Static task
static1
Behavioral task
behavioral1
Sample
1e16380e29dc841fe97af163f60e44e1a234c51050b1950d764eeb10f543118b.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
1e16380e29dc841fe97af163f60e44e1a234c51050b1950d764eeb10f543118b.exe
Resource
win10v2004-20231020-en
General
-
Target
1e16380e29dc841fe97af163f60e44e1a234c51050b1950d764eeb10f543118b
-
Size
168KB
-
MD5
3f4c4a81118be339019b0ed2fa16b047
-
SHA1
52c9dc0ac12fb4228138596fcf2dec15bb53f168
-
SHA256
1e16380e29dc841fe97af163f60e44e1a234c51050b1950d764eeb10f543118b
-
SHA512
4e70dce4bbfccaa779400482ff30ff6c9b5557d35ca7c2c89bbd38e364636f5ccbbcaaf330912f06e0788aa98f7ea7ffcd9f07e858156c6acc32b81be557149a
-
SSDEEP
3072:f+7lRkB3BnWeIVYIVCOBaF/pstBaDqwONnct43bBl3N2UGZN:mJwBWdVHUOBaF/p/uwONct43D92U0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1e16380e29dc841fe97af163f60e44e1a234c51050b1950d764eeb10f543118b
Files
-
1e16380e29dc841fe97af163f60e44e1a234c51050b1950d764eeb10f543118b.exe windows:5 windows x86 arch:x86
99b110cd2aae5a89f97646f692a83dfb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc100
ord5532
ord2752
ord2973
ord2974
ord10360
ord10007
ord8137
ord2776
ord7487
ord7875
ord4144
ord4143
ord11781
ord11744
ord3743
ord7862
ord2614
ord3431
ord13280
ord2409
ord1172
ord721
ord1012
ord895
ord5858
ord9286
ord5302
ord5123
ord11103
ord2846
ord2944
ord2945
ord3484
ord11060
ord2338
ord5253
ord12482
ord10672
ord6128
ord13300
ord7074
ord13302
ord2661
ord3984
ord13980
ord3991
ord4401
ord4368
ord4364
ord4398
ord4419
ord4377
ord4406
ord4415
ord4385
ord4389
ord4393
ord4381
ord4410
ord4373
ord12531
ord1507
ord1509
ord1503
ord1496
ord11188
ord11190
ord12644
ord2847
ord8351
ord9994
ord6217
ord11154
ord8070
ord13294
ord10883
ord3395
ord11025
ord8228
ord13973
ord13972
ord14045
ord14062
ord14058
ord14060
ord14061
ord14059
ord2417
ord7349
ord2878
ord2881
ord12535
ord5534
ord3744
ord6680
ord948
ord5776
ord5837
ord3439
ord1982
ord946
ord385
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord7091
ord1732
ord14075
ord10922
ord2416
ord8235
ord11108
ord8330
ord8305
ord5805
ord8506
ord5204
ord5175
ord5176
ord4554
ord4788
ord3970
ord4790
ord12170
ord1479
ord5141
ord12430
ord13181
ord11413
ord12440
ord7211
ord12962
ord4785
ord6970
ord12283
ord12285
ord7206
ord1004
ord457
ord12868
ord3839
ord7581
ord4344
ord9475
ord10030
ord1210
ord788
ord3390
ord3254
ord1929
ord1900
ord1011
ord5857
ord5444
ord1514
ord8227
ord7144
ord13483
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord11172
ord11180
ord4078
ord7355
ord9449
ord11184
ord11153
ord11787
ord4622
ord4903
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9281
ord8304
ord6112
ord2611
ord305
ord5242
ord2626
ord3620
ord1313
ord12672
ord849
ord1890
ord7141
ord1288
ord888
ord6835
ord9399
ord300
ord266
ord265
ord1294
ord1316
ord310
ord4498
ord4283
ord2088
ord901
ord316
ord11067
ord1296
msvcr100
_setmbcp
memset
memcpy
__CxxFrameHandler3
_controlfp_s
_invoke_watson
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_onexit
_lock
__dllonexit
_unlock
strrchr
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
_unlock_file
_lock_file
strncmp
fwrite
fclose
fread
ftell
fseek
fopen
_localtime64
_time64
ungetc
fputc
fgetc
memcpy_s
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
memmove
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
_beginthreadex
sscanf
atof
atoi
strncpy
strstr
_errno
sprintf
_CxxThrowException
kernel32
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetPrivateProfileStringA
WritePrivateProfileStringA
FindFirstFileA
FindClose
WideCharToMultiByte
GetLastError
CreatePipe
GetStartupInfoA
CreateProcessA
ReadFile
Sleep
WaitForSingleObject
DeleteCriticalSection
GetLocalTime
GetFileAttributesA
CreateDirectoryA
GetModuleFileNameA
EncodePointer
DecodePointer
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateThread
IsProcessorFeaturePresent
InitializeCriticalSection
user32
EnableWindow
LoadIconW
IsIconic
TranslateMessage
DispatchMessageA
GetSystemMetrics
GetClientRect
DrawIcon
GetSystemMenu
AppendMenuA
SetTimer
IsWindowVisible
KillTimer
PeekMessageA
PostMessageA
SendMessageA
MsgWaitForMultipleObjects
comctl32
InitCommonControlsEx
ws2_32
WSAStartup
WSACleanup
inet_addr
gethostbyaddr
htons
select
__WSAFDIsSet
send
socket
ioctlsocket
connect
getsockopt
closesocket
recv
ntohl
gethostbyname
searchlib
ord3
ord5
ord7
ord4
ord1
ord2
iphlpapi
GetAdaptersInfo
msvcp100
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ