Static task
static1
Behavioral task
behavioral1
Sample
35f6735be1ddba7f7c2acbccb12a3cab.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
35f6735be1ddba7f7c2acbccb12a3cab.exe
Resource
win10v2004-20231215-en
General
-
Target
35f6735be1ddba7f7c2acbccb12a3cab
-
Size
552KB
-
MD5
35f6735be1ddba7f7c2acbccb12a3cab
-
SHA1
44d1571c7223513683390f55b236e1dc36aa767b
-
SHA256
3e90bf10247e38f5651f6c0a3d4631cc274c6dc8e9580abcd029c735f99e139e
-
SHA512
99fe5228eb877e14d7f7c54d8696a4e71bc7ce33e47f32dddb555f42039c927fc9e341a5fcfb1a3333480ae24e0815fa284494c5b63e86f6dc6ee79488a3310e
-
SSDEEP
12288:eqRAhucpWKRk6LRpT1q4dCazOT/RAqAWVLXqs76ve7I+L:kzpTPzOTZAqAWpR76v9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 35f6735be1ddba7f7c2acbccb12a3cab
Files
-
35f6735be1ddba7f7c2acbccb12a3cab.exe windows:4 windows x86 arch:x86
9b1335938ada8bfa2dfde0b7b113e4f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
gethostbyname
inet_addr
WSACreateEvent
ntohl
accept
WSASend
WSARecv
WSAGetOverlappedResult
WSAResetEvent
connect
getsockname
listen
WSASocketA
gethostname
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAGetLastError
WSAEventSelect
getsockopt
WSAStartup
WSACloseEvent
shutdown
closesocket
ioctlsocket
recvfrom
select
sendto
setsockopt
bind
socket
ntohs
htonl
htons
iphlpapi
GetAdaptersInfo
kwlogsvr
?YL_Log@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H0PBDZZ
?LogUserActMsg@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?LogInit@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?LogRealMsg@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0_NPAPAEPAI@Z
kernel32
Sleep
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
QueryPerformanceCounter
GetStartupInfoA
TerminateThread
ResumeThread
CreateDirectoryA
WriteFile
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CloseHandle
GetFileSize
CreateFileA
GetModuleFileNameA
GetSystemTimeAsFileTime
GetVersionExA
CreateEventA
SetEvent
WaitForSingleObject
ResetEvent
InitializeCriticalSection
DeleteCriticalSection
CreateSemaphoreA
GetLastError
GetVersion
TerminateProcess
CreateMutexA
CreateProcessA
GetSystemDirectoryA
ExitProcess
GetFileAttributesExA
SetProcessPriorityBoost
GetModuleHandleA
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
GetTickCount
GetPrivateProfileStringA
DeleteFileA
ReadFile
SetFilePointer
FreeLibrary
GetProcAddress
LoadLibraryA
GetOverlappedResult
user32
FindWindowA
SendMessageTimeoutA
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
DefWindowProcA
CreateWindowExA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
StartServiceCtrlDispatcherA
CreateServiceA
ChangeServiceConfigA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
ControlService
DeleteService
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
shell32
SHGetFolderPathA
msvcr71
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strtoul
atof
sscanf
_stricmp
fwrite
vsprintf
fflush
ftell
fseek
strncmp
strstr
atoi
sprintf
ceil
memmove
exit
time
_unlink
??_U@YAPAXI@Z
??_V@YAXPAX@Z
fopen
fread
fclose
??0exception@@QAE@ABV0@@Z
_snprintf
free
malloc
_CxxThrowException
_purecall
strncpy
__CxxFrameHandler
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
memset
_beginthreadex
msvcp71
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@V312@@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?clear@ios_base@std@@QAEXH_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
Sections
.text Size: 232KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tc Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE