Static task
static1
Behavioral task
behavioral1
Sample
f0190196727616e3eaee6a0ee463982d2354f2c4ba9362bbd9cc039556452161.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f0190196727616e3eaee6a0ee463982d2354f2c4ba9362bbd9cc039556452161.exe
Resource
win10v2004-20231222-en
General
-
Target
f0190196727616e3eaee6a0ee463982d2354f2c4ba9362bbd9cc039556452161
-
Size
1.8MB
-
MD5
99b0070b97e80795c3a5561d29c005b5
-
SHA1
521033f7792a9a572eb55e433f88b4d90932dcf8
-
SHA256
f0190196727616e3eaee6a0ee463982d2354f2c4ba9362bbd9cc039556452161
-
SHA512
e0bb163119849ce524d90af5c5ac45428956e567f17d6a2c673ef431bdbc7ba477a53887eca549ba99e429cef69239a3809d5a43da8ed372f95e8d921b36123c
-
SSDEEP
24576:boC68aGgLR71sqjnhMgeiCl7G0nehbGZpbD:boC3aGgttDmg27RnWGj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f0190196727616e3eaee6a0ee463982d2354f2c4ba9362bbd9cc039556452161
Files
-
f0190196727616e3eaee6a0ee463982d2354f2c4ba9362bbd9cc039556452161.exe windows:6 windows x64 arch:x64
bef4003079cdecb0618677b83247d944
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSASetLastError
accept
listen
send
htons
htonl
WSAGetLastError
WSASocketW
select
__WSAFDIsSet
WSACleanup
WSAStartup
bind
recv
closesocket
kernel32
DeleteTimerQueueEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
GetFileAttributesW
RemoveDirectoryW
SetConsoleCtrlHandler
GetCommandLineW
GetTickCount
HeapAlloc
GetProcessHeap
HeapFree
OpenMutexW
CreateMutexW
AllocConsole
AttachConsole
lstrlenW
GetSystemDirectoryW
LoadLibraryW
GetProcessId
MultiByteToWideChar
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringA
lstrcmpA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeThread
LoadLibraryExW
AddDllDirectory
FreeLibrary
CreateTimerQueue
GetModuleFileNameW
GetExitCodeProcess
VerifyVersionInfoW
GetModuleHandleW
CreateProcessW
VerSetConditionMask
WTSGetActiveConsoleSessionId
GetProcAddress
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
InitializeCriticalSectionEx
PeekNamedPipe
CreatePipe
K32GetModuleFileNameExW
TerminateProcess
GetCurrentProcess
FlushFileBuffers
WaitNamedPipeW
WriteFile
SetLastError
GetCurrentProcessId
LocalFree
ResetEvent
CreateThread
DeleteFileW
SetEvent
OutputDebugStringW
GetLastError
Sleep
CreateEventW
LocalAlloc
WaitForSingleObject
FindClose
GetEnvironmentVariableW
WaitForMultipleObjects
FindNextFileW
GetFileSizeEx
FindFirstFileW
CreateDirectoryW
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
CloseHandle
ReadFile
GetFileSize
CreateFileW
SystemTimeToFileTime
user32
CloseWindow
UnregisterPowerSettingNotification
RegisterClassW
UnregisterDeviceNotification
RegisterDeviceNotificationW
GetWindowThreadProcessId
GetShellWindow
CreateWindowExW
GetMessageW
RegisterPowerSettingNotification
TranslateMessage
DefWindowProcW
GetProcessWindowStation
GetUserObjectInformationW
wsprintfW
DispatchMessageW
advapi32
QueryServiceStatusEx
InitializeSecurityDescriptor
FreeSid
RegCreateKeyExW
SetEntriesInAclW
AllocateAndInitializeSid
SetFileSecurityW
RegCloseKey
RegNotifyChangeKeyValue
SetSecurityDescriptorDacl
GetTokenInformation
AddAccessAllowedAce
DuplicateTokenEx
GetLengthSid
CreateProcessAsUserW
RegOpenKeyExW
RegDeleteKeyExW
RegEnumKeyW
DeleteService
QueryServiceStatus
StartServiceW
CreateServiceW
ChangeServiceConfig2W
OpenSCManagerW
CloseServiceHandle
InitializeAcl
ControlService
OpenServiceW
EnumDependentServicesW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
RegFlushKey
RegDeleteValueW
RegGetValueW
ReadEventLogW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
NotifyChangeEventLog
OpenEventLogW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertStringSidToSidW
CreateProcessWithTokenW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
RegQueryValueExW
shell32
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHFileOperationW
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CLSIDFromString
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
msvcp140
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
_Query_perf_counter
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
_Query_perf_frequency
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??Bid@locale@std@@QEAA_KXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
shlwapi
PathFileExistsW
SHDeleteKeyW
PathIsDirectoryW
PathAppendW
wtsapi32
WTSEnumerateSessionsW
WTSQueryUserToken
WTSQuerySessionInformationW
WTSFreeMemory
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
crypt32
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CertGetNameStringW
CryptQueryObject
CryptDecodeObject
CryptMsgClose
CertFreeCertificateContext
api-ms-win-core-path-l1-1-0
PathCchAppend
PathCchRemoveFileSpec
vcruntime140
memcmp
memcpy
_local_unwind
__CxxFrameHandler3
__std_terminate
__std_exception_destroy
__std_exception_copy
wcsrchr
__C_specific_handler
_CxxThrowException
memset
memmove
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
exit
_exit
_errno
_c_exit
_register_thread_local_exe_atexit_callback
_get_wide_winmain_command_line
_seh_filter_exe
_initialize_wide_environment
_invalid_parameter_noinfo
terminate
_invalid_parameter_noinfo_noreturn
_crt_atexit
_initialize_onexit_table
_configure_wide_argv
_register_onexit_function
_set_app_type
_cexit
api-ms-win-crt-stdio-l1-1-0
setvbuf
fflush
fclose
__acrt_iob_func
__stdio_common_vsscanf
_wfsopen
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__stdio_common_vswprintf_s
__stdio_common_vsprintf_s
_wfopen_s
ungetwc
ungetc
fputwc
fgetwc
fgetc
_set_fmode
fwrite
fgetpos
_fseeki64
fsetpos
__stdio_common_vfwprintf
__p__commode
api-ms-win-crt-string-l1-1-0
_stricmp
strncpy_s
wcsncpy_s
_wcsicmp
strnlen
_wcsnicmp
wcsncat_s
wcscpy_s
wcscat_s
wcstok_s
tolower
towlower
api-ms-win-crt-time-l1-1-0
_localtime64_s
wcsftime
_time64
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
realloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
_wtoi
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 167KB - Virtual size: 167KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE