Static task
static1
Behavioral task
behavioral1
Sample
59a8f2a2475bd660b1c4e648e2a449b05fe869749a56cd93c7e25faad1ffff13.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
59a8f2a2475bd660b1c4e648e2a449b05fe869749a56cd93c7e25faad1ffff13.exe
Resource
win10v2004-20231020-en
General
-
Target
59a8f2a2475bd660b1c4e648e2a449b05fe869749a56cd93c7e25faad1ffff13
-
Size
1.6MB
-
MD5
52e082a406fe1e638a92e02e3f58702d
-
SHA1
80fa2afeeec158f27f66446df8e266542115b2e6
-
SHA256
59a8f2a2475bd660b1c4e648e2a449b05fe869749a56cd93c7e25faad1ffff13
-
SHA512
83deda37b96ffde55f9392b3139ee4b47c07ae518594b50c40d8dfdbab056c5f4afc6d6630076987ed42bbfa63127fbb6c38e57eabbda91b02002a2989d072a1
-
SSDEEP
49152:tyVDVnpmskAbEi2bj68js3djaPIjmA8CB:aVn0sRbEi2bj9Cl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 59a8f2a2475bd660b1c4e648e2a449b05fe869749a56cd93c7e25faad1ffff13
Files
-
59a8f2a2475bd660b1c4e648e2a449b05fe869749a56cd93c7e25faad1ffff13.exe windows:6 windows x86 arch:x86
f6ae9f7481cc7c95912f90e3eeea64ac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
aegiscommon
??1CResourceMonitor@@UAE@XZ
??0CResourceMonitor@@QAE@XZ
?InitAegisCommon@aqs@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?StartMonitor@CResourceMonitor@@QAE_NPAVIResourceMonitorEvent@@@Z
?StopMonitor@CResourceMonitor@@QAE_NXZ
?SetThreadHeartbeat@CResourceMonitor@@QAEXIABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H@Z
?RemoveThreadHeartbeat@CResourceMonitor@@QAEXI@Z
?GetHttpInstance@@YAPAVIHttpInterface@@XZ
advapi32
DeregisterEventSource
RegisterEventSourceA
ReportEventA
ws2_32
getsockname
getsockopt
htons
ntohs
getpeername
socket
WSASetLastError
getaddrinfo
freeaddrinfo
__WSAFDIsSet
select
accept
listen
recvfrom
sendto
connect
closesocket
bind
send
recv
WSAGetLastError
gethostname
inet_ntoa
WSAStartup
WSACleanup
gethostbyname
ioctlsocket
shutdown
setsockopt
wldap32
ord79
ord35
ord301
ord200
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord30
user32
GetProcessWindowStation
GetUserObjectInformationW
GetDesktopWindow
MessageBoxA
aqsipc
InitIpcClient
IpcSendData
IsIpcClientNeedConnect
ConnectIpcServer
IpcRegData
aqsutil
??1CMutexUtil@aqs@@QAE@XZ
?StringToInt@CStringUtil@aqs@@SA_JABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_NH@Z
?stringRemove@CStringUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@0@Z
?zlibCompress@CZipUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?toBase64@CAlgorithmUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?toHex@CAlgorithmUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?xxAesEncrypt@CAlgorithmUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@@Z
?IsFile@CFileUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WriteNewFile@CFileUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
??0CFileInfo@aqs@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1CFileInfo@aqs@@QAE@XZ
?fileName@CFileInfo@aqs@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?log@CLogMessage@aqs@@QAAXW4AqsLogLevel@2@PBDH1ZZ
?xxAesDecrypt@CAlgorithmUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@@Z
??0CMutexUtil@aqs@@QAE@XZ
?GetInstance@CLogMessage@aqs@@SAPAV12@XZ
?IntToString@CStringUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JPA_NH@Z
??1CTimeUtil@aqs@@QAE@XZ
?GetCurrentDataTime@CTimeUtil@aqs@@SA?AV12@XZ
?GetHour@CTimeUtil@aqs@@QAEHXZ
?GetMinute@CTimeUtil@aqs@@QAEHXZ
?GetSecond@CTimeUtil@aqs@@QAEHXZ
?GetYear@CTimeUtil@aqs@@QAEHXZ
?GetMonth@CTimeUtil@aqs@@QAEHXZ
?GetDayOfMonth@CTimeUtil@aqs@@QAEHXZ
?WriteLogMessage@CLogMessage@aqs@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4AqsLogLevel@2@@Z
?IsDir@CDirUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?MakeDirPath@CDirUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?RemoveFile@CFileUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Terminate@CToolUtil@aqs@@SAXXZ
?msleep@CToolUtil@aqs@@SAX_K@Z
?GetApplicationDirPath@CToolUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??1CMutexLockUtil@aqs@@QAE@XZ
??0CMutexLockUtil@aqs@@QAE@PAVCMutexUtil@1@@Z
?stringEqual@CStringUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?stringToLower@CStringUtil@aqs@@SA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?stringSplit@CStringUtil@aqs@@SA?AV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@0_N@Z
?UIntToString@CStringUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KPA_NH@Z
?GetCurrOsThreadId@CThreadUtil@aqs@@SA_JXZ
?endLoop@CTimerLoop@aqs@@SAXXZ
?stringEndWith@CStringUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?stringReplace@CStringUtil@aqs@@SAHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@1@Z
?stringTrimmed@CStringUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?StringToUInt@CStringUtil@aqs@@SA_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PA_NH@Z
?GetThreadName@CThreadUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J@Z
?GetProcessUtil@aqs@@YAPAVIProcessUtil@1@XZ
?strprintf@CStringUtil@aqs@@SA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBDZZ
?GetTreadTime@CThreadInfo@aqs@@SA_K_J@Z
?stringStartWith@CStringUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_N@Z
?MakeDir@CDirUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?startTimer@CTimerEvent@aqs@@IAE_K_K0@Z
??1CTimerEvent@aqs@@QAE@XZ
??0CTimerEvent@aqs@@QAE@XZ
?s2s_utf8@CStringUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?IsX64System@CToolUtil@aqs@@SA_NXZ
?QuickToString@CTimeUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_J@Z
?GetCurrentDetailTm@CTimeUtil@aqs@@SA_JAAUtm@@@Z
?s2ws@CStringUtil@aqs@@SA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?ws2s@CStringUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?waitForThreadFinish@CThreadUtil@aqs@@IAE_NXZ
?startThread@CThreadUtil@aqs@@IAE_NXZ
?IsThreadRunning@CThreadUtil@aqs@@QAE_NXZ
?SetThreadName@CThreadUtil@aqs@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1CThreadUtil@aqs@@QAE@XZ
??0CThreadUtil@aqs@@QAE@XZ
?ToTime_t@CTimeUtil@aqs@@QAE_JXZ
?NewInstance@?$CSingleton@VCGetTickClock@aqs@@@@SAPAVCGetTickClock@aqs@@XZ
?exec@CTimerLoop@aqs@@SAXXZ
?UpdateDstFlag@CTimeUtil@aqs@@SAXXZ
?SetLogLevel@CLogMessage@aqs@@QAEXW4AqsLogLevel@2@@Z
?SetLogRelativePath@CLogMessage@aqs@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?InitThreadRandom@CThreadUtil@aqs@@SAXXZ
?SetPthreadId@CThreadUtil@aqs@@SAXXZ
?SetCurrentDir@CDirUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0CSingleApp@aqs@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?ReadFullFile@CFileUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$vector@CV?$allocator@C@std@@@4@I@Z
?fromBase64@CAlgorithmUtil@aqs@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
??1CSingleApp@aqs@@QAE@XZ
?ReadFullFile@CFileUtil@aqs@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@I@Z
aqsfilter
?GetDriverFsFilter@@YAPAVIDriverFsFilter@@XZ
kernel32
OpenThread
CreateToolhelp32Snapshot
DeleteCriticalSection
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
SuspendThread
QueryDosDeviceA
GetDriveTypeA
GetLogicalDriveStringsA
GetLastError
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreW
GetModuleHandleW
EnterCriticalSection
SetLastError
GetVersionExA
FreeLibrary
LoadLibraryA
SleepEx
GetTickCount
FormatMessageA
Sleep
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetVersion
GetModuleHandleA
MultiByteToWideChar
QueryPerformanceCounter
Thread32Next
LeaveCriticalSection
Thread32First
GlobalMemoryStatus
GetSystemDirectoryW
LoadLibraryW
CreateEventW
TlsFree
InitializeCriticalSection
EncodePointer
DecodePointer
SetProcessAffinityMask
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentThread
GetCurrentProcess
SetUnhandledExceptionFilter
TlsSetValue
GetProcAddress
TlsGetValue
TlsAlloc
DuplicateHandle
ResetEvent
SetEvent
ResumeThread
SetThreadContext
GetThreadContext
GetThreadPriority
SetThreadPriority
RaiseException
OpenProcess
GetProcessAffinityMask
InterlockedCompareExchange
InterlockedExchangeAdd
InterlockedExchange
InterlockedIncrement
FlushConsoleInputBuffer
CreateFileA
msvcp120
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??1_Container_base12@std@@QAE@XZ
??0_Container_base12@std@@QAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Winerror_map@std@@YAPBDH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
?setf@ios_base@std@@QAEHH@Z
?setf@ios_base@std@@QAEHHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
dbghelp
SymGetModuleBase64
SymGetLineFromAddr
SymCleanup
SymFunctionTableAccess
SymGetModuleBase
MiniDumpWriteDump
StackWalk
SymInitialize
SymFromAddr
EnumerateLoadedModules64
msvcr120
memmove
_snprintf_s
_purecall
??3@YAXPAX@Z
_set_invalid_parameter_handler
strrchr
??2@YAPAXI@Z
free
malloc
realloc
memchr
_mbsicmp
strtol
??_V@YAXPAX@Z
_time64
atoi
calloc
memcpy
memset
strchr
strncmp
__iob_func
fclose
fgets
fopen
fputs
sscanf
qsort
_strtoi64
_errno
tolower
strstr
fread
fseek
isxdigit
strncpy
fwrite
strtoul
isalpha
isdigit
isalnum
_gmtime64
fputc
sprintf
strerror
__sys_nerr
_beginthreadex
isspace
fflush
_lseeki64
_fstat64
getenv
_stat64
abort
_open
_stat64i32
_exit
wcsstr
vfprintf
_vsnprintf
raise
strcmp
feof
ferror
_fileno
ftell
_wfopen
_write
_setmode
_strnicmp
_stricmp
fprintf
isupper
islower
isprint
isgraph
_ftime64
signal
_getch
modf
memcmp
strlen
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_CxxThrowException
__CxxFrameHandler3
_strtoui64
strtod
sprintf_s
strpbrk
_vacopy
_set_errno
_get_errno
exit
_strdup
wcsncat_s
longjmp
_endthreadex
_ftime64_s
_setjmp3
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except1
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_memicmp
_close
_read
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 361KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ