Static task
static1
Behavioral task
behavioral1
Sample
03305baa52123025a6484b76d38ba81c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
03305baa52123025a6484b76d38ba81c.exe
Resource
win10v2004-20231215-en
General
-
Target
03305baa52123025a6484b76d38ba81c
-
Size
1.8MB
-
MD5
03305baa52123025a6484b76d38ba81c
-
SHA1
9b4cae790221cdf070fe05e8b003f276c3904753
-
SHA256
e8871eddb28ac84811030563d333561d95efbb4e90c765f5ed98e5ef40f31d16
-
SHA512
7e81bbfa01e0badd28a634b16291a89bafdafdcacb943b63d25744813a4f76a69a632d61e7d041ce0210e23e396ec6742a865b465ca7dc66403ffee83ce60b4a
-
SSDEEP
24576:f1V9p4otkEax9xO0KxEo6OKNXTsKXCjyAnHi4q6IB1ESb:f/9pNtQxnf7OqXoKXE/s1x
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03305baa52123025a6484b76d38ba81c
Files
-
03305baa52123025a6484b76d38ba81c.exe windows:4 windows x86 arch:x86
96bd1a8db3691a3138a6dc9d890c9d27
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
bugreport
ord2
ord3
ord7
ord6
ord1
winmm
PlaySoundA
shlwapi
PathSkipRootA
StrTrimA
PathStripToRootA
PathCompactPathA
PathAddBackslashA
PathIsSameRootA
PathFileExistsA
PathCombineA
SHGetValueA
SHDeleteKeyA
SHSetValueA
PathIsDirectoryA
PathIsUNCA
PathRemoveFileSpecA
PathIsRootA
PathFindExtensionA
PathIsURLA
wininet
InternetSetCookieA
mfc42
ord6615
ord4497
ord1642
ord2862
ord1140
ord4277
ord6877
ord4278
ord6663
ord3708
ord781
ord801
ord541
ord6136
ord6134
ord3061
ord3089
ord3092
ord4476
ord3097
ord5953
ord5951
ord5981
ord6215
ord939
ord941
ord6883
ord6283
ord6282
ord6143
ord2642
ord6880
ord6197
ord4204
ord1200
ord861
ord6662
ord2380
ord5710
ord5861
ord3810
ord3759
ord920
ord5683
ord4129
ord1199
ord2915
ord3303
ord2301
ord3398
ord3733
ord810
ord4271
ord6008
ord4000
ord3287
ord3914
ord4506
ord1099
ord3742
ord818
ord2567
ord755
ord470
ord1175
ord1233
ord2100
ord693
ord1601
ord1194
ord798
ord2393
ord1997
ord6929
ord5465
ord532
ord1133
ord6876
ord2411
ord2023
ord4218
ord4398
ord3582
ord3573
ord5788
ord1641
ord3317
ord5875
ord2754
ord2859
ord2513
ord293
ord6358
ord1088
ord2122
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord5307
ord5289
ord5714
ord3738
ord815
ord561
ord538
ord6928
ord6930
ord1205
ord2621
ord1134
ord6438
ord2725
ord3499
ord2515
ord355
ord4698
ord1151
ord1193
ord926
ord665
ord1979
ord6385
ord5442
ord5186
ord354
ord6927
ord3706
ord4133
ord4297
ord472
ord3571
ord3619
ord556
ord1270
ord1232
ord1168
ord640
ord3797
ord3138
ord5785
ord1640
ord323
ord4299
ord1271
ord2431
ord3807
ord6178
ord6172
ord4287
ord2089
ord3719
ord2363
ord3098
ord4220
ord2584
ord3654
ord2438
ord2362
ord4538
ord4774
ord6270
ord2863
ord2546
ord291
ord1644
ord1146
ord2578
ord6648
ord2297
ord3873
ord500
ord772
ord6142
ord5860
ord1229
ord5232
ord2147
ord1180
ord1568
ord5268
ord2149
ord3297
ord5572
ord4171
ord6605
ord2582
ord3370
ord3286
ord6907
ord6007
ord3998
ord2292
ord2365
ord2289
ord3903
ord699
ord6888
ord3438
ord912
ord397
ord2096
ord6675
ord3301
ord6380
ord6442
ord4123
ord1829
ord2453
ord5789
ord1929
ord1949
ord2450
ord2455
ord2763
ord816
ord562
ord2919
ord1842
ord4242
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord975
ord5472
ord2879
ord2878
ord4151
ord4077
ord5237
ord2649
ord1665
ord674
ord366
ord4457
ord1113
ord6564
ord6565
ord6619
ord2117
ord5252
ord4427
ord1114
ord3906
ord4413
ord3403
ord955
ord5282
ord6379
ord5882
ord2920
ord4499
ord6828
ord4724
ord5030
ord3870
ord3021
ord5054
ord5805
ord4590
ord2817
ord4337
ord4436
ord3920
ord2587
ord4406
ord3394
ord3729
ord804
ord6785
ord2135
ord5794
ord2688
ord4400
ord3630
ord682
ord3693
ord6696
ord6654
ord3910
ord4243
ord2358
ord2298
ord3318
ord5782
ord1176
ord2714
ord3302
ord5431
ord3348
ord4351
ord2989
ord3353
ord3579
ord696
ord2625
ord394
ord4021
ord2033
ord4185
ord5590
ord3435
ord909
ord3443
ord3786
ord5628
ord1105
ord2078
ord1572
ord465
ord857
ord4188
ord2097
ord6762
ord5856
ord3220
ord697
ord910
ord4186
ord395
ord4219
ord2581
ord1771
ord6366
ord2413
ord2024
ord4401
ord3639
ord692
ord5678
ord5736
ord4124
ord2580
ord2299
ord2652
ord1669
ord6407
ord3296
ord703
ord5445
ord404
ord3290
ord2123
ord668
ord3178
ord3181
ord4058
ord2781
ord2770
ord356
ord1795
ord3496
ord4480
ord326
ord6130
ord4034
ord1154
ord4020
ord5148
ord297
ord619
ord5606
ord5933
ord3880
ord2116
ord4148
ord2574
ord3572
ord2452
ord2753
ord2639
ord2405
ord2713
ord6625
ord2921
ord2923
ord4454
ord4364
ord6862
ord6593
ord6594
ord6931
ord6860
ord6749
ord6491
ord620
ord6802
ord6820
ord2585
ord4365
ord1709
ord1714
ord4404
ord5258
ord3722
ord796
ord529
ord4265
ord6067
ord6000
ord3294
ord4115
ord4759
ord5039
ord5063
ord1871
ord1147
ord654
ord5858
ord341
ord2064
ord5448
ord3986
ord3273
ord786
ord2504
ord438
ord1706
ord430
ord2461
ord6389
ord519
ord5645
ord1265
ord853
ord1574
ord4694
ord3732
ord4270
ord5873
ord2784
ord6779
ord2152
ord6194
ord4333
ord2408
ord6242
ord4268
ord6603
ord4083
ord6604
ord4284
ord2012
ord5885
ord5884
ord3289
ord2922
ord4163
ord554
ord384
ord807
ord3730
ord2444
ord5248
ord5064
ord5279
ord6369
ord5234
ord1715
ord1710
ord5086
ord2389
ord4121
ord5471
ord4056
ord4366
ord2530
ord6154
ord3295
ord3293
ord3996
ord6905
ord3640
ord4402
ord4275
ord3874
ord2107
ord2044
ord2448
ord2841
ord5834
ord616
ord809
ord3610
msvcrt
_wcsicmp
_setmbcp
_stricmp
_strcmpi
__CxxFrameHandler
memcpy
memset
strlen
_mbsicmp
atoi
memmove
strcpy
_mbscmp
islower
isupper
isalpha
memcmp
wcscmp
_beginthreadex
_mbsnbcmp
_mbschr
__p___argv
_mbsnbicmp
__p___argc
_flushall
_CxxThrowException
_ftol
_mbsnbcat
_itoa
_purecall
rand
srand
time
abs
strcmp
wcslen
_mbctoupper
_strupr
swprintf
_mbstok
sprintf
sscanf
strncpy
_mbsnbcpy
_atoi64
_except_handler3
difftime
strcat
isalnum
_mbsstr
_wtoi
_mbsrchr
_ismbcalpha
_mbsinc
strchr
_mbsicoll
__dllonexit
_onexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
kernel32
CreateMutexA
GetLastError
OpenEventA
GetTickCount
GetCommandLineA
GetLocalTime
OpenFileMappingA
MapViewOfFile
CreateEventA
WaitForSingleObject
ResetEvent
TerminateThread
CloseHandle
GetCurrentProcess
TerminateProcess
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualQuery
GlobalAlloc
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
SetPriorityClass
lstrcpynA
lstrlenA
GetPrivateProfileIntA
lstrcmpA
lstrcmpiA
GetCurrentThreadId
MultiByteToWideChar
DeleteFileA
GetStartupInfoA
GetPrivateProfileStringA
OutputDebugStringA
CreateProcessA
ReleaseMutex
FindNextFileA
lstrcatA
GetSystemDirectoryA
RemoveDirectoryA
lstrlenW
WriteFile
ReadFile
GetFileSize
CreateFileA
GlobalMemoryStatus
lstrcpyA
ResumeThread
SetThreadPriority
GetExitCodeThread
Sleep
LockResource
LoadResource
FindResourceA
GetModuleHandleA
WritePrivateProfileStringA
CreateFileMappingA
UnmapViewOfFile
SetProcessWorkingSetSize
InitializeCriticalSection
DeleteCriticalSection
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
_lclose
OpenFile
GetFullPathNameA
IsBadReadPtr
CopyFileA
InterlockedIncrement
InterlockedDecrement
GlobalFree
GlobalSize
GetVersionExA
GetSystemDefaultLangID
SetFileAttributesA
UnhandledExceptionFilter
GetTimeFormatA
GetDateFormatA
OpenProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
WaitForMultipleObjects
CreateDirectoryA
GetVolumeInformationA
GetDiskFreeSpaceExA
MoveFileA
GetModuleFileNameA
GetSystemInfo
Module32Next
Module32First
GetCurrentProcessId
WriteProcessMemory
VirtualProtectEx
GetSystemTime
WideCharToMultiByte
GetWindowsDirectoryA
EnumResourceNamesA
SizeofResource
LocalFree
SetEvent
LocalAlloc
user32
ModifyMenuA
EnableMenuItem
CheckMenuRadioItem
FillRect
GetClipboardOwner
ChangeClipboardChain
SetClipboardViewer
MonitorFromPoint
GetMonitorInfoA
SystemParametersInfoA
IsZoomed
GetDlgCtrlID
SetWindowPos
RemoveMenu
InsertMenuA
GetWindowThreadProcessId
GetSystemMetrics
LoadBitmapA
GetMenuStringA
GetIconInfo
GetMenuItemInfoA
SetMenuItemInfoA
GetWindow
DrawTextA
SetForegroundWindow
IsIconic
GetLastActivePopup
GetCapture
GetFocus
ClientToScreen
IsWindowEnabled
GetActiveWindow
SetActiveWindow
PeekMessageA
DrawIcon
LoadMenuA
GetMenuItemCount
SendMessageA
EnableWindow
KillTimer
GetMenuItemID
IsClipboardFormatAvailable
GetClipboardData
GetSubMenu
LoadImageA
TranslateMessage
GetMessageA
DispatchMessageA
CopyIcon
GetDC
ReleaseDC
ReleaseCapture
SetCapture
SetRectEmpty
SetRect
DrawFrameControl
GetCursor
DestroyCursor
GetClassInfoA
SetWindowRgn
GetSysColorBrush
CallWindowProcA
DrawEdge
DrawStateA
EnumThreadWindows
CheckMenuItem
SetParent
GetDlgItem
GetForegroundWindow
AttachThreadInput
GetDCEx
GetWindowLongA
SetWindowLongA
MessageBoxA
FindWindowA
GetPropA
RegisterWindowMessageA
GetKeyState
DrawFocusRect
GetSysColor
InflateRect
OpenClipboard
EmptyClipboard
SetClipboardData
GetDesktopWindow
AnimateWindow
SetWindowTextA
GetTopWindow
MapWindowPoints
SetFocus
ExitWindowsEx
EnumChildWindows
AppendMenuA
RegisterClipboardFormatA
CreatePopupMenu
GetAncestor
WindowFromPoint
keybd_event
TrackPopupMenuEx
GetMenu
SetMenu
ScreenToClient
ShowWindow
EqualRect
GetUpdateRect
ValidateRect
FrameRect
CloseClipboard
IsWindowVisible
DeleteMenu
CopyRect
MoveWindow
GetClientRect
GetCursorPos
PtInRect
UpdateWindow
IsWindow
IntersectRect
IsRectEmpty
DrawIconEx
LoadIconA
DestroyIcon
GetWindowRect
UnhookWindowsHookEx
SetWindowsHookExA
GetClassNameA
CallNextHookEx
GetParent
LoadCursorA
SetCursor
PostMessageA
InvalidateRect
OffsetRect
SetTimer
DefWindowProcA
EndDialog
BringWindowToTop
gdi32
GetStockObject
SetTextColor
SetBkMode
SetStretchBltMode
CreateFontA
GetCurrentObject
GetTextColor
BeginPath
EndPath
FillPath
CreatePenIndirect
PatBlt
OffsetRgn
CreateRectRgnIndirect
GetTextMetricsA
CreatePen
CreateRectRgn
CreateRoundRectRgn
CombineRgn
GetTextExtentPoint32A
RoundRect
GetTextExtentExPointA
StretchBlt
PtInRegion
CreateFontIndirectA
GetObjectA
GetPixel
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateBitmap
FillRgn
CreatePolygonRgn
CreateSolidBrush
Rectangle
SetPixel
SelectObject
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyA
RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteExA
SHGetSpecialFolderPathA
SHFileOperationA
Shell_NotifyIconA
SHChangeNotify
SHGetFileInfoA
ShellExecuteA
comctl32
ImageList_Remove
ImageList_Draw
ImageList_LoadImageA
ImageList_DragEnter
ImageList_BeginDrag
ImageList_Destroy
ImageList_DragMove
ImageList_EndDrag
ImageList_DragLeave
ImageList_GetImageInfo
_TrackMouseEvent
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_DragShowNolock
ImageList_GetImageCount
ImageList_AddMasked
ole32
CLSIDFromProgID
StringFromCLSID
CLSIDFromString
ProgIDFromCLSID
RegisterDragDrop
RevokeDragDrop
StgOpenStorage
StgCreateDocfile
CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
oleaut32
VariantCopy
VariantClear
SysStringLen
SysAllocString
SysAllocStringLen
SysFreeString
msvcp60
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_fstream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
ws2_32
inet_addr
imagehlp
CheckSumMappedFile
ImageDirectoryEntryToData
ImageNtHeader
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 840KB - Virtual size: 837KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 188KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 760KB - Virtual size: 757KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ