Static task
static1
Behavioral task
behavioral1
Sample
6bae23070d4623bcdbad0e633b09f352db78c4d24695a296f0fa091ce8421a8b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6bae23070d4623bcdbad0e633b09f352db78c4d24695a296f0fa091ce8421a8b.exe
Resource
win10v2004-20231215-en
General
-
Target
6bae23070d4623bcdbad0e633b09f352db78c4d24695a296f0fa091ce8421a8b
-
Size
555KB
-
MD5
2b40841745159328ff4032fe97746ebd
-
SHA1
ed830fd77daeb9ccae9f0d25258ee451fa658f36
-
SHA256
6bae23070d4623bcdbad0e633b09f352db78c4d24695a296f0fa091ce8421a8b
-
SHA512
09e0f4973740b27f6062bd51604437b9c56f72b0f31bee5f73e5292cb9e1993d4c9575f8d5950d662101bf2faf81e81e3733f6dda3d4f3d3a21b11dbae440302
-
SSDEEP
12288:BNoK6VoaK85AV9pGHNu4B2UoZPJS/PC/dJ+bDFpPOofVL:BNoXVoaK8KII4ro1uLRdfV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6bae23070d4623bcdbad0e633b09f352db78c4d24695a296f0fa091ce8421a8b
Files
-
6bae23070d4623bcdbad0e633b09f352db78c4d24695a296f0fa091ce8421a8b.exe windows:6 windows x64 arch:x64
d554829202f49a5b79e16f9a11182f74
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
hid
HidD_GetAttributes
HidD_GetPreparsedData
HidP_GetCaps
HidD_GetHidGuid
setupapi
SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
mfc140
ord14208
ord6102
ord14209
ord6100
ord14207
ord7688
ord12160
ord14007
ord11615
ord11614
ord2004
ord7637
ord12571
ord3941
ord4002
ord9049
ord14133
ord7619
ord14135
ord12171
ord12170
ord2437
ord5167
ord7989
ord12490
ord8050
ord8131
ord450
ord3258
ord4086
ord3157
ord8788
ord6565
ord2182
ord2207
ord3591
ord10117
ord4714
ord8128
ord13784
ord8432
ord10680
ord9016
ord5221
ord13683
ord13689
ord8693
ord6266
ord8863
ord8888
ord11803
ord2695
ord13327
ord5980
ord3066
ord3299
ord3300
ord11037
ord10657
ord11761
ord1487
ord12913
ord5656
ord2473
ord6229
ord4710
ord7519
ord4715
ord7364
ord3705
ord9351
ord3501
ord6299
ord3748
ord6101
ord1032
ord4648
ord2264
ord1639
ord6292
ord6226
ord988
ord8862
ord5687
ord7890
ord5211
ord7420
ord7431
ord7430
ord5896
ord5049
ord5213
ord5067
ord5566
ord5323
ord9001
ord5536
ord5347
ord5064
ord11798
ord3165
ord3270
ord3271
ord3804
ord11754
ord2627
ord5704
ord13284
ord11357
ord6607
ord14134
ord7620
ord14136
ord2962
ord4343
ord9343
ord4351
ord4817
ord4756
ord4741
ord4803
ord4848
ord4771
ord4826
ord4842
ord4783
ord4789
ord4795
ord4777
ord4832
ord4765
ord1750
ord1729
ord1743
ord1717
ord1695
ord11888
ord11892
ord13438
ord3166
ord8909
ord10644
ord6703
ord11850
ord8618
ord14128
ord11575
ord3710
ord11719
ord8779
ord11366
ord316
ord3723
ord11365
ord5435
ord9936
ord9932
ord1084
ord9934
ord9935
ord9933
ord14279
ord2696
ord7881
ord3202
ord3205
ord13331
ord438
ord4021
ord11869
ord11877
ord4490
ord4436
ord7888
ord10079
ord11881
ord11849
ord1507
ord12552
ord5539
ord9898
ord6590
ord1089
ord6143
ord1087
ord1421
ord3943
ord13469
ord7028
ord13050
ord940
ord2173
ord7685
ord1446
ord981
ord7363
ord10026
ord265
ord266
ord2899
ord1674
ord305
ord5691
ord2917
ord300
ord1504
ord1367
ord878
ord310
ord13872
ord1485
ord1381
ord3734
ord6533
ord4020
ord8792
ord13603
ord12692
ord9903
ord2471
ord1051
ord5982
ord3051
ord3138
ord2368
ord6788
ord7206
kernel32
GetLastError
OutputDebugStringW
DeleteCriticalSection
SetLastError
CloseHandle
CreateFileA
WriteFile
CreateEventA
ReadFile
GetOverlappedResult
Sleep
CreateThread
SizeofResource
LockResource
LoadResource
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
FindResourceA
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
user32
GetSystemMetrics
DrawIcon
PostMessageA
RedrawWindow
GetParent
IsIconic
GetSysColor
SendMessageA
GetClientRect
AppendMenuA
InvalidateRect
DrawFrameControl
CopyRect
EnableWindow
GetSystemMenu
LoadIconW
MessageBoxA
MessageBoxW
FillRect
gdi32
GetTextExtentPoint32A
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
GetStockObject
CreateSolidBrush
msimg32
TransparentBlt
comctl32
InitCommonControlsEx
_TrackMouseEvent
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
memmove
_CxxThrowException
__current_exception
memcmp
memset
__std_exception_destroy
__std_exception_copy
memchr
__C_specific_handler
memcpy
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_initialize_narrow_environment
terminate
_initialize_onexit_table
_errno
_c_exit
_register_onexit_function
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vsprintf_s
api-ms-win-crt-heap-l1-1-0
malloc
free
_set_new_mode
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_setmbcp
_configthreadlocale
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 452KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ