Static task
static1
Behavioral task
behavioral1
Sample
ca9a48f8969815ce33f89b03149e2010af9663c67da5f355ce7f2d38e14634da.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ca9a48f8969815ce33f89b03149e2010af9663c67da5f355ce7f2d38e14634da.exe
Resource
win10v2004-20231215-en
General
-
Target
ca9a48f8969815ce33f89b03149e2010af9663c67da5f355ce7f2d38e14634da
-
Size
488KB
-
MD5
45defb747b942fbf3f322636df8a94ff
-
SHA1
6d11c71e1a633c4881cfdc8b3f7220eca84c0e7c
-
SHA256
ca9a48f8969815ce33f89b03149e2010af9663c67da5f355ce7f2d38e14634da
-
SHA512
6ab713d6058f757ddbb5da0d5d68a9736a7080b7aac9fb1eb2b3e6099a710e379aaf7e6dfe45ecfb59f55a1b365e07c667629046b87840380f16acc85b053993
-
SSDEEP
6144:c6cJ8MgsTHCFqSi6f0VhK/JInw8MFHL2TWM23pGgjiGTHPN8k5I10nWn4gUQ6mFP:znT0VhXw9M2uGTVOsWn4Sl9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ca9a48f8969815ce33f89b03149e2010af9663c67da5f355ce7f2d38e14634da
Files
-
ca9a48f8969815ce33f89b03149e2010af9663c67da5f355ce7f2d38e14634da.exe windows:6 windows x64 arch:x64
6b7bcf916e742c8200bb0bd0954fd936
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSACleanup
WSAStartup
inet_addr
socket
recvfrom
htons
sendto
vmm
VMMDLL_ProcessGetModuleBaseW
VMMDLL_PidGetFromName
VMMDLL_Initialize
VMMDLL_Scatter_ExecuteRead
VMMDLL_Scatter_CloseHandle
VMMDLL_MemReadEx
VMMDLL_Scatter_Clear
VMMDLL_Scatter_PrepareEx
VMMDLL_Scatter_Initialize
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
SetUnhandledExceptionFilter
UnhandledExceptionFilter
MultiByteToWideChar
EnterCriticalSection
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetModuleHandleW
Sleep
CloseHandle
IsProcessorFeaturePresent
TerminateProcess
RtlVirtualUnwind
GetCurrentThreadId
GetCurrentProcess
RtlLookupFunctionEntry
GlobalAlloc
RtlCaptureContext
user32
DefWindowProcW
DestroyWindow
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
PeekMessageW
TranslateMessage
PostQuitMessage
UpdateWindow
GetKeyState
GetMessageExtraInfo
ScreenToClient
GetCapture
ClientToScreen
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
LoadCursorW
SetClipboardData
SetCapture
SetCursor
GetClientRect
IsWindowUnicode
ReleaseCapture
SetCursorPos
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmSetCandidateWindow
ImmGetContext
msvcp140
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Query_perf_counter
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_function_call@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xlength_error@std@@YAXPEBD@Z
_Xtime_get_ticks
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?good@ios_base@std@@QEBA_NXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memmove
memset
memcmp
memchr
__std_terminate
strstr
__std_exception_destroy
__std_exception_copy
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
api-ms-win-crt-stdio-l1-1-0
fputc
fgetc
fgetpos
setvbuf
__p__commode
__stdio_common_vsscanf
fread
_set_fmode
__stdio_common_vsprintf
_wfopen
fwrite
ungetc
_get_stream_buffer_pointers
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
ftell
_fseeki64
fsetpos
__stdio_common_vsprintf_s
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-string-l1-1-0
strncmp
strcmp
toupper
strncpy
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
malloc
_callnewh
api-ms-win-crt-convert-l1-1-0
strtoull
atoi
strtod
strtoll
atof
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
terminate
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_errno
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-math-l1-1-0
sinf
cosf
ceilf
sqrtf
powf
atan2f
acosf
sqrt
pow
fmodf
_dclass
__setusermatherr
Sections
.text Size: 386KB - Virtual size: 385KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 752B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ