Static task
static1
Behavioral task
behavioral1
Sample
e160af4d390c23cd30e1f3b09f62c4f4243b891162efe7b6cb65053691e51fe6.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
e160af4d390c23cd30e1f3b09f62c4f4243b891162efe7b6cb65053691e51fe6.exe
Resource
win10v2004-20231020-en
General
-
Target
e160af4d390c23cd30e1f3b09f62c4f4243b891162efe7b6cb65053691e51fe6
-
Size
393KB
-
MD5
919aa33d2d77b0d3a7a2fe14684bc0e6
-
SHA1
c7d9dff9d009c95fa0b5336e4e1da45cec72fd87
-
SHA256
e160af4d390c23cd30e1f3b09f62c4f4243b891162efe7b6cb65053691e51fe6
-
SHA512
74f582fe97fd1b05629c376115cb5f28bcbc89b69210fcebbca52959809aa0d30ab4d78201c2c9de1eaf6de9e6784906e93ca21f56a5b64eaeb6f8663de6d972
-
SSDEEP
6144:ecblO6UPYbiElW4WISqqEMQJ7Y3M/pxN/o17CVDa0LTFORWOcVvGtcVvGvc9e4:bO6UP6iESICk7Y3MooVPXscVvGtcVvG4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e160af4d390c23cd30e1f3b09f62c4f4243b891162efe7b6cb65053691e51fe6
Files
-
e160af4d390c23cd30e1f3b09f62c4f4243b891162efe7b6cb65053691e51fe6.exe windows:5 windows x86 arch:x86
e119c1e781bc80b583b86435015d5c35
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
pegrp32c
ord29
ord4
ord51
ord55
ord20
ord19
ord7
ord3
ord9
ord5
ord50
ord59
ord8
cppsqlite3u
??0CppSQLite3Statement@@QAE@XZ
??4CppSQLite3Statement@@QAEAAV0@ABV0@@Z
?reset@CppSQLite3Statement@@QAEXXZ
?bind@CppSQLite3Statement@@QAEXHH@Z
?execDML@CppSQLite3DB@@QAEHPB_W@Z
??1CppSQLite3DB@@UAE@XZ
??1CppSQLite3Exception@@UAE@XZ
?errorMessage@CppSQLite3Exception@@QAEPB_WXZ
?close@CppSQLite3DB@@QAEXXZ
?finalize@CppSQLite3Query@@QAEXXZ
?nextRow@CppSQLite3Query@@QAEXXZ
?fieldValue@CppSQLite3Query@@QAEPB_WH@Z
?eof@CppSQLite3Query@@QAE_NXZ
?fieldName@CppSQLite3Query@@QAEPB_WH@Z
?numFields@CppSQLite3Query@@QAEHXZ
??1CppSQLite3Query@@UAE@XZ
??4CppSQLite3Query@@QAEAAV0@ABV0@@Z
?execQuery@CppSQLite3DB@@QAE?AVCppSQLite3Query@@PB_W@Z
?execScalar@CppSQLite3DB@@QAEHPB_W@Z
?tableExists@CppSQLite3DB@@QAE_NPB_W@Z
?open@CppSQLite3DB@@QAEXPB_W@Z
??0CppSQLite3Query@@QAE@XZ
??0CppSQLite3DB@@QAE@XZ
??1CppSQLite3Statement@@UAE@XZ
?finalize@CppSQLite3Statement@@QAEXXZ
?execDML@CppSQLite3Statement@@QAEHXZ
?bind@CppSQLite3Statement@@QAEXHPB_W@Z
?compileStatement@CppSQLite3DB@@QAE?AVCppSQLite3Statement@@PB_W@Z
languageapi
?LA_GetString@@YAPB_WPB_W@Z
?LA_SetMenuStrings@@YAHPAUHMENU__@@IPB_W@Z
ord1
?LA_GetDlgStrings@@YAHPAUHWND__@@IPB_W@Z
?GetCurLangFromINI@@YAIXZ
ord2
?SetCurLangToINI@@YAHI@Z
ord3
mfc90u
ord5861
ord1462
ord6044
ord5606
ord2239
ord2204
ord6762
ord2867
ord2859
ord4994
ord5137
ord5939
ord4519
ord2478
ord6614
ord5851
ord2479
ord2695
ord4405
ord6013
ord3185
ord5979
ord4677
ord6553
ord3399
ord1551
ord2442
ord5938
ord4518
ord5549
ord320
ord631
ord361
ord3360
ord1261
ord3003
ord2326
ord938
ord3356
ord761
ord5541
ord557
ord1607
ord285
ord3220
ord6630
ord1137
ord3948
ord4042
ord4895
ord4759
ord3736
ord793
ord588
ord4693
ord1441
ord3681
ord5601
ord4378
ord5294
ord5297
ord4800
ord4805
ord4802
ord4820
ord4823
ord4807
ord5210
ord4599
ord4590
ord5418
ord4516
ord2656
ord6579
ord5624
ord4896
ord2232
ord6160
ord1144
ord1096
ord3819
ord3396
ord4866
ord1696
ord6723
ord4455
ord4727
ord4262
ord3165
ord4773
ord4543
ord6311
ord534
ord2697
ord5886
ord2081
ord2676
ord3166
ord2360
ord5020
ord1041
ord6112
ord2069
ord4266
ord633
ord2045
ord2904
ord3511
ord1674
ord797
ord785
ord2137
ord5611
ord5652
ord6794
ord5595
ord1432
ord2227
ord2265
ord2269
ord3009
ord2297
ord2289
ord2078
ord4396
ord5802
ord4320
ord4614
ord6524
ord1726
ord933
ord4760
ord2593
ord3661
ord3278
ord4663
ord1722
ord1786
ord2286
ord4268
ord3665
ord791
ord3167
ord935
ord287
ord4400
ord4040
ord4171
ord3282
ord4270
ord611
ord686
ord436
ord1503
ord6551
ord1689
ord2100
ord6349
ord2728
ord3160
ord2144
ord758
ord3631
ord554
ord3489
ord4652
ord1665
ord2274
ord2595
ord579
ord781
ord3728
ord899
ord4410
ord4541
ord6095
ord525
ord2470
ord6183
ord3622
ord4010
ord693
ord3563
ord4658
ord2280
ord290
ord291
ord1868
ord6619
ord2222
ord531
ord3061
ord5497
ord4992
ord3742
ord6666
ord1678
ord3155
ord2356
ord3537
ord3577
ord2282
ord4512
ord2130
ord2596
ord1357
ord1108
ord3498
ord3236
ord5166
ord4630
ord3252
ord814
ord3853
ord4013
ord788
ord779
ord585
ord576
ord451
ord4687
ord4698
ord5658
ord2071
ord4431
ord2652
ord980
ord6382
ord6380
ord3232
ord4731
ord5452
ord5449
ord2080
ord1733
ord4126
ord2189
ord2341
ord2340
ord6194
ord6181
ord6338
ord4720
ord5619
ord4766
ord6595
ord1585
ord4451
ord3676
ord3674
ord6636
ord2097
ord6187
ord1354
ord2263
ord3778
ord343
ord619
ord3995
ord1222
ord4717
ord4351
ord3858
ord553
ord3630
ord757
ord1423
ord2901
ord5502
ord4527
ord3859
ord795
ord2431
ord4278
ord1533
ord590
ord744
ord524
ord5342
ord5947
ord6094
ord3057
ord2487
ord4250
ord3422
ord6830
ord6513
ord6169
ord3486
ord6091
ord2592
ord5945
ord2090
ord4641
ord3340
ord3035
ord6439
ord4906
ord4684
ord388
ord650
ord4004
ord3803
ord4324
ord6170
ord6514
ord1599
ord405
ord2209
ord3014
ord3012
ord664
ord6018
ord813
ord5548
ord6275
ord3515
ord4211
ord1186
ord1182
ord1098
ord6482
ord4441
ord457
ord996
ord341
ord5567
ord5675
ord617
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord2447
ord4347
ord4996
ord5680
ord5663
ord3115
ord4905
ord3670
ord589
ord462
ord580
ord794
ord710
ord782
ord4897
ord4893
ord4890
ord4043
ord2597
ord6355
ord316
ord820
ord6604
ord601
ord2277
ord3543
ord2106
ord2537
ord3488
ord5767
ord1243
ord6811
ord367
ord1353
ord333
ord2141
ord636
ord4044
ord2103
ord1601
ord4510
ord1667
ord4654
ord3496
ord615
ord799
ord5618
ord670
ord5448
ord1697
ord4985
ord5354
ord2445
ord2079
ord2860
ord5447
ord5451
ord4730
ord4553
ord3233
ord5338
ord3229
ord6379
ord3230
ord6381
ord981
ord5803
ord3287
ord2651
ord2650
ord4430
ord1681
ord4344
ord5598
ord2070
ord5657
ord2369
ord1380
ord4697
ord6375
ord3225
ord2138
ord4685
ord450
ord4012
ord3852
ord3355
ord6411
ord1493
ord5664
ord3286
ord4681
ord3528
ord595
ord1250
ord265
ord6822
ord5778
ord261
ord266
ord1248
ord3589
ord5008
ord6760
ord4131
ord280
ord909
ord1183
ord811
ord4000
ord2057
ord1938
ord654
ord5632
ord4631
ord5167
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord2074
ord5512
ord6800
ord4603
ord5653
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
msvcr90
fwrite
swprintf_s
printf
vswprintf_s
_waccess
abs
strlen
strcpy
_mbsnbcpy
_onexit
_mbschr
_mbsicmp
strcat
fflush
_wfopen
_mbsstr
realloc
_purecall
_amsg_exit
__wgetmainargs
_cexit
malloc
wcsrchr
wcscpy
memcpy_s
memset
_lock
__dllonexit
wcstok
_itow
rand
wcschr
srand
_wtof
_swprintf
sprintf
free
swscanf
_mktime64
sscanf
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
_invalid_parameter_noinfo
_CxxThrowException
_wtoi
wcsncpy_s
memcpy
_gmtime64
_mbslen
_wtoi64
_wcsicmp
fgetws
wcsncpy
fclose
wcsstr
wcslen
wcscat
wcscmp
strtoul
wcsncmp
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_exit
kernel32
GetLocalTime
lstrcpynW
GetCurrentDirectoryW
SetUnhandledExceptionFilter
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
MulDiv
DeleteFileA
CreateFileA
FlushFileBuffers
CopyFileA
SetCommTimeouts
GetCommTimeouts
SetCommState
CreateDirectoryA
GetDiskFreeSpaceExA
RemoveDirectoryA
FindNextFileA
FindFirstFileA
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
GetTempPathW
SystemTimeToFileTime
IsDebuggerPresent
FileTimeToSystemTime
GetPrivateProfileStringW
GetFileAttributesW
lstrlenA
CopyFileW
lstrlenW
OutputDebugStringW
MultiByteToWideChar
WideCharToMultiByte
MoveFileW
SetFilePointer
RemoveDirectoryW
FindFirstFileW
FindClose
FindNextFileW
CreateDirectoryW
CreateFileW
GetFileSize
ReadFile
CloseHandle
WriteFile
DeleteFileW
GetModuleFileNameW
GetTickCount
user32
PostMessageW
GetParent
MessageBoxW
UpdateWindow
InvalidateRect
IsIconic
GetClientRect
IsWindowVisible
GetActiveWindow
GetCursorPos
GetWindowLongW
PtInRect
GetSubMenu
LoadMenuW
ReleaseDC
RedrawWindow
GetFocus
wsprintfW
SetFocus
EndDialog
GetWindowTextW
GetDlgItem
SendMessageW
CreateWindowExW
ScreenToClient
GetWindowRect
ShowWindow
SetWindowTextW
SystemParametersInfoW
GetSysColor
IsChild
GetKeyState
OffsetRect
LoadCursorW
GetSysColorBrush
EndDeferWindowPos
BeginDeferWindowPos
GetClassLongW
ReleaseCapture
IsRectEmpty
ClientToScreen
GetDCEx
SetCapture
GetWindow
DrawFocusRect
FrameRect
FillRect
InflateRect
CopyRect
SetWindowLongW
EnableWindow
MoveWindow
gdi32
PatBlt
CreateCompatibleBitmap
GetTextColor
ExtTextOutW
CreateCompatibleDC
GetObjectW
BitBlt
CreateFontIndirectW
EnumFontFamiliesW
EndDoc
GetTextMetricsW
GetTextExtentPoint32W
Rectangle
GetStockObject
GetDeviceCaps
EndPage
StartPage
advapi32
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
shell32
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
comctl32
ord17
shlwapi
PathFileExistsW
PathIsDirectoryW
msvcp90
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
dbghelp
MiniDumpWriteDump
Sections
.text Size: 270KB - Virtual size: 269KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ