Static task
static1
Behavioral task
behavioral1
Sample
36196f02216188e8b5a5aea1e86d827e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
36196f02216188e8b5a5aea1e86d827e.exe
Resource
win10v2004-20231215-en
General
-
Target
36196f02216188e8b5a5aea1e86d827e
-
Size
292KB
-
MD5
36196f02216188e8b5a5aea1e86d827e
-
SHA1
56a6445c138af3935f13a5712c5aa7918f73253a
-
SHA256
8dbbaf07fbc33b73b33d2e400fbb88219b1b546eaa423890aca0d06281cbc75d
-
SHA512
9331460b08673688bb929714f8d4ab8bf8a7daede2a19dce810ef599e828fc2e6896fdd84b20e59729a72f6d01452175d68b939ec602f1c0350b61d70d468176
-
SSDEEP
6144:iAZFSg9WewEESALXqo1jmUZxL6xQGQ5eC4N:pZFn2fLXqs76J9N
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 36196f02216188e8b5a5aea1e86d827e
Files
-
36196f02216188e8b5a5aea1e86d827e.exe windows:4 windows x86 arch:x86
8607dbb0dd2480334a97d76766f34c37
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SystemTimeToFileTime
WriteFile
SetFilePointerEx
SetEndOfFile
SetFilePointer
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
GetCurrentThreadId
GetProcAddress
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetModuleFileNameA
SetCurrentDirectoryA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentThread
SuspendThread
TerminateThread
CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
Process32Next
Sleep
WaitForSingleObject
CreateFileW
GetFullPathNameW
CopyFileW
SetFileAttributesW
GetLastError
RemoveDirectoryW
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
CreateDirectoryW
ReadFile
GetFileSize
LocalAlloc
LocalFree
OpenThread
GetModuleHandleA
GetStartupInfoA
RaiseException
DebugBreak
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
GetCurrentDirectoryA
GetTickCount
SetFileTime
SetUnhandledExceptionFilter
ExitProcess
user32
DispatchMessageA
TranslateMessage
GetMessageA
DefWindowProcA
SetWindowLongA
CreateWindowExA
SendMessageA
baselib
?RemoveAt@ArrayBase@@QAEXHH@Z
?RemoveAt@HashBase@@QAEXPAU__POSITION@@@Z
?RemoveKey@HashBase@@QAEHPBX@Z
?Close@SpinLockTraits@SyncLack@@SAXAAUHType@12@@Z
?FindFile@FileFindTraits@@SAHAAUHType@1@PBD@Z
??0ArrayBase@@IAE@H@Z
?Unlock@SpinLockTraits@SyncLack@@SAHAAUHType@12@@Z
?Close@FileFindTraits@@SAXAAUHType@1@@Z
?FindNextFileA@FileFindTraits@@SAHAAUHType@1@@Z
?SetSize@ArrayBase@@QAEXHH@Z
?Lock@SpinLockTraits@SyncLack@@SAHAAUHType@12@K@Z
?Create@SpinLockTraits@SyncLack@@SAHAAUHType@12@HHJ@Z
?MemoryAlloc@@YGPAXK@Z
?RemoveAll@HashBase@@QAEXXZ
??0HashBase@@IAE@XZ
?SetAt@HashBase@@QAEPAU__POSITION@@PBXAAH@Z
?ThrowMemoryException@@YGXXZ
?BrtStringAllocator@@YGPAVStringAllocator@@XZ
?MemoryFree@@YGXPAX@Z
msvcp71
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?width@ios_base@std@@QBEHXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1locale@std@@QAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?to_int_type@?$char_traits@D@std@@SAHABD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?to_char_type@?$char_traits@G@std@@SAGABG@Z
?eq_int_type@?$char_traits@G@std@@SA_NABG0@Z
?eof@?$char_traits@G@std@@SAGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?to_int_type@?$char_traits@G@std@@SAGABG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@Vconst_iterator@01@0@Z
?uncaught_exception@std@@YA_NXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AVconst_iterator@12@XZ
msvcr71
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
wcscat
wcscpy
rand
srand
_mbsrchr
_except_handler3
__security_error_handler
strlen
memcpy
wprintf
wcslen
wcscspn
wcsspn
_wcsicmp
_wfopen
fseek
ftell
malloc
fread
fclose
free
memset
iswxdigit
wcsrchr
_wcsupr
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcmp
swprintf
printf
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
_mbsdec
_CxxThrowException
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABV0@@Z
_beginthreadex
__CxxFrameHandler
_mbsinc
memmove
_mbschr
??1type_info@@UAE@XZ
wininet
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetTimeFromSystemTimeW
InternetCloseHandle
InternetReadFile
advapi32
GetEffectiveRightsFromAclW
GetNamedSecurityInfoW
InitializeSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
ConvertStringSidToSidW
GetSecurityDescriptorOwner
GetKernelObjectSecurity
Sections
.text Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tc Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE