Static task
static1
Behavioral task
behavioral1
Sample
14622bf4b22c735aa93a7b565759fc67.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
14622bf4b22c735aa93a7b565759fc67.exe
Resource
win10v2004-20231222-en
General
-
Target
14622bf4b22c735aa93a7b565759fc67
-
Size
44KB
-
MD5
14622bf4b22c735aa93a7b565759fc67
-
SHA1
279cc11e038b380966d8f277304bd4bf6428184f
-
SHA256
866f89325b2c4aa71829d1b4d2ba1954e567831e9d6faf5fb8dc905cd5a6780f
-
SHA512
f431a9792a0fd50ab830631f4352a08ae0a7a174b3558be53fc2f0ae59650e1d17f8a029a83413ab19b670f547145ba9bc8e7c7b0204bee0314e6385187e3351
-
SSDEEP
768:Q/ZIRmwGdAOwZhP9o6atZmq7tdcPsHxjRh+vs0zNKqMUpg6eJ6:AIXGv0FhGtdcPwx1GlzNKqMUpgd6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 14622bf4b22c735aa93a7b565759fc67
Files
-
14622bf4b22c735aa93a7b565759fc67.exe windows:5 windows x86 arch:x86
a8836736df882fdda129a9c49d10a832
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteTapemark
GetStartupInfoA
LeaveCriticalSection
GetVolumePathNameA
LoadLibraryA
GetStringTypeExA
BaseCheckAppcompatCache
HeapCompact
GetCPInfo
_llseek
SetInformationJobObject
RegisterWowBaseHandlers
CreateProcessInternalA
SetComputerNameExA
GetConsoleMode
GetProfileIntA
ReadConsoleInputA
lstrcmpiA
QueryPerformanceFrequency
RaiseException
lstrcpynA
SetWaitableTimer
DeleteCriticalSection
WaitForSingleObject
GlobalAlloc
SetCommState
EnterCriticalSection
ExitProcess
IsBadStringPtrW
GetPrivateProfileIntW
LocalShrink
ReadFileScatter
FindAtomW
AssignProcessToJobObject
_lwrite
GetSystemDirectoryA
VirtualAlloc
TransactNamedPipe
odbccp32
SQLRemoveDriverW
SQLRemoveTranslatorW
ODBCCPlApplet
SQLInstallerError
SQLWritePrivateProfileStringW
SQLGetInstalledDriversW
SQLRemoveDriverManager
SQLGetAvailableDriversW
SQLInstallODBC
SQLGetPrivateProfileStringW
SQLInstallDriver
SQLReadFileDSN
SQLRemoveDSNFromIni
SQLGetTranslator
SQLInstallTranslatorExW
SQLInstallTranslator
SelectTransDlg
SQLWriteDSNToIniW
SQLRemoveTranslator
SQLLoadDriverListBox
SQLCreateDataSourceEx
SQLInstallDriverManagerW
SQLCreateDataSourceExW
SQLInstallDriverManager
SQLCreateDataSourceW
SQLInstallerErrorW
SQLInstallDriverW
SQLPostInstallerErrorW
SQLWritePrivateProfileString
SQLRemoveDSNFromIniW
SQLGetPrivateProfileString
SQLInstallTranslatorW
SQLGetTranslatorW
SQLInstallTranslatorEx
SQLSetConfigMode
SQLConfigDataSource
SQLRemoveDefaultDataSource
SQLCreateDataSource
SQLGetInstalledDrivers
SQLLoadDataSourcesListBox
SQLManageDataSources
scecli
SceSetupUpdateSecurityKey
SceGetTimeStamp
SceGenerateGroupPolicy
SceOpenProfile
SceSvcUpdateInfo
SceGetDatabaseSetting
SceCompareNameList
SceSvcSetInfo
SceBrowseDatabaseTable
SceSetupGenerateTemplate
SceSvcSetInformationTemplate
SceIsSystemDatabase
SceGetScpProfileDescription
SceSvcConvertTextToSD
SceCopyBaseProfile
SceFreeProfileMemory
SceSetupUpdateSecurityService
SceNotifyPolicyDelta
SceGetSecurityProfileInfo
SceSetupBackupSecurity
SceAddToNameStatusList
SceStartTransaction
SceCompareSecurityDescriptors
SceFreeMemory
SceSvcGetInformationTemplate
msvcp60
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
??4?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
?good@ios_base@std@@QBE_NXZ
?uflow@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Getcat@?$moneypunct@G$00@std@@SAIXZ
??0_Locinfo@std@@QAE@PBD@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGPAG0@Z
?abs@std@@YAMABV?$complex@M@1@@Z
_Mbrtowc
?seekoff@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z
?_Doraise@underflow_error@std@@MBEXXZ
??Ostd@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?_Term@?$ctype@D@std@@KAXXZ
?max@?$numeric_limits@N@std@@SANXZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
?_Isinf@?$_Ctr@O@std@@SA_NO@Z
??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@
wcsrtombs
?round_error@?$numeric_limits@F@std@@SAFXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z
?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?_Exp@?$_Ctr@N@std@@SAFPANNF@Z
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@
?truename@?$numpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??4?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??_7out_of_range@std@@6B@
?pbackfail@?$basic_filebuf@GU?$char_traits@G@std@@@std@@MAEGG@Z
?arg@std@@YAOABV?$complex@O@1@@Z
?epsilon@?$numeric_limits@K@std@@SAKXZ
??_7?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
ir50_qcx
AllocInstanceData
SetScalability
SetCPUID
CompressQuery
DllMain
CompressFramesInfo
Compress
FreeInstanceData
CompressEnd
CompressBegin
regapi
RegWinStationAccessCheck
RegWinStationQueryNumValueW
RegWinStationQueryW
RegCdCreateA
RegCdQueryA
RegWinStationDeleteA
RegWinStationSetSecurityW
RegWinStationQueryDefaultSecurity
RegWdDeleteA
RegGetMachinePolicyEx
RegDefaultUserConfigQueryW
RegWinStationDeleteW
RegPdDeleteA
RegUserConfigDelete
RegWinStationSetNumValueW
RegPdEnumerateW
RegDenyTSConnectionsPolicy
RegPdDeleteW
RegWinStationQueryA
RegGetUserPolicy
RegPdQueryA
RegCdEnumerateW
RegCloseServer
RegGetMachinePolicy
RegWinStationEnumerateW
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ