Static task
static1
Behavioral task
behavioral1
Sample
256a14ddaad8867c66ba1a0ccfa4f694.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
256a14ddaad8867c66ba1a0ccfa4f694.exe
Resource
win10v2004-20231215-en
General
-
Target
256a14ddaad8867c66ba1a0ccfa4f694
-
Size
415KB
-
MD5
256a14ddaad8867c66ba1a0ccfa4f694
-
SHA1
aabf1b86c4b96f899fe98c0b0c4994c4817c0d24
-
SHA256
aa299d63a0bc1cd9b0e030ca668d2c2159c0f84fe337511936bdb7e574a4dbc2
-
SHA512
ac362928d9f42f67fdede76d770242da3ca8e6f2534001c2bf81410f95fb0972f35c35979e94b7249dc8ac169586a3374ed182d1a25732f8ab3280987128c662
-
SSDEEP
6144:tgwIfdUopdYFyRjunPFgfmL5V/rKBu8h27gEcecLJyQjOZypq5XgcinYVj:a+sinPFmmLvDK+7TcFy4o5XnV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 256a14ddaad8867c66ba1a0ccfa4f694
Files
-
256a14ddaad8867c66ba1a0ccfa4f694.exe windows:6 windows x64 arch:x64
81a88a0afcd662baae8f86e9b596f79d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
RegEnumKeyW
RegEnumValueW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegNotifyChangeKeyValue
kernel32
HeapDestroy
GetVersionExA
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
LoadLibraryW
VirtualFree
InterlockedPopEntrySList
VirtualAlloc
InterlockedPushEntrySList
GetStartupInfoW
SetUnhandledExceptionFilter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
WaitForMultipleObjects
ExpandEnvironmentStringsW
GlobalFree
GetTempFileNameW
CreateFileW
WriteFile
SizeofResource
GetModuleFileNameW
MultiByteToWideChar
lstrlenW
RaiseException
GetLastError
GetProcAddress
lstrcmpiW
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
GetCommandLineW
CloseHandle
WaitForSingleObject
Sleep
HeapSetInformation
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
SetLastError
GetCurrentProcess
FlushInstructionCache
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
LockResource
FindResourceExW
OutputDebugStringW
GetTempPathW
GetVersionExW
GetTickCount
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
RegisterApplicationRestart
QueryPerformanceCounter
QueryPerformanceFrequency
SetEvent
GetFileAttributesExW
CompareStringW
CreateProcessW
HeapSize
DeleteCriticalSection
CreateEventW
gdi32
GetStockObject
GetObjectW
GetDeviceCaps
DeleteDC
DeleteObject
SelectObject
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
user32
GetClassNameW
IsWindow
SendMessageW
GetDlgItem
GetWindow
SetFocus
GetFocus
IsChild
EndPaint
BeginPaint
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
GetSysColor
LoadIconW
SetForegroundWindow
CreateWindowExW
SetTimer
GetPropW
KillTimer
RemovePropW
SetWindowPos
LoadBitmapW
GetKeyboardLayout
UnregisterClassW
EnumThreadWindows
AllowSetForegroundWindow
DestroyAcceleratorTable
RedrawWindow
GetClassInfoExW
DestroyWindow
SystemParametersInfoW
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
GetClientRect
InvalidateRect
InvalidateRgn
CallWindowProcW
CharNextW
FillRect
GetDC
GetDesktopWindow
ReleaseDC
GetKeyboardLayoutList
UnregisterClassA
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassExW
LoadCursorW
DefWindowProcW
SetWindowLongW
GetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
SetPropW
msvcrt
wcscat_s
wcscpy_s
_wcsicmp
wcschr
_wcsnicmp
_beginthreadex
_itow
memcmp
memcpy
vswprintf_s
swprintf_s
iswspace
memmove_s
wcsstr
??2@YAPEAX_K@Z
memcpy_s
_purecall
??_V@YAXPEAX@Z
malloc
free
??_U@YAPEAX_K@Z
wcsncpy_s
_vscwprintf
_endthreadex
_vsnwprintf
__CxxFrameHandler3
??3@YAXPEAX@Z
memset
__C_specific_handler
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
realloc
_errno
??1type_info@@UEAA@XZ
_unlock
__dllonexit
_lock
_onexit
qsort
_CxxThrowException
dui70
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
UnInitThread
InitThread
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
??0HWNDHost@DirectUI@@QEAA@XZ
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z
?Register@HWNDHost@DirectUI@@SAJXZ
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
CreateDUIWrapper
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
??1HWNDHost@DirectUI@@UEAA@XZ
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ
?OnReset@TaskPage@DirectUI@@MEAA_JXZ
?OnKillActive@TaskPage@DirectUI@@MEAA_JXZ
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z
?GetPageResID@TaskPage@DirectUI@@MEAAPEBGXZ
?GetPageRCID@TaskPage@DirectUI@@MEAAIXZ
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?SetHeight@Element@DirectUI@@QEAAJH@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z
?Click@Button@DirectUI@@SA?AVUID@@XZ
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?SetDataEntry@PText@DirectUI@@QEAAXPEAUIDataEntry@2@@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
??0TaskPage@DirectUI@@QEAA@XZ
??1TaskPage@DirectUI@@UEAA@XZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z
??1IDataEntry@DirectUI@@UEAA@XZ
??0IDataEntry@DirectUI@@QEAA@XZ
StrToID
UnInitProcessPriv
InitProcessPriv
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAVDialogElement@2@@Z
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAVDialogElement@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?DefaultAction@Button@DirectUI@@UEAAJXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@Button@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??1CritSecLock@DirectUI@@QEAA@XZ
??0Button@DirectUI@@QEAA@XZ
??1Button@DirectUI@@UEAA@XZ
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?Release@Value@DirectUI@@QEAAXXZ
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?GetHeight@Element@DirectUI@@QEAAHXZ
?GetWidth@Element@DirectUI@@QEAAHXZ
?AddRef@Value@DirectUI@@QEAAXXZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
ColorFromEnumI
GetThemeHandle
?OnPropertyChanged@Button@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?Register@Button@DirectUI@@SAJXZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
comctl32
ord345
PropertySheetW
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
ole32
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
CoGetInterfaceAndReleaseStream
OleUninitialize
CoInitializeEx
CoRevokeClassObject
CoResumeClassObjects
CoRegisterClassObject
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoSuspendClassObjects
StringFromCLSID
OleLockRunning
oleaut32
SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
VarBstrCmp
OleCreateFontIndirect
LoadRegTypeLi
SysStringByteLen
VariantClear
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringByteLen
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
VariantChangeType
SafeArrayCreate
VarUI4FromStr
shlwapi
StrCmpW
SHRegGetValueW
PathFileExistsW
uxtheme
CloseThemeData
OpenThemeData
GetThemeColor
shell32
ShellExecuteW
wer
WerReportSetParameter
WerReportCloseHandle
WerReportSubmit
WerReportCreate
WerReportAddFile
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwLogTraceEvent
Sections
.text Size: 209KB - Virtual size: 209KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE