Static task
static1
Behavioral task
behavioral1
Sample
4c9f5bc8a0165da1c0f42e8c8d99816c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4c9f5bc8a0165da1c0f42e8c8d99816c.exe
Resource
win10v2004-20231215-en
General
-
Target
4c9f5bc8a0165da1c0f42e8c8d99816c
-
Size
252KB
-
MD5
4c9f5bc8a0165da1c0f42e8c8d99816c
-
SHA1
8b891b641b7ac28377d7dfc745d33bd13e1ff634
-
SHA256
6a04779ae63257a3f95ac7c4bfa7a808f6ce8b2df2d4d7b12a7f9a7753e93b38
-
SHA512
2411c9a8d6b30fa579dbc2e64cd4349201ba83899ed9d05a17689feae09ed623e8f299edb966fe92c9d819fea99a72a6b4dcb833458f9743f23e468603be9e36
-
SSDEEP
6144:GxGQ/jehRNxLEfARNDnTYJih8LCZ3qROOpDKzo0naGQ:qGQ/CeARND0Jih8L2VPaGQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c9f5bc8a0165da1c0f42e8c8d99816c
Files
-
4c9f5bc8a0165da1c0f42e8c8d99816c.exe windows:4 windows x86 arch:x86
6af947d33f6f91bf9e40ec4217a74032
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteW
mfc80u
ord764
ord1079
ord577
ord2311
ord293
ord1197
ord6282
ord1425
ord1430
ord1908
ord385
ord630
ord3050
ord2012
ord899
ord774
ord3082
ord266
ord6303
ord1182
ord1178
ord384
ord629
ord5083
ord283
ord317
ord265
ord776
ord5338
ord584
ord2897
ord762
msvcr80
_CxxThrowException
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
_decode_pointer
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
wcsncpy
__RTtypeid
wcslen
_wmakepath_s
_waccess
_wsplitpath_s
strchr
strncmp
isalnum
isalpha
tolower
isspace
memmove
memcpy
fclose
fseek
ftell
fread
__CxxFrameHandler3
_vsnprintf_s
atoi
fprintf
strcmp
fopen_s
strlen
_wtoi
_purecall
free
__RTDynamicCast
_snwprintf_s
_snprintf_s
_access
swprintf_s
malloc
_resetstkoflw
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
_vswprintf
memset
_onexit
kernel32
Sleep
GetLastError
OutputDebugStringW
LoadLibraryW
FreeLibrary
GetModuleFileNameW
lstrlenW
MultiByteToWideChar
WinExec
WideCharToMultiByte
GetProcAddress
GetModuleHandleW
GetCommandLineW
LocalAlloc
RaiseException
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetLocaleInfoA
GetACP
GetVersionExA
GetThreadLocale
LoadLibraryA
GetTickCount
InterlockedExchange
user32
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
FlashWindow
SetWindowPos
ShowWindow
GetActiveWindow
IsIconic
wsprintfW
MessageBoxW
PostQuitMessage
SendMessageW
LoadIconW
LoadCursorW
PostMessageW
LoadCursorFromFileW
CreateWindowExW
SetWindowLongW
SetCursor
DefWindowProcW
DestroyWindow
SetRect
PtInRect
gdi32
CreateFontW
shlwapi
StrCmpW
msvcp80
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?uncaught_exception@std@@YA_NXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
ws2_32
htons
htonl
ntohl
ntohs
gdiplus
GdipFree
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipCreateBitmapFromGdiDib
GdipCreateBitmapFromFile
GdipCloneImage
GdipLoadImageFromFile
GdipDisposeImage
Sections
.text Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ