Static task
static1
Behavioral task
behavioral1
Sample
21cf9a86c8e082ee695187ae502f9018.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
21cf9a86c8e082ee695187ae502f9018.exe
Resource
win10v2004-20231222-en
General
-
Target
21cf9a86c8e082ee695187ae502f9018
-
Size
876KB
-
MD5
21cf9a86c8e082ee695187ae502f9018
-
SHA1
790a41c673af71d1885208599e2c6693dd84d64d
-
SHA256
4d6bd403cfb73db133eb6a4cbc64603e19e8635b7d535f909272bc362ce963a6
-
SHA512
ce4a3634f51e2d2af3710a026e989407192d18dafc47b19565c08863e32e9342a9adc1027a5b1f8f3ec3c0a1ad5aa1863dce949e855352aa538cb7b2e685a6b6
-
SSDEEP
12288:hSrXt8WYyCqxJzt6GDuXUaRER9C+Ga5YfWP:6XtPxJzjDuXfs1Zn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21cf9a86c8e082ee695187ae502f9018
Files
-
21cf9a86c8e082ee695187ae502f9018.exe windows:4 windows x86 arch:x86
88e0d640686155047cb92f0df695ac7d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ResetEvent
WaitForSingleObject
InitializeCriticalSection
GetModuleFileNameW
lstrcatW
lstrcpyW
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteCriticalSection
HeapDestroy
GetCommandLineW
lstrcmpiW
CreateEventW
CloseHandle
Sleep
GetCurrentProcess
FlushInstructionCache
lstrcmpW
GlobalLock
GetStartupInfoW
DeleteAtom
GlobalReAlloc
MulDiv
LocalLock
LocalUnlock
CreateThread
GetFileSize
EnumUILanguagesW
SetErrorMode
OpenMutexW
ReleaseMutex
CreateMutexW
ExpandEnvironmentStringsW
IsDBCSLeadByteEx
CompareStringW
LocalAlloc
GlobalUnlock
FindResourceW
LoadResource
LockResource
lstrlenW
GlobalAlloc
GlobalHandle
GlobalFree
FreeResource
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetPriorityClass
GetModuleHandleW
GetCurrentThread
GetProcessHeap
HeapAlloc
HeapFree
GetExitCodeProcess
GetVersionExW
OpenProcess
TerminateProcess
CreateProcessW
WriteFile
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
RemoveDirectoryW
CreateDirectoryW
GetTempFileNameW
WideCharToMultiByte
DeleteFileW
CopyFileW
MultiByteToWideChar
CreateFileW
SetFilePointer
lstrlenA
GetTempPathW
ReadFile
FindFirstFileW
FindNextFileW
FindClose
SetEvent
InterlockedIncrement
QueryPerformanceFrequency
QueryPerformanceCounter
GetLastError
FormatMessageW
GetLocalTime
SetLastError
OutputDebugStringW
LocalFree
GetCurrentProcessId
user32
LoadImageW
SendMessageW
KillTimer
RegisterWindowMessageW
PostMessageW
PostThreadMessageW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
wsprintfW
CreateWindowExW
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableW
GetDesktopWindow
RedrawWindow
LoadStringW
SetForegroundWindow
EnumChildWindows
EnumWindows
IsWindowVisible
GetWindowThreadProcessId
DrawFocusRect
ScreenToClient
InflateRect
SetDlgItemTextW
ModifyMenuW
IsMenu
LoadBitmapW
FindWindowW
ShowWindow
MessageBoxW
GetWindowDC
SetRect
SetPropW
SetCursor
RemovePropW
GetPropW
PtInRect
MapDialogRect
GetDialogBaseUnits
BringWindowToTop
EnableWindow
DestroyWindow
GetClassNameW
GetFocus
IsChild
SetFocus
GetDC
ReleaseDC
BeginPaint
FillRect
EndPaint
CallWindowProcW
GetDlgItem
GetSysColor
GetWindowTextLengthW
GetWindowTextW
SetWindowLongW
DefWindowProcW
GetClassInfoExW
LoadCursorW
RegisterClassExW
DialogBoxIndirectParamW
GetActiveWindow
EndDialog
IsWindow
SetTimer
GetWindowLongW
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
SetWindowTextW
GetSystemMetrics
gdi32
ExtTextOutW
Rectangle
GetPixel
MaskBlt
CreateDIBSection
ExtCreateRegion
CombineRgn
CreateBitmap
SetBkColor
GetDIBits
CreateDCW
CreateFontIndirectW
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
CreateSolidBrush
GetDeviceCaps
GetObjectW
GetStockObject
SetTextColor
advapi32
GetSidSubAuthority
CryptReleaseContext
RegNotifyChangeKeyValue
GetSidSubAuthorityCount
GetSidIdentifierAuthority
OpenProcessToken
OpenThreadToken
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegEnumKeyExW
RegEnumValueW
RegRestoreKeyW
GetSecurityDescriptorSacl
CheckTokenMembership
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
CryptHashData
CryptGetHashParam
CryptDestroyHash
shell32
SHFileOperationW
Shell_NotifyIconW
SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
ole32
CoUninitialize
CoRegisterClassObject
CoInitialize
CoResumeClassObjects
OleLockRunning
CoCreateGuid
StringFromGUID2
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CoRevokeClassObject
CreateStreamOnHGlobal
oleaut32
VariantInit
SysAllocStringByteLen
SysStringByteLen
RegisterTypeLi
LoadTypeLi
OleCreateFontIndirect
VariantClear
LoadRegTypeLi
SysStringLen
SysAllocString
SysAllocStringLen
SysFreeString
VariantChangeType
VariantCopy
msi
ord205
ord70
olepro32
ord251
comctl32
InitCommonControlsEx
msimg32
AlphaBlend
msvcp60
?_Xran@std@@YAXXZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?_Xlen@std@@YAXXZ
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??7ios_base@std@@QBE_NXZ
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?find_first_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?find_last_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Ostd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBG@Z
?find_last_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
msvcrt
memset
_close
_write
_wopen
_wstrtime
_wstrdate
_vsnwprintf
malloc
wcschr
iswalnum
iswdigit
tolower
isdigit
iswxdigit
memcpy
strstr
_strupr
wcsncpy
wcscmp
towupper
_wcsupr
wcscpy
wcsncmp
_wcslwr
strlen
localtime
swscanf
_ltow
_wtol
_ultow
_itow
_wtoi
wcsstr
strncpy
_CxxThrowException
realloc
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
wcstok
time
free
_wcsicmp
_beginthreadex
_purecall
??2@YAPAXI@Z
__CxxFrameHandler
wcslen
shlwapi
PathRemoveFileSpecW
wininet
InternetSetOptionW
InternetQueryOptionW
InternetCloseHandle
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetGetConnectedState
Sections
.text Size: 523KB - Virtual size: 522KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 369KB - Virtual size: 373KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ