Static task
static1
Behavioral task
behavioral1
Sample
2c91017cd94505c1cc5f19ad064cbd4b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2c91017cd94505c1cc5f19ad064cbd4b.exe
Resource
win10v2004-20231215-en
General
-
Target
2c91017cd94505c1cc5f19ad064cbd4b
-
Size
84KB
-
MD5
2c91017cd94505c1cc5f19ad064cbd4b
-
SHA1
c45000f259eb807deb05a2c28279ade853edeb92
-
SHA256
e92b64028f5b6e2b49da84352728081e2c1cbfc035be088f9694e21018bb653a
-
SHA512
5fa3623a2467f63be5ec4e021eb3e30ee5a952dcc21576f62f850186b6c0516ad47c35423d0eae24e17ed3c79ccc77b260a81a50ef92d87cab85fe926d82d18b
-
SSDEEP
1536:1e9fMbzYg7RY+sYIODmNEdvOb7OmergoNrCAj/mvo:1ikbzlGYeNjOxuASvo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c91017cd94505c1cc5f19ad064cbd4b
Files
-
2c91017cd94505c1cc5f19ad064cbd4b.exe windows:4 windows x86 arch:x86
b5263d9d7410905dfc095c48368869f8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetProcAddress
LoadLibraryA
WriteFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetTickCount
FreeLibrary
CreateThread
InitializeCriticalSection
ResumeThread
TlsAlloc
TlsFree
TlsSetValue
GetCurrentThreadId
TlsGetValue
lstrlenA
RaiseException
InterlockedExchange
LocalAlloc
CreateMutexA
SetEvent
SetUnhandledExceptionFilter
CreateEventA
WaitForSingleObject
CloseHandle
AllocConsole
GetStdHandle
GlobalAlloc
GlobalFree
FormatMessageA
LocalFree
SetConsoleCtrlHandler
GetModuleHandleA
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
SetFilePointer
ReadFile
GetLastError
lstrcpynA
MultiByteToWideChar
GetFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
Sleep
GetLocalTime
GetVersionExA
GetSystemDirectoryA
ExpandEnvironmentStringsA
DeleteFileA
CreateFileA
GetFileSize
SuspendThread
GetStartupInfoA
user32
PeekMessageA
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
RegisterClassA
CreateWindowExA
PostQuitMessage
DefWindowProcA
advapi32
RegEnumValueA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
RegCreateKeyA
RegDeleteValueA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
StartServiceCtrlDispatcherA
GetUserNameA
LookupAccountNameA
IsValidSid
GetLengthSid
CopySid
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
oleaut32
SysStringLen
SysAllocString
SysFreeString
crypt32
CertAddEncodedCertificateToStore
CertOpenStore
CertCloseStore
msvcp60
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
msvcrt
_fdopen
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__CxxFrameHandler
_purecall
strlen
??2@YAPAXI@Z
memset
strerror
_errno
sprintf
_CxxThrowException
toupper
strstr
isxdigit
strncmp
strcmp
printf
strcpy
_mbslen
_mbscmp
strcat
setvbuf
_acmdln
_open_osfhandle
_iob
__p___argv
__p___argc
_snprintf
_vsnprintf
isdigit
atol
free
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_controlfp
Sections
.text Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ