Static task
static1
Behavioral task
behavioral1
Sample
2caa570da4e98a5e87ffa018444d429c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2caa570da4e98a5e87ffa018444d429c.exe
Resource
win10v2004-20231215-en
General
-
Target
2caa570da4e98a5e87ffa018444d429c
-
Size
180KB
-
MD5
2caa570da4e98a5e87ffa018444d429c
-
SHA1
4d2faa5b84b4247ddc8f1fe9ca5d5ee5afd2e65d
-
SHA256
e90dcd8b935c7ebec9c9c9c2b911a4e003b5e8246031ebc10167de1f96509989
-
SHA512
52b4f1fa559590b44aedbc3bf7b1953cc27167bc489494ac7f44662e0375975228e7b5c71e3d23c7b5120fae518f489f2eadf25b78fab1a504390325feccaf5b
-
SSDEEP
3072:ywnjDcNFVEepkY6h32HcPkrtog0p6jSmxG2q3S+WMFb0VYdwcOXy6lPxdUJD:HnjMFVEepkD2HcPwd0p6jSmxTB+rIIwC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2caa570da4e98a5e87ffa018444d429c
Files
-
2caa570da4e98a5e87ffa018444d429c.exe windows:5 windows x86 arch:x86
4ad961daf841c58e39050fe1f0fbf89a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateSemaphoreW
DeleteFileW
SetFileAttributesW
ReleaseSemaphore
WaitForMultipleObjects
GetModuleHandleW
GetVersionExW
MoveFileW
GetWindowsDirectoryW
lstrlenW
lstrcpynW
GetStartupInfoW
OpenProcess
GetCurrentProcess
DeviceIoControl
GetTimeFormatW
QueryPerformanceFrequency
QueryDosDeviceW
GetTickCount
QueryPerformanceCounter
InterlockedIncrement
GetExitCodeProcess
CreateProcessW
SetErrorMode
IsBadReadPtr
GetComputerNameW
DeleteCriticalSection
RemoveDirectoryW
EnterCriticalSection
GetTempPathW
WritePrivateProfileStringW
ReadFile
LeaveCriticalSection
InitializeCriticalSection
WriteFile
GetPrivateProfileStringW
SetEndOfFile
SetFilePointer
CreateMutexW
GetFileSize
GetCurrentProcessId
InterlockedExchangeAdd
GetLocalTime
InterlockedCompareExchange
OpenEventW
LocalFree
Sleep
GetProcAddress
GetModuleFileNameW
LoadLibraryW
FreeLibrary
FindNextFileW
ResetEvent
FindClose
CreateFileW
CreateDirectoryW
GetDriveTypeW
FindFirstFileW
CloseHandle
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedExchange
LoadLibraryA
InterlockedDecrement
LoadLibraryExW
GetFileAttributesW
FormatMessageW
GetVolumeInformationW
SetLastError
CreateEventW
GetLastError
SetEvent
GetDateFormatW
WaitForSingleObject
user32
OemToCharBuffW
LoadStringW
GetForegroundWindow
GetWindowThreadProcessId
wsprintfW
CharUpperW
advapi32
RegSetValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
GetSecurityDescriptorDacl
AdjustTokenPrivileges
BuildExplicitAccessWithNameW
FreeSid
SetEntriesInAclW
SetSecurityInfo
AllocateAndInitializeSid
GetSecurityInfo
LookupPrivilegeValueW
CreateProcessAsUserW
EqualSid
GetTokenInformation
GetSidSubAuthorityCount
GetUserNameW
GetSidSubAuthority
OpenProcessToken
GetSidIdentifierAuthority
LookupAccountSidW
ReportEventW
RegisterServiceCtrlHandlerW
SetServiceStatus
DeregisterEventSource
StartServiceCtrlDispatcherW
RegisterEventSourceW
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegDeleteValueW
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExW
msvcr90
memmove_s
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
??_U@YAPAXI@Z
_vsnwprintf_s
_read
_lseek
_filelength
_wsopen
strtoul
realloc
_wassert
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
??0exception@std@@QAE@ABV01@@Z
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_crt_debugger_hook
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_CxxThrowException
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??3@YAXPAX@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
__CxxFrameHandler3
wcscmp
wcsncat_s
wcsncpy_s
_wsplitpath_s
wcscpy
iswalnum
iswspace
vswprintf_s
_wfopen_s
wcslen
swscanf_s
wcscpy_s
swprintf_s
wcscat_s
_errno
memcpy
_swprintf
memset
srand
rand
calloc
_beginthread
_endthread
_time64
fclose
?_wsopen@@YAHPB_WHHH@Z
wcsstr
_acmdln
_wcsdup
toupper
wcstok
towupper
wcstombs
wcsncmp
_wcsupr
_wcsnicmp
memmove
swscanf
mbstowcs
strncat
exit
strncpy
_vswprintf
strchr
strncmp
wcsrchr
_wtoi
_waccess
_wsplitpath
wcsncat
wcsncpy
_snwprintf
_wcsicmp
wcschr
_beginthreadex
malloc
free
_strupr
_strnicmp
_close
abort
msvcp90
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
??_7ios_base@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@_W@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_WH@Z
?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@H@2@JHH@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPB_WH@Z
?_Xsgetn_s@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPA_WIH@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHPA_WH@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
shell32
ShellExecuteW
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ