Static task
static1
Behavioral task
behavioral1
Sample
66c888d9b0b8d6ebb9fdb9cdcb49e6b1.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
66c888d9b0b8d6ebb9fdb9cdcb49e6b1.exe
Resource
win10v2004-20231215-en
General
-
Target
66c888d9b0b8d6ebb9fdb9cdcb49e6b1
-
Size
328KB
-
MD5
66c888d9b0b8d6ebb9fdb9cdcb49e6b1
-
SHA1
417bbf0cfae06f0d8c6f03915f068f339ce8f553
-
SHA256
5b3374c2aaa6fb912462b2af6fdb5dad66f2a5dc331e05ff609da3cd8ede19aa
-
SHA512
448ebb835f452684988fb39478701b9dea1e75506a04e742613409b636bd0daba48fad7ba9f774f94d3903720a6548f774dfe05536c9998a724d714b05cc8825
-
SSDEEP
6144:0z9lMuBOJ5qMf/mZs9rrALXqo1jmUZxL6xQGQXK3M:0z0vqMXmZs9ELXqs76GK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 66c888d9b0b8d6ebb9fdb9cdcb49e6b1
Files
-
66c888d9b0b8d6ebb9fdb9cdcb49e6b1.exe windows:4 windows x86 arch:x86
c21d3bbbf9f1ec783a1feb55ad70ba1e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
dbghelp
SymCleanup
SymInitialize
SymSetOptions
SymLoadModule
SymGetModuleInfo
wininet
InternetReadFile
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetOpenA
InternetConnectA
psapi
GetModuleFileNameExA
comctl32
ImageList_Create
InitCommonControlsEx
ImageList_ReplaceIcon
kernel32
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetTickCount
DeleteFileW
CreateFileW
ReadFile
SetFilePointer
CloseHandle
GetTempPathW
CreateDirectoryW
GetVersionExW
GetModuleHandleW
VirtualQueryEx
CreateFileA
ReadProcessMemory
WriteProcessMemory
OpenThread
GetProcAddress
OpenProcess
HeapFree
GetModuleFileNameW
SetCurrentDirectoryW
WriteFile
GetCurrentProcessId
SetEvent
CreateProcessW
HeapAlloc
GetProcessHeap
VirtualProtect
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedIncrement
InterlockedDecrement
Sleep
LoadLibraryW
GetFileAttributesW
GetCurrentThreadId
QueryPerformanceCounter
GetFileSize
FreeLibrary
GetThreadSelectorEntry
user32
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
IsWindow
SetClipboardData
GetWindow
EmptyClipboard
SetDlgItemTextW
GetKeyState
OpenClipboard
SetWindowPos
RegisterClipboardFormatW
LoadImageW
SendMessageW
LoadIconW
InvalidateRect
GetClientRect
ShowWindow
SendDlgItemMessageW
MapDialogRect
GetWindowRect
MapWindowPoints
GetWindowTextW
GetWindowTextLengthW
GetDlgItem
SetWindowLongW
CallWindowProcW
ClientToScreen
DrawIconEx
EnableWindow
CloseClipboard
SetWindowTextW
EndDialog
MessageBoxW
DialogBoxParamW
gdi32
GetStockObject
SetTextColor
DeleteObject
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
shell32
SHGetFileInfoW
SHGetDesktopFolder
ord155
SHBindToParent
ShellExecuteW
ole32
DoDragDrop
OleUninitialize
OleInitialize
atl80
ord10
msvcp80
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
common
??0CTXStringA@@QAE@UtagEN@@PB_WH@Z
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??0CTXStringW@@QAE@UtagUTF8@@PBDH@Z
??0CTXStringA@@QAE@PBDH@Z
??0CTXStringA@@QAE@ABV0@@Z
??0CTXStringA@@QAE@PBD@Z
?FormatV@CTXStringA@@QAEXPBDPAD@Z
?GetZip@CZipBuffers@@QAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
??0CTXStringA@@QAE@UtagUTF8@@PB_WH@Z
?AddBuffer@CZipBuffers@@QAE_NPBXIPBD@Z
?Utf8FromWSLimit@Convert@Util@@YA?AVCTXStringA@@HPB_WH@Z
?GetBuffer@CTXStringA@@QAEPADXZ
??M@YA_NABVCTXStringA@@0@Z
??YCTXStringA@@QAEAAV0@D@Z
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?GetLogByFilter@TXLog@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABVCTXStringW@@K0K@Z
??4CTXStringA@@QAEAAV0@ABV0@@Z
?SetAt@CTXStringW@@QAEXH_W@Z
??1CTXBSTR@@QAE@XZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??0CTXBSTR@@QAE@ABV0@@Z
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?SetConfigFile@TXI18N@@YAHPB_W0@Z
?LoadStringW@CTXStringW@@QAEHPAUHINSTANCE__@@I@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
??BCTXBSTR@@QBEPA_WXZ
?Trim@CTXStringW@@QAEAAV1@XZ
?Length@CTXBSTR@@QBEIXZ
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??1CZipBuffers@@QAE@XZ
?GetBuffer@CTXStringA@@QAEPADH@Z
?MakeLower@CTXStringA@@QAEAAV1@XZ
??YCTXStringA@@QAEAAV0@ABV0@@Z
?Format@CTXStringA@@QAAXPBDZZ
?GetLength@CTXStringA@@QBEHXZ
?Utf8FromWS@Convert@Util@@YA?AVCTXStringA@@PB_WH@Z
??1CTXStringA@@QAE@XZ
??0CTXStringA@@QAE@XZ
??8@YA_NABVCTXStringW@@0@Z
??0CTXStringW@@QAE@PA_W@Z
??0CTXStringW@@QAE@PB_W@Z
?IsEmpty@CTXStringW@@QBE_NXZ
??BCTXStringA@@QBEPBDXZ
?AnsiToUnicode@Convert@Util@@YA_NAAVCTXStringW@@PBDH@Z
??YCTXStringA@@QAEAAV0@PBD@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
?Format@CTXStringW@@QAAXPB_WZZ
??BCTXStringW@@QBEPB_WXZ
wcslcat
wcslcpy
?Left@CTXStringW@@QBE?AV1@H@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
?Mid@CTXStringW@@QBE?AV1@H@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
??0CTXStringW@@QAE@ABV0@@Z
??M@YA_NABVCTXStringW@@0@Z
??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@XZ
??YCTXStringW@@QAEAAV0@_W@Z
?Empty@CTXStringW@@QAEXXZ
??YCTXStringW@@QAEAAV0@ABV0@@Z
?GetLength@CTXStringW@@QBEHXZ
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?Preallocate@CTXStringW@@QAEXH@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
?MatchWildcard@FS@Util@@YAHPBD0@Z
?Replace@CTXStringW@@QAEH_W0@Z
??0CZipBuffers@@QAE@XZ
??4CTXStringA@@QAEAAV0@PBD@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
?Left@CTXStringA@@QBE?AV1@H@Z
msvcr80
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_wcmdln
_CxxThrowException
exit
_XcptFilter
_exit
_cexit
??3@YAXPAX@Z
_invalid_parameter_noinfo
_snwprintf
??_V@YAXPAX@Z
_gmtime32
??0exception@std@@QAE@ABV01@@Z
_wfopen
??0exception@std@@QAE@XZ
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
??1exception@std@@UAE@XZ
fread
?what@exception@std@@UBEPBDXZ
fclose
strrchr
_snprintf
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
__wargv
wcsncmp
swscanf
malloc
free
srand
wcsrchr
_purecall
__argc
memmove_s
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_wcsicmp
strchr
_time32
_time64
strncmp
atoi
_initterm
memset
__CxxFrameHandler3
memcpy
_unlock
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tc Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE