Static task
static1
Behavioral task
behavioral1
Sample
03745da6d54513e625a47b8839c9a5bd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
03745da6d54513e625a47b8839c9a5bd.exe
Resource
win10v2004-20231222-en
General
-
Target
03745da6d54513e625a47b8839c9a5bd
-
Size
424KB
-
MD5
03745da6d54513e625a47b8839c9a5bd
-
SHA1
06219aa7546cfdd3526d9c2f2bfdfa5ee1e90cd0
-
SHA256
7e0fcc9c2e86cfc467461c08e73384c5c1e9eec175df334cb2235a4cc60cc1d9
-
SHA512
5dfd0d1bbe8e5153d25c4848c3270d80533a43ac823309b7c0d1205c66dba3a619fb8752fa8a05bd5f658a09b39d998dabcde20876598611f79478632ca400de
-
SSDEEP
6144:wkxZKzHh8Alb81cOwgJtdyalskqoF+n41jgLQB36fW5H+T0b4fl3KGK9UmM7E:WxuUbal3m49oQZ6fWMT0sflge7E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03745da6d54513e625a47b8839c9a5bd
Files
-
03745da6d54513e625a47b8839c9a5bd.exe windows:4 windows x86 arch:x86
494ae8b8e52287a754c27c505e586c8a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
inet_ntoa
inet_addr
WSAStartup
sendto
socket
htons
htonl
closesocket
iphlpapi
GetAdaptersInfo
kernel32
lstrlenA
GetProcAddress
LoadLibraryW
InterlockedIncrement
lstrlenW
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
Sleep
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
WideCharToMultiByte
RaiseException
SetEvent
ResetEvent
CloseHandle
CreateEventW
WaitForMultipleObjects
DeleteTimerQueueTimer
CreateTimerQueueTimer
SetUnhandledExceptionFilter
SetErrorMode
WaitForSingleObject
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCurrentThreadId
OpenMutexW
TerminateThread
CreateThread
CreateMutexW
SizeofResource
MultiByteToWideChar
LoadResource
FindResourceW
FindResourceExW
GetModuleHandleW
GetVolumeInformationA
GetTickCount
WritePrivateProfileStringA
GetPrivateProfileStringA
GetSystemDirectoryA
GetFileAttributesW
MoveFileW
DeleteFileW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
ExitProcess
FreeLibrary
GetStartupInfoW
GetModuleHandleA
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
InitializeCriticalSection
DeleteCriticalSection
GetPrivateProfileIntW
GetPrivateProfileStringW
GetModuleFileNameW
GetLastError
LocalFree
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
LockResource
InterlockedExchange
user32
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
IsWindow
PostMessageW
PostThreadMessageW
TrackMouseEvent
MoveWindow
GetDesktopWindow
GetParent
GetWindow
SystemParametersInfoW
MapWindowPoints
SendMessageW
SetWindowPos
InvalidateRect
PeekMessageW
IsWindowEnabled
KillTimer
SetTimer
DestroyWindow
ShowWindow
CallWindowProcW
GetWindowLongW
DefWindowProcW
UpdateLayeredWindow
CreateWindowExW
EqualRect
IsRectEmpty
GetClientRect
GetWindowRect
SetWindowLongW
BeginPaint
EndPaint
PostQuitMessage
gdi32
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteDC
DeleteObject
SelectObject
advapi32
RegQueryValueExW
RegOpenKeyExW
ole32
OleUninitialize
OleCreate
OleSetContainedObject
CoCreateInstance
OleRun
OleInitialize
CoUninitialize
CoInitialize
OleDraw
oleaut32
VariantChangeType
VariantCopy
VariantInit
DispCallFunc
VariantClear
SysStringLen
LoadTypeLi
LoadRegTypeLi
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
GetErrorInfo
atl71
ord23
ord64
ord40
ord48
ord47
ord42
ord45
ord44
ord43
ord61
ord27
ord32
ord31
ord58
ord54
ord11
ord10
ord65
ord66
ord28
comctl32
InitCommonControlsEx
msvcp71
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Nomemory@std@@YAXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
msvcr71
_itoa
malloc
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_purecall
time
_time64
rand
srand
memmove
_vscwprintf
vswprintf
_except_handler3
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_set_purecall_handler
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
_set_error_mode
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_set_new_mode@@YAHH@Z
_wcsicmp
_wtoi
wcsstr
sprintf
strrchr
wcscpy
_ultoa
atol
wcsncpy
wcscat
wcsrchr
memset
_callnewh
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__security_error_handler
_controlfp
??1exception@@UAE@XZ
??_V@YAXPAX@Z
free
__CxxFrameHandler
wcslen
??3@YAXPAX@Z
_CxxThrowException
Sections
.text Size: 120KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tc Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE