Static task
static1
Behavioral task
behavioral1
Sample
765213074fa597903634cec221d4755dd080ca6045bd8c552730cc861ac3443a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
765213074fa597903634cec221d4755dd080ca6045bd8c552730cc861ac3443a.exe
Resource
win10v2004-20231215-en
General
-
Target
765213074fa597903634cec221d4755dd080ca6045bd8c552730cc861ac3443a
-
Size
2.9MB
-
MD5
e06bcb95136ff279a68fe1835dae9edc
-
SHA1
e5798b2098f6cf86d9920c526d45254d3ce6f5de
-
SHA256
765213074fa597903634cec221d4755dd080ca6045bd8c552730cc861ac3443a
-
SHA512
0ed452cd3e31bb5af29acde1cf9d831d8b8ebf7f6b24187c9b8c7a6a6b0e1d18faee94eae9282e110613099e676567c8437b5c2dca8b3a7f01fe10dd4f84964a
-
SSDEEP
49152:o5z3usdPq4C3mENrF1C3NGuSnTCfcVuRFmS:9pTqdGHVmFm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 765213074fa597903634cec221d4755dd080ca6045bd8c552730cc861ac3443a
Files
-
765213074fa597903634cec221d4755dd080ca6045bd8c552730cc861ac3443a.exe windows:5 windows x64 arch:x64
473b035968db605d2fd3fb7b73251687
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
wininet
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoA
InternetErrorDlg
InternetCrackUrlW
HttpAddRequestHeadersA
InternetOpenUrlW
HttpQueryInfoW
HttpEndRequestW
HttpOpenRequestW
FtpGetFileSize
FtpCommandW
FtpOpenFileW
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionW
InternetSetOptionA
InternetQueryOptionW
InternetWriteFile
InternetReadFileExA
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetOpenW
HttpSendRequestExW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
kernel32
CreateEventW
GetExitCodeProcess
SetThreadPriority
SetLastError
ResumeThread
InitializeCriticalSection
Sleep
GetStdHandle
ReadFile
SetHandleInformation
GetTickCount
CreatePipe
CreateProcessW
DeleteFileW
OpenProcess
ReleaseMutex
CreateMutexW
OpenMutexW
VirtualAlloc
VirtualFree
VirtualQuery
GetCurrentProcessId
SetUnhandledExceptionFilter
LoadLibraryW
GetCommandLineW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
CreateFileW
GetFileAttributesW
GetVersionExW
WideCharToMultiByte
ResetEvent
WaitForMultipleObjects
WriteFile
SetEndOfFile
SetFilePointer
SetFileTime
SystemTimeToFileTime
TlsAlloc
TlsSetValue
TlsFree
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
GetDiskFreeSpaceExW
IsBadReadPtr
IsBadWritePtr
TerminateThread
SuspendThread
GetModuleHandleA
GetCurrentThread
DuplicateHandle
LocalFree
GetNativeSystemInfo
FormatMessageA
OutputDebugStringA
IsDebuggerPresent
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemInfo
GetModuleHandleExA
AssignProcessToJobObject
GetLongPathNameW
GetFileSize
FindClose
WaitForSingleObject
GetCurrentDirectoryW
RemoveDirectoryW
GetFileAttributesExW
FindFirstFileW
FindNextFileW
MoveFileW
MoveFileExW
ReplaceFileW
TryEnterCriticalSection
DeviceIoControl
lstrcmpA
GetUserDefaultLangID
lstrlenW
GetModuleHandleExW
TlsGetValue
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
FlushFileBuffers
SetFilePointerEx
RegisterWaitForSingleObject
UnregisterWaitEx
GetSystemDirectoryW
GetWindowsDirectoryW
MulDiv
FindResourceExW
ExitProcess
lstrlenA
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
VirtualProtect
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
RtlPcToFileHeader
RtlUnwindEx
ExitThread
GetConsoleCP
GetConsoleMode
GetFullPathNameW
GetFileType
PeekNamedPipe
WriteConsoleW
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
SetEvent
CreateThread
LockResource
FreeResource
MultiByteToWideChar
FindResourceW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
CloseHandle
SizeofResource
LoadResource
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetProcAddress
FreeLibrary
GetTimeZoneInformation
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
SetStdHandle
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
HeapReAlloc
HeapAlloc
HeapDestroy
DecodePointer
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
WaitForSingleObjectEx
GetPrivateProfileStringA
CreateEventA
GetFileAttributesA
SetFileAttributesW
lstrcpyW
GetDriveTypeW
user32
EndDialog
SetFocus
DialogBoxParamW
FindWindowW
OffsetRect
SubtractRect
FillRect
ReleaseDC
DrawTextW
AllowSetForegroundWindow
ReplyMessage
SendMessageTimeoutW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
LoadCursorW
GetWindow
GetWindowThreadProcessId
EnableWindow
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
IsWindowEnabled
SetWindowLongW
GetWindowLongW
PtInRect
InflateRect
MapWindowPoints
ScreenToClient
SetWindowRgn
GetLastActivePopup
MessageBoxW
FindWindowExW
TranslateMessage
DispatchMessageW
PeekMessageW
WaitMessage
CallMsgFilterW
GetQueueStatus
MsgWaitForMultipleObjectsEx
WindowFromDC
GetIconInfo
DrawIconEx
InvalidateRgn
GetFocus
InvalidateRect
AdjustWindowRectEx
TrackMouseEvent
ReleaseCapture
GetCapture
SetCapture
UpdateWindow
UpdateLayeredWindow
BeginPaint
EndPaint
SetCursor
GetWindowRect
GetClientRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
GetSystemMetrics
IsZoomed
IsIconic
IsWindowVisible
SetWindowPos
ShowWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
AttachThreadInput
PostMessageW
SendMessageW
IntersectRect
CopyRect
GetCursorPos
KillTimer
SetTimer
IsWindow
PostQuitMessage
CharNextW
DestroyWindow
UnregisterClassW
GetMessageExtraInfo
RegisterWindowMessageW
GetMessageW
GetKeyState
GetParent
GetDC
gdi32
GetTextExtentPoint32W
SetWindowOrgEx
RectVisible
CreateRectRgnIndirect
ModifyWorldTransform
GetRgnBox
OffsetRgn
CombineRgn
CreateRectRgn
SetWorldTransform
LPtoDP
SetGraphicsMode
SetBkMode
GetCurrentObject
SetLayout
GetLayout
GdiAlphaBlend
GetRandomRgn
GetObjectType
SetViewportOrgEx
GetObjectW
SelectObject
CreateCompatibleDC
CreateFontIndirectW
DeleteDC
DeleteObject
CreateDIBSection
BitBlt
GetDeviceCaps
GetDIBits
GetStockObject
IntersectClipRect
RestoreDC
SelectClipRgn
SaveDC
shell32
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListW
DragQueryFileW
SHGetSpecialFolderPathW
SHAppBarMessage
ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
SHFileOperationW
ole32
CoTaskMemFree
OleInitialize
ReleaseStgMedium
CoTaskMemRealloc
CoInitializeEx
RegisterDragDrop
RevokeDragDrop
DoDragDrop
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantChangeType
VariantCopy
CreateStdDispatch
SysFreeString
VarCmp
VariantClear
VariantInit
SysAllocString
VarUI4FromStr
CreateDispTypeInfo
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
CreateProcessAsUserW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
shlwapi
PathGetDriveNumberW
SHGetValueW
PathFindFileNameW
PathFindFileNameA
PathFileExistsW
PathRemoveFileSpecW
PathAddBackslashW
StrStrIW
PathFileExistsA
PathIsRootW
PathIsDirectoryW
gdiplus
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipAlloc
GdiplusShutdown
GdipDrawImagePointRectI
GdipSetImageAttributesColorMatrix
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetImageAttributesWrapMode
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdiplusStartup
winmm
timeGetTime
timeEndPeriod
timeBeginPeriod
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
netapi32
Netbios
libmlt-6
mlt_animation_get_item
mlt_animation_get_length
mlt_animation_interpolate
mlt_animation_key_count
mlt_animation_key_get
mlt_animation_key_set_frame
mlt_animation_key_set_type
mlt_animation_next_key
mlt_animation_prev_key
mlt_animation_remove
mlt_animation_serialize_cut
mlt_animation_serialize_cut_tf
mlt_animation_set_length
mlt_animation_shift_frames
mlt_audio_format_size
mlt_consumer_close
mlt_consumer_is_stopped
mlt_consumer_position
mlt_consumer_purge
mlt_consumer_service
mlt_consumer_start
mlt_consumer_stop
mlt_event_block
mlt_event_close
mlt_event_data_none
mlt_event_data_to_frame
mlt_event_data_to_int
mlt_event_data_to_object
mlt_event_data_to_string
mlt_event_inc_ref
mlt_event_unblock
mlt_events_block
mlt_events_close_wait_for
mlt_events_fire
mlt_events_listen
mlt_events_setup_wait_for
mlt_events_unblock
mlt_events_wait_for
mlt_factory_close
mlt_factory_consumer
mlt_factory_event_object
mlt_factory_filter
mlt_factory_init
mlt_factory_producer
mlt_factory_transition
mlt_filter_close
mlt_filter_connect
mlt_filter_get_in
mlt_filter_get_length
mlt_filter_get_length2
mlt_filter_get_out
mlt_filter_get_position
mlt_filter_get_progress
mlt_filter_get_track
mlt_filter_process
mlt_filter_service
mlt_filter_set_in_and_out
mlt_frame_close
mlt_frame_get_audio
mlt_frame_get_image
mlt_frame_get_original_producer
mlt_frame_get_position
mlt_frame_get_waveform
mlt_frame_init
mlt_frame_properties
mlt_frame_set_alpha
mlt_frame_set_image
mlt_frame_unique_properties
mlt_image_format_size
mlt_log_get_level
mlt_log_set_callback
mlt_log_set_level
mlt_pool_alloc
mlt_pool_release
mlt_producer_clear
mlt_producer_close
mlt_producer_cut
mlt_producer_cut_parent
mlt_producer_frame
mlt_producer_frame_time
mlt_producer_get_creation_time
mlt_producer_get_fps
mlt_producer_get_in
mlt_producer_get_length
mlt_producer_get_length_time
mlt_producer_get_out
mlt_producer_get_playtime
mlt_producer_get_speed
mlt_producer_is_blank
mlt_producer_is_cut
mlt_producer_optimise
mlt_producer_position
mlt_producer_prepare_reopen
mlt_producer_probe
mlt_producer_seek
mlt_producer_seek_time
mlt_producer_service
mlt_producer_set_creation_time
mlt_producer_set_in_and_out
mlt_producer_set_speed
mlt_profile_close
mlt_profile_dar
mlt_profile_fps
mlt_profile_from_producer
mlt_profile_init
mlt_profile_list
mlt_profile_load_properties
mlt_profile_sar
mlt_profile_scale_height
mlt_profile_scale_width
mlt_properties_anim_get
mlt_properties_anim_get_color
mlt_properties_anim_get_double
mlt_properties_anim_get_int
mlt_properties_anim_get_rect
mlt_properties_anim_set
mlt_properties_anim_set_color
mlt_properties_anim_set_double
mlt_properties_anim_set_int
mlt_properties_anim_set_rect
mlt_properties_clear
mlt_properties_close
mlt_properties_copy
mlt_properties_count
mlt_properties_debug
mlt_properties_dec_ref
mlt_properties_dump
mlt_properties_exists
mlt_properties_frames_to_time
mlt_properties_get
mlt_properties_get_animation
mlt_properties_get_color
mlt_properties_get_data
mlt_properties_get_data_at
mlt_properties_get_double
mlt_properties_get_int
mlt_properties_get_int64
mlt_properties_get_lcnumeric
mlt_properties_get_name
mlt_properties_get_properties
mlt_properties_get_properties_at
mlt_properties_get_rect
mlt_properties_get_time
mlt_properties_get_value
mlt_properties_get_value_tf
mlt_properties_inc_ref
mlt_properties_inherit
mlt_properties_is_anim
mlt_properties_is_sequence
mlt_properties_load
mlt_properties_lock
mlt_properties_mirror
mlt_properties_new
mlt_properties_parse
mlt_properties_parse_yaml
mlt_properties_pass
mlt_properties_pass_list
mlt_properties_pass_property
mlt_properties_preset
mlt_properties_ref_count
mlt_properties_rename
mlt_properties_save
mlt_properties_serialise_yaml
mlt_properties_set
mlt_properties_set_color
mlt_properties_set_data
mlt_properties_set_double
mlt_properties_set_int
mlt_properties_set_int64
mlt_properties_set_lcnumeric
mlt_properties_set_properties
mlt_properties_set_rect
mlt_properties_set_string
mlt_properties_time_to_frames
mlt_properties_unlock
mlt_repository_consumers
mlt_repository_create
mlt_repository_filters
mlt_repository_init
mlt_repository_languages
mlt_repository_links
mlt_repository_metadata
mlt_repository_presets
mlt_repository_producers
mlt_repository_register
mlt_repository_register_metadata
mlt_repository_transitions
mlt_service_attach
mlt_service_cache_set_size
mlt_service_close
mlt_service_connect_producer
mlt_service_consumer
mlt_service_detach
mlt_service_disconnect_all_producers
mlt_service_disconnect_producer
mlt_service_filter
mlt_service_filter_count
mlt_service_get_frame
mlt_service_identify
mlt_service_insert_producer
mlt_service_lock
mlt_service_move_filter
mlt_service_producer
mlt_service_profile
mlt_service_properties
mlt_service_set_profile
mlt_service_unlock
mlt_transition_close
mlt_transition_connect
mlt_transition_get_a_track
mlt_transition_get_b_track
mlt_transition_get_in
mlt_transition_get_length
mlt_transition_get_out
mlt_transition_get_position
mlt_transition_get_progress
mlt_transition_get_progress_delta
mlt_transition_service
mlt_transition_set_in_and_out
mlt_transition_set_tracks
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 822KB - Virtual size: 821KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 121KB - Virtual size: 556KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 29B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 165KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ