Static task
static1
Behavioral task
behavioral1
Sample
osk.exe
Resource
win10v2004-20231023-en
General
-
Target
osk.exe
-
Size
574KB
-
MD5
d49b6a24b175d6377ad62e9c6690e75b
-
SHA1
4c8a22ccf76c3587474ad54e04dedc9d75754db5
-
SHA256
5d26ba9f19deb94a36730cdebc8282ef0a29fb27d1746a0184a833bb053ce3dd
-
SHA512
51baf1288e34d5e549637993c4168e496aa17818edeee3334b4fe65f15a4c6a9a4a339a596192e979c52471277fbb6f0832a51a2a31bcae7f0413325b0fee7d1
-
SSDEEP
6144:QRT99mOdaa5s/8Vuc5H3AdKy9HGeofJgDEvr6slnCUGw/xIRLtxIRLuovZO7:QhVyPjmNwzaoo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource osk.exe
Files
-
osk.exe.exe windows:10 windows x86
8ebb64009fb0d0cdcf619ebbe7b78bf9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
EventUnregister
RegOpenKeyExW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
RegSetValueExW
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
EventRegister
RegCloseKey
EventWrite
RegQueryValueExW
RegCreateKeyExW
RegDeleteValueW
RegGetValueW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegEnumKeyExW
RegLoadMUIStringW
RegNotifyChangeKeyValue
kernel32
HeapDestroy
HeapFree
OpenMutexW
GetSystemDefaultLocaleName
K32GetModuleBaseNameW
K32EnumProcessModules
K32EnumProcesses
DeleteFileW
GetFileAttributesW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
OpenProcess
CreateThread
SetEvent
CreateEventW
IsProcessInJob
OpenJobObjectW
WaitForSingleObject
GetModuleFileNameW
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxW
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
HeapReAlloc
GetStartupInfoW
GetStringTypeExW
GetModuleHandleW
GetProcAddress
Sleep
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
GlobalAddAtomW
GlobalDeleteAtom
LoadLibraryExW
MulDiv
GetTickCount
LocaleNameToLCID
GetCurrentProcessId
ResolveLocaleName
ProcessIdToSessionId
LCIDToLocaleName
FreeResource
GetUserPreferredUILanguages
GetLocaleInfoEx
ExpandEnvironmentStringsW
GetProcessHeap
HeapAlloc
RegisterApplicationRestart
LoadResource
FindResourceExW
HeapSetInformation
CloseHandle
LockResource
GetLastError
GetTickCount64
CreateMutexW
SetProcessShutdownParameters
SizeofResource
UnhandledExceptionFilter
HeapSize
RaiseException
DeleteCriticalSection
InitializeCriticalSection
gdi32
GetStockObject
GetDeviceCaps
user32
UnregisterClassA
GetWindowMinimizeRect
IsIconic
FindWindowW
TranslateMessage
PeekMessageW
CreateDialogParamW
GetKeyState
GetShellWindow
GetUserObjectInformationW
GetThreadDesktop
SendNotifyMessageW
SetWindowFeedbackSetting
MessageBoxW
SetDlgItemTextW
SendDlgItemMessageW
SetFocus
GetDlgItem
CheckDlgButton
EnableWindow
AdjustWindowRectEx
AllowSetForegroundWindow
MonitorFromPoint
MonitorFromWindow
RemovePropW
GetSystemMetrics
SetClassLongW
IsWindow
GetMonitorInfoW
SetWindowPlacement
GetDoubleClickTime
SetPropW
LoadIconW
ChangeWindowMessageFilterEx
SetWindowLongW
SetForegroundWindow
GetWindowLongW
GetWindowThreadProcessId
GetMessageExtraInfo
GetWindowRect
GetDC
GetPropW
MonitorFromRect
CallNextHookEx
GetCursorInfo
WindowFromPhysicalPoint
MapVirtualKeyExW
MapWindowPoints
GetKeyboardLayout
GetForegroundWindow
UnhookWindowsHookEx
SetLayeredWindowAttributes
LoadCursorW
GetClassNameW
SetWindowsHookExW
SetWinEventHook
GetParent
PtInRect
UnhookWinEvent
InvalidateRect
ReleaseDC
GetGUIThreadInfo
SendInput
SetWindowPos
CreateWindowExW
ScreenToClient
SendMessageW
SetTimer
GetClientRect
KillTimer
SystemParametersInfoW
LoadImageW
GetCursorPos
GetMessageW
PostMessageW
DestroyWindow
LoadStringW
ShowWindow
DispatchMessageW
IsDialogMessageW
msvcrt
wcschr
_ltow_s
memcpy_s
wcsrchr
_wcslwr_s
_wcsicmp
__CxxFrameHandler3
_wtoi
_except_handler4_common
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
malloc
memset
wcsstr
wcscpy_s
free
calloc
wcstoul
_vsnwprintf
wcscspn
memmove_s
wcsspn
_ftol2_sse
osksupport
UninitializeOSKSupport
InitializeOSKSupport
dwmapi
DwmSetWindowAttribute
gdiplus
GdiplusStartup
GdiplusShutdown
ntdll
WinSqmIncrementDWORD
WinSqmSetDWORD
WinSqmAddToStream
NtQueryWnfStateData
WinSqmIsOptedIn
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleacc
AccessibleObjectFromWindow
AccSetRunningUtilityState
oleaut32
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
winmm
joySetCapture
joyReleaseCapture
PlaySoundW
waveOutGetNumDevs
wmsgapi
WmsgSendMessage
duser
InvalidateGadget
dui70
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
??1HWNDElement@DirectUI@@UAE@XZ
??0HWNDElement@DirectUI@@QAE@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
UnInitThread
?ThemeChange@HWNDElement@DirectUI@@SG?AVUID@@XZ
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?ElementFromPoint@HWNDElement@DirectUI@@QAEPAVElement@2@PAUtagPOINT@@@Z
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
UnInitProcessPriv
?EndDefer@Element@DirectUI@@QAEXK@Z
InitThread
InitProcessPriv
?Register@HWNDElement@DirectUI@@SGJXZ
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
??0NativeHWNDHost@DirectUI@@QAE@XZ
?Initialize@NativeHWNDHost@DirectUI@@QAEJPBG0PAUHWND__@@PAUHICON__@@HHHHHHPAUHINSTANCE__@@I@Z
??1NativeHWNDHost@DirectUI@@UAE@XZ
?CreateHostWindow@NativeHWNDHost@DirectUI@@UAEPAUHWND__@@KPBG0KHHHHPAU3@PAUHMENU__@@PAUHINSTANCE__@@PAX@Z
?SetWidth@Element@DirectUI@@QAEJH@Z
?SetHeight@Element@DirectUI@@QAEJH@Z
?SetX@Element@DirectUI@@QAEJH@Z
?SetY@Element@DirectUI@@QAEJH@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?Remove@Element@DirectUI@@QAEJPAV12@@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
?GetClassInfoW@HWNDElement@DirectUI@@UAEPAUIClassInfo@2@XZ
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?Destroy@Layout@DirectUI@@QAEXXZ
?Destroy@Element@DirectUI@@QAEJ_N@Z
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?DoubleBuffered@Element@DirectUI@@QAEX_N@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
shell32
ShellExecuteW
Sections
.text Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 469KB - Virtual size: 469KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ