d�@y%Cٓ�t�=��N��Ut�O����,l�������:Et�w�l�RcI�EЋM^X��B�9��K>7U�1���F������~�&�r�S$ގ{7�@C�b[��6w�Y$�;#:��G��{���pe]%�jF���,�;���}��7/����4h=�Ko�G�����!8 �����n�x]�I�� ��~� � $i����&l)����'��C)oh�]F�r�K�_����"h�������2�cA�#�ϼ���O����h����Y7_�����ώ�f�q�#0�f������9(Ex!� �9/���}Se��� �U���90��$���Q|nq��cy�5��N����+�emđ�faf���G���-8�bv�p����D��،��QDzd��*���ZKT����+ݟ��������9W�q��r̟���9�6;��E����tbm�l��@ZN���� �e )��<�$��.�ƞ)�|�J���G"=�a��݂,�-�$ ��֥r�/��������F1Y����V���������P�w�#�Ε�����[����R�;��ߐ��S��\�3�mEW�҆\B���٦/�q�L�[w��L)�%���75���[���0W�>��Tw�_���:�ܨ�Mj�}-@�??�R��<}MV�I>?���A�}i�+�A�����H} �����QPDA�����f��[y�8�%�;��5<Ȓكn�0k)X8�D$-�^R�C <o��n2�9n�t����f�S=KQ���)Ը$�o�ʔ ֤/��i��"�~�vaB�V�Z�R� H�����MH�JMF^���N�j�#@}N��'�1C�L��S�2��Rt;�+��"}g���WR]���͕��a8����dAĞF��Hu�8-��8���\�6_��PX�2����DZ.fZ�צ��C�u��ps�K~�3�h�?O���Œ�����Z���*��W>"���o�s�w^|�?�|�a�� #���{j��;�q� R�=�_B��!<@|����TTJ�D�v���H�x�˔u)C���j,����[C�?Sơэ�� l>�wY�}U��!� ��*�Q�����܌�ǔ��r����/��Nc�i��gȚ�l؛-��A�Ϲ��P'ᢺ�V� �3[���;���U)c�郝e� ��{��!��;=��B���7W���OP�t��et�a����v`3#�O��~X��`s� Ͻ�/������)b��UD (�&�ƕ�����;�E���m@�y��/#� �$O⎳��t��t��n��kӦz��b.o���`wl�S"�6{1R좩�0�"�Z��D��H�ө���3;,�?�.�y��Ѱ�=�!���F��]AD�¤���1�7��nl�+�P����hMٞ�t�DҲ���s=u5-�L�nxQWZ�oQ�� r�k�&���l��h��UD���#Һ;��I{��R̤�_�W��<���BSA�_��%>��������b�m�Б�����S�uՔ��Mc�^gh �J;}o����(�1�����Cz�;,�x�!�ݳ{�\��G�3��\�+�]y�|��n����nZu� 4ah�}%�O��S����B"��oYT\�<�թK/��Qԟ��o��+����D��s���__�w���: ��V�/�b(��ñE��tE���B �>�3"���7��}Ci�kʬv���?�����pq(�R0J�pb*]-���l��Z��^1�ܢŤ���sc�9���$עN�1��k�61: ���P탊)NF2��� �LMڕF!L�!�x�$vB��C�D˶s���4����V������6�v>֧#�.MO(�Y��#���ͬ���a���������i:�cg�>n��&���SIi[C}�ꉻ��0��醓?��'+�@Ih��Q.Q���< ��7�����C'�˴Bჼz��U�������t�0�F��~�8�_ڪs��z)6萴�!�����f��<� ����Z-/���@�YS�I�f;��G�Hfm/�ͭ����q�{�����}c$�}���ݷD�7ю]3�U|��I�% �\9�j ������&8!q\��P�0��)�����yx�R���7Xg ���`Ri}����(�P� ɐ������%V5��c(��3#��Hc���|��L�m�s ��*e{��%�$冾 �Jހ,+K�͂��;�\��o� '��0��16��c��`t���h*����cw �'�c�;�1Y5�� Ƈ��ER� aJ�]�!�w؉��)�T`*'�@T+�Ϯ��B=��aV��3������&'|�caZ��ȓ�����X����@ _1? ���ݐ�4AR����!_�.�,,�!��S\��8{$� s3���?EE��͵4�`2�AQ�Y�Ri�m�-�99�� )gf����c̑f�U봼-jS�����:h�(ΌWZ��G�&�:�WB7p��f��&�j#�"p�ZC�L"����E����s���E��u�g��t��raXz���&��ûWT�N�38��@� Û�{���^0xH�������AH7}���bm/=Y�[����HT�S�d4ZD[9]�h{d/� ���q�3�[|q[{灋C=D���a�r8~�3n����5�f@:(�^49$����/t�}��#��]#��'b��YKc5}X¢jQG����I.×_��V[��4�q��:]��� 0��;ht/���I��6�Cp���,$0H͎^l�9�������\a�, � �"��l��G�D�Jt,8�iQ"/��,��;�ݨ��,1!�p���>@]a0�p��[0�s�������^���,6���i��ݖ�sWE�D\i�;&P�s�d��]o���Wx���\�`QX�*y�zP!���" n�}��igs��)3�ï� ����2�� Jt�����X?����vj���1��,69c���W�d;�&-jmm��$;Dw��xZ�y�h�,�`f�-L�,�nD '��I�՟e@]}���C-T����`W��Vh�������N
Static task
static1
Behavioral task
behavioral1
Sample
1b3bdc14c2ca627aab31e45f37be1438.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1b3bdc14c2ca627aab31e45f37be1438.exe
Resource
win10v2004-20231215-en
General
-
Target
1b3bdc14c2ca627aab31e45f37be1438
-
Size
3.6MB
-
MD5
1b3bdc14c2ca627aab31e45f37be1438
-
SHA1
3e2d17b830bca96c8f4a808d3f01bcf9381d7921
-
SHA256
17e3f44e4832deb4ed917f2c608603a81a77501cb524ae4eda1b21d536cb42ff
-
SHA512
5be7e675fd5f999f8a616742f249882a171ad469e45282ba21af5c78fa498b3e93cfe89c56dac7a954c55fb9a976ab6f7d56aad3ed47264aee9f6e7c0c840e37
-
SSDEEP
98304:L+Gzqu7jcapnG7mYJP6BwqbvrXdDD2lMe+:LxHVnG7mqM2ly
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b3bdc14c2ca627aab31e45f37be1438
Files
-
1b3bdc14c2ca627aab31e45f37be1438.exe windows:6 windows x64 arch:x64
9a4e47dbf0ee171e5727a3fa553b17a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
GetUserNameA
OpenSCManagerA
RegQueryValueExA
CloseServiceHandle
RegCloseKey
EnumServicesStatusExA
OpenServiceA
StartServiceA
ControlService
DeleteService
QueryServiceConfigA
CreateServiceA
EnumServicesStatusA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyExA
CloseServiceHandle
QueryServiceConfigW
OpenServiceW
EnumServicesStatusExW
OpenSCManagerW
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
version
VerQueryValueW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
kernel32
Sleep
GetModuleHandleExA
Wow64RevertWow64FsRedirection
GetLastError
GetFileAttributesA
CreateFileA
SetEvent
GetCurrentThread
LoadLibraryA
Process32Next
CloseHandle
RaiseException
GetSystemInfo
K32GetModuleInformation
CreateThread
GetWindowsDirectoryA
HeapAlloc
SwitchToThread
AddVectoredExceptionHandler
LocalSize
GetThreadContext
GetProcAddress
LocalFree
HeapQueryInformation
VerSetConditionMask
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
lstrcmpiA
VerifyVersionInfoW
GetComputerNameExA
FormatMessageA
CreateEventA
VirtualQuery
IsDebuggerPresent
GetComputerNameA
CheckRemoteDebuggerPresent
SetUnhandledExceptionFilter
K32QueryWorkingSetEx
Process32NextW
Process32FirstW
GetModuleHandleW
WideCharToMultiByte
QueryPerformanceFrequency
QueryPerformanceCounter
DeviceIoControl
InitializeCriticalSectionEx
CreateFileW
GetTempPathA
GetVersionExA
OpenProcess
SetLastError
SetConsoleTitleA
TerminateProcess
DebugBreak
GetExitCodeProcess
WriteProcessMemory
MultiByteToWideChar
CreateRemoteThread
VirtualFreeEx
GetModuleHandleA
lstrcmpA
GlobalGetAtomNameA
RemoveVectoredExceptionHandler
Process32First
SetHandleInformation
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
FreeLibrary
VerifyVersionInfoA
GetTickCount
WaitForSingleObjectEx
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
AreFileApisANSI
LocalAlloc
WaitForSingleObject
UnhandledExceptionFilter
IsProcessorFeaturePresent
CreateMutexA
ResetWriteWatch
lstrlenA
GetWriteWatch
GetEnvironmentVariableW
ExpandEnvironmentStringsA
VirtualAlloc
OutputDebugStringA
Wow64DisableWow64FsRedirection
GetStdHandle
GetCurrentProcess
VirtualFree
HeapFree
VirtualAllocEx
CreateToolhelp32Snapshot
DeleteCriticalSection
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
CreateEventW
InitializeCriticalSectionAndSpinCount
GetBinaryTypeW
VirtualProtect
GetCurrentProcess
FreeLibrary
TerminateProcess
GetSystemInfo
CreateToolhelp32Snapshot
Thread32First
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
GetTickCount
GetLocalTime
GlobalFree
GetProcAddress
LocalAlloc
LoadLibraryA
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
FlushFileBuffers
CreateFileA
GetCurrentProcessId
GetLastError
GetModuleFileNameW
CreateEventA
GetModuleHandleA
GetSystemTimeAsFileTime
LocalFree
ReadFile
WriteConsoleW
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapAlloc
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
HeapReAlloc
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
MessageBoxA
GetWindowThreadProcessId
MessageBoxW
GetShellWindow
wsprintfW
CharUpperBuffW
MessageBoxW
shell32
ShellExecuteExA
SHGetSpecialFolderPathA
msvcp140
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
shlwapi
StrStrIA
PathRemoveExtensionW
PathFindFileNameW
PathCombineA
StrCmpIW
StrStrIW
StrCmpNIA
mpr
WNetGetProviderNameA
iphlpapi
GetAdaptersInfo
normaliz
IdnToAscii
ws2_32
send
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
bind
socket
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSACleanup
WSAStartup
recv
htonl
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
ioctlsocket
closesocket
accept
connect
select
listen
WSAIoctl
wldap32
ord211
ord46
ord217
ord143
ord45
ord50
ord41
ord60
ord22
ord26
ord27
ord32
ord33
ord35
ord30
ord200
ord301
ord79
crypt32
CertOpenStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertAddCertificateContextToStore
CryptStringToBinaryA
CertCloseStore
wininet
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
ntdll
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
RtlAdjustPrivilege
NtQuerySystemInformation
NtRaiseHardError
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
_local_unwind
strchr
strstr
_CxxThrowException
__current_exception_context
__current_exception
memchr
memcmp
memset
memmove
strrchr
__std_terminate
__C_specific_handler
__std_exception_destroy
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
__sys_nerr
_beginthreadex
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_initialize_onexit_table
strerror
_initialize_narrow_environment
_getpid
_errno
_configure_narrow_argv
exit
terminate
api-ms-win-crt-string-l1-1-0
isupper
_strdup
strncpy
strncmp
strspn
strcspn
_stricmp
isxdigit
strpbrk
strtok_s
strcmp
tolower
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
_open
__acrt_iob_func
_lseeki64
fclose
__stdio_common_vsprintf_s
fgets
_close
fgetpos
__stdio_common_vfprintf
_write
fgetc
__stdio_common_vsprintf
fputs
fopen
_read
__stdio_common_vsscanf
fread
fwrite
_fseeki64
fsetpos
fseek
fflush
__p__commode
ftell
ungetc
_set_fmode
fputc
setvbuf
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
_mbscmp
api-ms-win-crt-heap-l1-1-0
calloc
malloc
free
realloc
_set_new_mode
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
atoi
strtoul
strtol
strtoll
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_fstat64
remove
_stat64
_lock_file
_access
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 528KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 156KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xrtisth Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xrtisth Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ