??4l4link_st@@QAEAAU0@ABU0@@Z
Static task
static1
Behavioral task
behavioral1
Sample
333251d18dc104c8e1b4ff52743b5754.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
333251d18dc104c8e1b4ff52743b5754.exe
Resource
win10v2004-20231215-en
General
-
Target
333251d18dc104c8e1b4ff52743b5754
-
Size
968KB
-
MD5
333251d18dc104c8e1b4ff52743b5754
-
SHA1
86c6dd886f2d61f9ca54f124ac120f61dfa21562
-
SHA256
57ff49edca68fa279d18146447cfb54c17bf3c719af7f2b8799faedb38fab23e
-
SHA512
c3a4e780b9f555063bff1bed9079296517ed9c16d7350ce035e782c8b260851ca2a740b01c3e06fcda47aaf60e2d468a1a4f59d8dd0e7940161f3c20c38128f3
-
SSDEEP
12288:Ohmvys9THwPzwNaSWgUUqQMKfmgHzb8dpfzUqcJ/nj+PqqCcyt:OhAx93NDYzJgHzb8d5Ix/nQqhcyt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 333251d18dc104c8e1b4ff52743b5754
Files
-
333251d18dc104c8e1b4ff52743b5754.exe windows:4 windows x86 arch:x86
f91c0a930e53e35e70a222112ddf463b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shw32
ord34
ord79
ord46
ord74
ord72
ord295
ord30
ord70
ord77
ord48
mfc42
ord4710
ord6453
ord668
ord2819
ord3337
ord3310
ord6007
ord3181
ord3178
ord2781
ord2770
ord356
ord3996
ord5289
ord4204
ord2919
ord2723
ord2390
ord3059
ord5100
ord4303
ord3350
ord5012
ord975
ord5472
ord2879
ord2878
ord4151
ord4077
ord5282
ord2649
ord1665
ord4436
ord5252
ord3623
ord4242
ord4220
ord2584
ord3654
ord6232
ord6230
ord6148
ord2568
ord6268
ord6271
ord3225
ord3257
ord3912
ord2544
ord2543
ord2511
ord978
ord1731
ord5851
ord2883
ord2418
ord6224
ord6226
ord2429
ord2250
ord4732
ord4541
ord5477
ord2259
ord4836
ord4440
ord3720
ord674
ord6467
ord1154
ord527
ord366
ord794
ord2438
ord3571
ord2455
ord2452
ord1644
ord3482
ord2117
ord4457
ord4299
ord6195
ord4467
ord3481
ord5852
ord2252
ord4499
ord2379
ord1246
ord2652
ord3485
ord1669
ord941
ord1146
ord4413
ord3870
ord4224
ord4427
ord1601
ord922
ord924
ord5910
ord5949
ord3916
ord2975
ord5054
ord1980
ord4058
ord3708
ord781
ord4275
ord5710
ord5148
ord2642
ord2645
ord6199
ord3092
ord3610
ord656
ord5981
ord3874
ord5953
ord4464
ord4589
ord4588
ord4899
ord4370
ord4892
ord5076
ord4341
ord4349
ord4890
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4964
ord4961
ord4108
ord5240
ord3748
ord1726
ord5260
ord4432
ord6197
ord1200
ord2078
ord2860
ord4287
ord2119
ord2753
ord2754
ord1572
ord4723
ord2135
ord6379
ord4273
ord1945
ord686
ord813
ord384
ord560
ord2097
ord3286
ord798
ord1997
ord5465
ord5448
ord3318
ord3511
ord5194
ord533
ord2096
ord6334
ord2107
ord3903
ord4264
ord4789
ord801
ord541
ord5861
ord5608
ord1949
ord2688
ord4034
ord539
ord1265
ord1169
ord926
ord939
ord2243
ord6785
ord1158
ord548
ord3811
ord6673
ord291
ord3815
ord2546
ord2616
ord5891
ord6109
ord6164
ord1862
ord6139
ord5791
ord3692
ord610
ord287
ord404
ord2454
ord2381
ord3998
ord5805
ord4023
ord6270
ord1153
ord1232
ord6442
ord5495
ord430
ord1706
ord3138
ord472
ord5788
ord4297
ord4133
ord283
ord2567
ord6172
ord2450
ord3920
ord3301
ord4123
ord4083
ord3216
ord2862
ord2380
ord4042
ord955
ord2504
ord5736
ord2714
ord5678
ord2100
ord4284
ord4243
ord1848
ord4544
ord4525
ord736
ord439
ord3274
ord5685
ord4367
ord5344
ord3882
ord614
ord438
ord3579
ord3353
ord3273
ord3089
ord2089
ord3797
ord289
ord5789
ord613
ord3573
ord4454
ord3288
ord4265
ord2557
ord6021
ord5873
ord2639
ord2108
ord765
ord3698
ord1717
ord3294
ord5859
ord5858
ord5860
ord6143
ord6000
ord2859
ord5875
ord3484
ord6069
ord2846
ord529
ord341
ord414
ord500
ord796
ord654
ord713
ord772
ord2444
ord5258
ord5279
ord6369
ord5234
ord4404
ord1714
ord1709
ord5085
ord2389
ord4121
ord5471
ord4056
ord4365
ord2530
ord6154
ord1930
ord5834
ord6215
ord2864
ord2302
ord2370
ord2414
ord3626
ord324
ord693
ord795
ord609
ord804
ord3721
ord1576
ord3574
ord4396
ord2575
ord3729
ord3394
ord4406
ord2587
ord3640
ord3370
ord4402
ord2582
ord3597
ord4425
ord5280
ord1775
ord6052
ord4998
ord4853
ord4376
ord5265
ord3619
ord354
ord5186
ord273
ord603
ord2817
ord1969
ord1979
ord665
ord2514
ord6400
ord641
ord1977
ord2725
ord1134
ord6438
ord1168
ord2621
ord4159
ord5180
ord5484
ord2092
ord1175
ord2863
ord4160
ord561
ord815
ord3738
ord4622
ord5714
ord5307
ord4698
ord4079
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4234
ord4274
ord634
ord316
ord4277
ord2915
ord5572
ord2827
ord2740
ord2801
ord882
ord3464
ord1259
ord879
ord5460
ord6571
ord1871
ord3663
ord6282
ord6283
ord2784
ord4129
ord858
ord567
ord818
ord3742
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2866
ord536
ord3072
ord5799
ord1938
ord1133
ord1642
ord403
ord6387
ord5443
ord1989
ord2453
ord2920
ord703
ord2841
ord2448
ord323
ord1640
ord5785
ord2405
ord640
ord6394
ord5450
ord6383
ord5440
ord470
ord755
ord1768
ord1233
ord2152
ord3706
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
comctl32
ImageList_BeginDrag
ImageList_DragEnter
ImageList_AddMasked
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_GetImageInfo
ImageList_Draw
ImageList_Add
ImageList_GetIcon
ImageList_EndDrag
ImageList_ReplaceIcon
ImageList_GetImageCount
msvcrt
fclose
fprintf
__threadid
strftime
_vsnprintf
_filelength
_fsopen
_splitpath
vsprintf
strrchr
_makepath
rename
_errno
memcmp
fwrite
fread
_lseek
isspace
_ftol
fgetc
tolower
toupper
strchr
rand
srand
memcpy
floor
fabs
_strnicmp
_strupr
_strlwr
wcslen
_fdopen
_open_osfhandle
isdigit
atof
fseek
clearerr
fgets
fputs
fflush
__p___argv
__p___argc
sscanf
_beginthreadex
memmove
__CxxFrameHandler
_setmbcp
_CxxThrowException
strtol
_mbsicmp
_mbsnbcmp
_mbsnbcpy
_strdup
towlower
_mbscmp
exit
remove
wcscpy
_access
_stricmp
_putenv
strcat
_ultoa
atoi
sprintf
getenv
strcmp
strlen
strcpy
_tzname
strncpy
atol
_lock
_unlock
mktime
localtime
memset
difftime
_timezone
time
_controlfp
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
_dstbias
strstr
_purecall
strtok
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
_daylight
msvcp60
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
kernel32
CompareStringA
GetPrivateProfileIntA
lstrcmpA
GlobalHandle
GetEnvironmentStrings
FreeEnvironmentStringsA
OpenProcess
OpenMutexA
GetCurrentProcessId
GetProfileIntA
FlushInstructionCache
GetShortPathNameA
lstrlenA
lstrlenW
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
InterlockedIncrement
OpenEventA
SetEvent
CreateEventA
GetExitCodeThread
CreateMutexA
TerminateThread
GetCommandLineA
lstrcmpiA
GetComputerNameA
LocalAlloc
MultiByteToWideChar
InterlockedDecrement
GetCurrencyFormatA
GetTimeFormatA
GetDateFormatA
GetLocaleInfoA
WriteFile
ReadFile
SetFilePointer
MoveFileA
SetSystemTime
GlobalFree
GlobalSize
GlobalReAlloc
GlobalAlloc
GlobalLock
GlobalUnlock
GetCurrentDirectoryA
SetCurrentDirectoryA
RemoveDirectoryA
CreateDirectoryA
SetFileTime
CreateFileA
GetFileTime
_lwrite
_lread
Sleep
_llseek
GetFileSize
_lclose
OpenFile
CopyFileA
DeleteFileA
GetFileAttributesA
SetFileAttributesA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindFirstFileA
FindClose
GetCurrentThreadId
CreateThread
GetCurrentProcess
IsBadWritePtr
VirtualQuery
SuspendThread
GetThreadContext
ResumeThread
GetCurrentThread
SetUnhandledExceptionFilter
GetModuleFileNameA
GetLastError
FormatMessageA
LocalFree
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateProcessA
CloseHandle
WaitForSingleObject
GetExitCodeProcess
FreeLibrary
LoadLibraryA
WritePrivateProfileStructA
GetPrivateProfileStructA
SetTimeZoneInformation
GetVersionExA
GetPrivateProfileStringA
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceA
lstrcatA
lstrcpyA
GetSystemTime
GetTimeZoneInformation
GetLocalTime
SetLocalTime
GetTickCount
MulDiv
GetStartupInfoA
lstrcpynA
GetEnvironmentVariableA
WritePrivateProfileStringA
user32
MessageBoxA
GetActiveWindow
LoadStringA
EnableWindow
wvsprintfA
wsprintfA
GetWindowTextA
GetWindowTextLengthA
SetWindowTextA
GetDlgItemTextA
GetDlgItem
SetDlgItemTextA
EnableMenuItem
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
PostThreadMessageA
SendMessageA
GetKeyState
GetSystemMetrics
GetWindowRect
PtInRect
SetTimer
KillTimer
ShowWindow
GetWindowPlacement
SetForegroundWindow
GetParent
GetWindow
GetTopWindow
DispatchMessageA
TranslateMessage
PeekMessageA
GetMessageA
GetMenuStringA
DestroyWindow
IsWindow
MoveWindow
WinHelpA
IsDialogMessageA
CreateDialogParamA
SetWindowLongA
GetDialogBaseUnits
ReleaseDC
GetDC
AppendMenuA
CreatePopupMenu
CreateMenu
SetMenu
GetSysColor
GetClientRect
LoadImageA
RedrawWindow
CheckMenuItem
InsertMenuA
LoadBitmapA
GetScrollInfo
DialogBoxIndirectParamA
RegisterClassExA
LoadCursorA
GetClassInfoExA
RegisterWindowMessageA
DefWindowProcA
GetWindowLongA
CallWindowProcA
SetFocus
IsChild
GetFocus
EndPaint
FillRect
BeginPaint
SetWindowPos
GetClassNameA
GetDesktopWindow
CreateAcceleratorTableA
CreateWindowExA
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
LoadIconA
SystemParametersInfoA
DrawEdge
SetRect
RemoveMenu
DestroyIcon
DrawStateA
FrameRect
CopyRect
InflateRect
GetCursorPos
PostMessageA
EqualRect
IntersectRect
ClientToScreen
WindowFromPoint
GetCapture
RegisterClipboardFormatA
GetMessagePos
ScreenToClient
GetAsyncKeyState
SetRectEmpty
ValidateRect
IsRectEmpty
OffsetRect
GetMenuItemInfoA
SetMenuItemInfoA
DrawFrameControl
SetWindowRgn
SetCursor
UpdateWindow
EndDialog
IsDlgButtonChecked
CheckDlgButton
SendDlgItemMessageA
SetParent
CopyIcon
gdi32
GetStockObject
CombineRgn
CreateRectRgn
CreatePolygonRgn
GetObjectA
GetTextExtentPoint32A
StretchBlt
GetMapMode
CreateBitmap
RectVisible
GetCurrentObject
FillRgn
CreateRectRgnIndirect
CreateDIBitmap
RealizePalette
SelectPalette
CreateHalftonePalette
CreatePalette
GetPaletteEntries
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
DeleteDC
GetDeviceCaps
CreateFontIndirectA
SelectObject
GetTextMetricsA
GetTextExtentPointA
DeleteObject
DPtoLP
CreateFontA
winmm
sndPlaySoundA
advapi32
RegCloseKey
RegOpenKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegQueryValueA
RegCreateKeyExA
RegQueryValueExA
ole32
CreateStreamOnHGlobal
CoInitialize
CoInitializeSecurity
CLSIDFromProgID
StringFromCLSID
CoFreeUnusedLibraries
OleLockRunning
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemFree
CoDisconnectObject
OleInitialize
CoCreateInstance
OleUninitialize
CoRevokeClassObject
CoGetClassObject
CLSIDFromString
oleaut32
VariantChangeType
CreateErrorInfo
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
OleCreateFontIndirect
SetErrorInfo
OleCreatePropertyFrame
VariantClear
VariantInit
VariantCopy
LoadRegTypeLi
SysStringLen
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysReAllocStringLen
SysAllocStringLen
VarDateFromStr
SysFreeString
GetErrorInfo
netapi32
Netbios
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Exports
Exports
Sections
.text Size: 520KB - Virtual size: 518KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_TEXT_HA Size: 52KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 232KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ