75d74226b169d0.exe windows:4 windows x86
6658e50c8f22b263c41bf1c0b22888f9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
uilogic
CreateUiOptions
GetRecordObj
ws2_32
send
WSAGetLastError
closesocket
socket
connect
inet_addr
WSACleanup
WSAStartup
gethostbyname
inet_ntoa
recv
bind
listen
accept
htons
encrypt
HexToStr
CreateEncryptObject
BRCrc32
StrToHex
shlwapi
PathIsDirectoryW
PathIsNetworkPathW
PathFindFileNameW
StrStrIW
PathAppendW
PathFileExistsW
enumfolder
CreateEnumRemoteFolder
comn
GetObjectLog
GetObjectSys
mpr
WNetGetUniversalNameW
brlog
GetBrLogMgr
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
kernel32
GetProcAddress
GetModuleFileNameW
CreateFileW
SetUnhandledExceptionFilter
GetCurrentThreadId
WaitForSingleObject
GetVersionExW
OpenProcess
Process32FirstW
Process32NextW
HeapAlloc
TerminateProcess
GetLastError
GetProcessHeap
Sleep
HeapFree
CreateToolhelp32Snapshot
CreateMutexW
GetFileAttributesW
LocalAlloc
MultiByteToWideChar
LocalFree
SetFileAttributesW
GetTickCount
SetFileTime
WriteFile
GetFileSizeEx
DeleteFileW
ReadFile
InitializeCriticalSection
ReleaseMutex
lstrcpyW
DeleteCriticalSection
EnterCriticalSection
CreateEventW
LeaveCriticalSection
SetFilePointer
GetFileTime
FlushFileBuffers
GetDriveTypeW
WinExec
GetModuleHandleW
OutputDebugStringW
OutputDebugStringA
CreateDirectoryA
GetQueuedCompletionStatus
MoveFileExW
GetModuleFileNameA
PostQueuedCompletionStatus
SetEvent
GetVolumeInformationW
CreateThread
MoveFileW
CreateDirectoryW
ReadDirectoryChangesW
GetExitCodeProcess
CreateIoCompletionPort
RemoveDirectoryW
GetFileAttributesExW
GetFileInformationByHandle
GetCurrentThread
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetDiskFreeSpaceExW
SystemTimeToFileTime
GetPrivateProfileIntW
GetSystemInfo
HeapSize
GetFullPathNameW
QueryPerformanceCounter
GetFullPathNameA
LockFileEx
FormatMessageW
GetDiskFreeSpaceW
GetVersionExA
HeapDestroy
HeapReAlloc
CreateFileA
InterlockedCompareExchange
GetFileAttributesA
HeapCreate
GetFileSize
UnlockFile
LoadLibraryA
LockFile
HeapValidate
HeapCompact
CreateFileMappingA
WaitForSingleObjectEx
GetTempPathA
GetSystemTime
CreateFileMappingW
AreFileApisANSI
TryEnterCriticalSection
UnlockFileEx
DeleteFileA
MapViewOfFile
GetDiskFreeSpaceA
GetSystemTimeAsFileTime
UnmapViewOfFile
FormatMessageA
SetEndOfFile
GetTempPathW
DeviceIoControl
IsBadWritePtr
IsBadReadPtr
GetWindowsDirectoryW
GetSystemDirectoryW
CreatePipe
GetStartupInfoW
PeekNamedPipe
CreateProcessW
SetFilePointerEx
WriteConsoleA
WriteConsoleW
SetLastError
lstrlenW
GetPrivateProfileStringA
GetCurrentProcess
GetCurrentProcessId
CloseHandle
InterlockedExchange
UnhandledExceptionFilter
IsDebuggerPresent
FindFirstFileW
FindClose
FindNextFileW
RaiseException
user32
PostThreadMessageW
PostMessageW
ShowWindow
UpdateWindow
DispatchMessageW
LoadCursorW
DefWindowProcW
RegisterClassExW
EndPaint
CharUpperW
FindWindowW
TranslateAcceleratorW
KillTimer
DestroyWindow
TranslateMessage
LoadStringW
GetMessageW
LoadAcceleratorsW
BeginPaint
SendMessageW
SetTimer
CreateWindowExW
PostQuitMessage
UnregisterClassA
wsprintfW
LoadIconW
advapi32
RegQueryInfoKeyW
RegEnumKeyW
RegDeleteValueW
RegSetValueExW
RegSetValueExA
RegFlushKey
RegOpenKeyW
RegQueryValueExW
BuildExplicitAccessWithNameW
SetThreadToken
OpenThreadToken
RegOpenKeyExW
RegDeleteValueA
RegOpenKeyA
RegCloseKey
RegQueryValueExA
CreateProcessAsUserW
DuplicateTokenEx
GetLengthSid
SetSecurityDescriptorDacl
GetTokenInformation
AddAccessAllowedAce
InitializeSecurityDescriptor
InitializeAcl
OpenProcessToken
LookupAccountNameW
SetEntriesInAclW
GetNamedSecurityInfoW
GetSecurityDescriptorLength
FreeSid
EqualSid
AdjustTokenPrivileges
AllocateAndInitializeSid
SetNamedSecurityInfoW
GetAclInformation
SetFileSecurityW
LookupPrivilegeValueW
GetAce
shell32
SHGetFolderPathA
SHGetFolderPathW
ole32
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeSecurity
oleaut32
SysAllocString
SysFreeString
msvcp80
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
msvcr80
_msize
memmove
strcpy_s
strncpy
_vsnprintf
strtol
_vsnwprintf
strftime
rand
calloc
isalnum
strchr
_CxxThrowException
isspace
isalpha
tolower
ferror
fputc
_vsnprintf_s
_fsopen
_itoa
_strnicmp
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CxxFrameHandler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
toupper
_vscprintf
_vscwprintf
vsprintf
srand
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
memcpy
wcscmp
swprintf_s
_wcsicmp
_invalid_parameter_noinfo
wcsstr
??2@YAPAXI@Z
memset
wcslen
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
wcscat_s
??0exception@std@@QAE@ABQBD@Z
wcscpy_s
??0exception@std@@QAE@ABV01@@Z
strcat
wcscat
wcsrchr
wcscpy
wcschr
strncpy_s
_beginthread
sprintf
strrchr
strncat_s
_wcsnicmp
malloc
printf
vswprintf_s
wcstombs
memcpy_s
_purecall
strlen
??_V@YAXPAX@Z
_beginthreadex
memmove_s
iswalpha
_wfopen_s
fprintf
fclose
fopen_s
vsprintf_s
_time64
_localtime64
sprintf_s
fwprintf
fwrite
fseek
ftell
fread
memcmp
fprintf_s
strstr
fgets
wcsncpy
_mktime64
mbstowcs
_vswprintf
atoi
strcmp
strncmp
realloc
_endthreadex
free
_localtime64_s
wtsapi32
WTSQuerySessionInformationW
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winhttp
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetTimeouts
WinHttpAddRequestHeaders
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpOpen
WinHttpConnect
WinHttpReadData
WinHttpOpenRequest
Exports
Exports
Sections
.text Size: 876KB - Virtual size: 875KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 104KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 32KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 388KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE