Static task
static1
Behavioral task
behavioral1
Sample
302d3ff6588b3878b4afe6d3c1f3292beb96ad8f508eda7bdbb645ba47ef12ad.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
302d3ff6588b3878b4afe6d3c1f3292beb96ad8f508eda7bdbb645ba47ef12ad.exe
Resource
win10v2004-20231023-en
General
-
Target
302d3ff6588b3878b4afe6d3c1f3292beb96ad8f508eda7bdbb645ba47ef12ad
-
Size
2.0MB
-
MD5
4e7382f06886418eb8b89d43b4c55bb7
-
SHA1
736b7035cf0dc2b8f5f2e609d308f0677fe86e97
-
SHA256
302d3ff6588b3878b4afe6d3c1f3292beb96ad8f508eda7bdbb645ba47ef12ad
-
SHA512
c409e492b03feae1f1625c4c41e8b152d8cfd6ec3100ba1c3d2ecd8f844154b61678f964aba7aa7921a3af0f2cb608d2936cc9512994cee5f78b221584e6c5f1
-
SSDEEP
49152:XpycT9g/fGCu3c92DXgLtPUkyyK9mdc/NN:Xpy9/QsdCkyy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 302d3ff6588b3878b4afe6d3c1f3292beb96ad8f508eda7bdbb645ba47ef12ad
Files
-
302d3ff6588b3878b4afe6d3c1f3292beb96ad8f508eda7bdbb645ba47ef12ad.exe windows:6 windows x86 arch:x86
1081b4e2e39ad75fc86e4be9b88264db
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAStartup
ioctlsocket
recvfrom
sendto
getsockopt
inet_addr
select
gethostbyname
WSAIoctl
connect
getpeername
htons
getaddrinfo
freeaddrinfo
ntohs
accept
htonl
recv
getprotobyname
send
getsockname
bind
gethostname
socket
setsockopt
listen
WSAGetLastError
WSAPoll
WSASetLastError
shutdown
closesocket
crypt32
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreA
CertGetNameStringA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
shlwapi
PathFindExtensionW
PathRemoveFileSpecW
rpcrt4
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrClientCall2
kernel32
IsProcessorFeaturePresent
IsDebuggerPresent
TerminateProcess
SystemTimeToFileTime
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
GetConsoleMode
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
QueryPerformanceCounter
CreateFiber
DeleteFiber
SwitchToFiber
GetFileType
FindFirstFileW
FindNextFileW
GetModuleFileNameW
FindClose
LoadLibraryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
lstrcmpiW
HeapFree
OpenProcess
CloseHandle
HeapAlloc
GetCurrentProcessId
GetProcessHeap
GetPrivateProfileIntW
lstrcatW
GlobalAlloc
GlobalFree
Sleep
GetSystemTimeAsFileTime
MultiByteToWideChar
CreateFileW
GetFileSize
GetFileSizeEx
ReadFile
SetFilePointerEx
WriteFile
CompareFileTime
GetLastError
WideCharToMultiByte
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetStdHandle
GetEnvironmentVariableW
InitializeSListHead
user32
wsprintfW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
advapi32
CryptGetUserKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptSignHashW
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptEnumProvidersW
ole32
CoInitializeEx
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Xlength_error@std@@YAXPBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?uncaught_exception@std@@YA_NXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
bcrypt
BCryptGenRandom
vcruntime140
_except_handler4_common
_CxxThrowException
__current_exception_context
__current_exception
wcsstr
memchr
strrchr
memset
strstr
memmove
memcpy
strchr
_purecall
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
exit
_register_thread_local_exe_atexit_callback
_c_exit
_invalid_parameter_noinfo_noreturn
_beginthreadex
strerror_s
__p___argc
_initterm_e
terminate
_initterm
_get_initial_narrow_environment
_exit
__p___argv
raise
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_controlfp_s
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_errno
signal
api-ms-win-crt-heap-l1-1-0
realloc
malloc
free
_set_new_mode
_callnewh
api-ms-win-crt-string-l1-1-0
isspace
_stricmp
strcspn
_strnicmp
strspn
tolower
strncmp
strpbrk
strcmp
strncpy
isalnum
strnlen
api-ms-win-crt-stdio-l1-1-0
_wfopen
_setmode
_fileno
fgets
fflush
feof
_close
fwrite
_isatty
_open
__stdio_common_vsscanf
_lseek
__stdio_common_vswprintf
fputs
__acrt_iob_func
__stdio_common_vfprintf
_set_fmode
__stdio_common_vsprintf
__stdio_common_vsprintf_s
ftell
fseek
fread
fopen
__p__commode
fclose
ferror
_read
_write
api-ms-win-crt-convert-l1-1-0
atol
atoi
strtol
strtoul
atoll
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_mktime64
_time64
_tzset
__timezone
__daylight
_mkgmtime64
_gmtime64_s
_localtime64
api-ms-win-crt-utility-l1-1-0
qsort
rand
api-ms-win-crt-filesystem-l1-1-0
rename
_stat64i32
_unlink
_wstat32i64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 426KB - Virtual size: 426KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ