Static task
static1
Behavioral task
behavioral1
Sample
2f22b98a153e3dbc2d8d9fb64dfcb183.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2f22b98a153e3dbc2d8d9fb64dfcb183.exe
Resource
win10v2004-20231215-en
General
-
Target
2f22b98a153e3dbc2d8d9fb64dfcb183
-
Size
92KB
-
MD5
2f22b98a153e3dbc2d8d9fb64dfcb183
-
SHA1
d27a9d77f03a06dd20abf6416bc1de460b491595
-
SHA256
e5ece9b57497450f17671cdaecab37f3787e441f7c0fccfd845ae2ff8c72e5fc
-
SHA512
9a872da6bbfe39c6e36883bf9011a950aceb2485208ed0feef910fde91a205f6d2ec414444cd749df539d14bd917265aade9fae595235e7814309fbdc024822c
-
SSDEEP
768:E0RZVRbqezYl9LLbUCG8i7S/qE4MSkaOgpZU9qZU9dYA:NRtBUlh8CGCq/BOgppQYA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f22b98a153e3dbc2d8d9fb64dfcb183
Files
-
2f22b98a153e3dbc2d8d9fb64dfcb183.exe windows:4 windows x86 arch:x86
b25e4295e78e2a1ff578d357c3b7428c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
CreateToolhelp32Snapshot
Process32FirstW
CloseHandle
GetCurrentProcessId
Sleep
Module32FirstW
Module32NextW
MoveFileW
FindResourceW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentThreadId
FindResourceExW
LoadResource
LockResource
Process32NextW
SizeofResource
GetTickCount
QueryPerformanceCounter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
IsDebuggerPresent
user32
UnregisterClassA
FindWindowW
MessageBoxW
PostMessageW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
shell32
SHGetFolderPathW
msvcp80
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@H@2@XZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?5_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?uncaught_exception@std@@YA_NXZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
msvcr80
__dllonexit
_encode_pointer
_lock
_unlock
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
memset
free
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
wcschr
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??2@YAPAXI@Z
_wcslwr_s
wcsstr
memcpy_s
??_V@YAXPAX@Z
memmove_s
??3@YAXPAX@Z
__CxxFrameHandler3
_CxxThrowException
_onexit
memcpy
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ