Static task
static1
Behavioral task
behavioral1
Sample
81f2beb028b512f820aee459c4631bb4a494e60de9f1904e043eacb7fbffc775.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
81f2beb028b512f820aee459c4631bb4a494e60de9f1904e043eacb7fbffc775.exe
Resource
win10v2004-20231215-en
General
-
Target
81f2beb028b512f820aee459c4631bb4a494e60de9f1904e043eacb7fbffc775
-
Size
161KB
-
MD5
2129a5abeba04b59809453f0b7e937a3
-
SHA1
f365d4dff84c7d1088e517a5da8da4c10648ff81
-
SHA256
81f2beb028b512f820aee459c4631bb4a494e60de9f1904e043eacb7fbffc775
-
SHA512
6663bf78fff23fdd6e62482f1dc51ae133b22ffef3bdba29fde88c0a483cfe6f315bcfe0dd5ddee28d8f69f8800dc78144c232a9eaec31783c21f6ea157ce971
-
SSDEEP
3072:AZNc/bg7SRzS8BmK2QUpEpzraUTOHJgrTROvvB2Q0A4qXvC2HJ0Cj:a+HR+8sHMjTGUTROv52SvC2p0C
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 81f2beb028b512f820aee459c4631bb4a494e60de9f1904e043eacb7fbffc775
Files
-
81f2beb028b512f820aee459c4631bb4a494e60de9f1904e043eacb7fbffc775.exe windows:5 windows x86 arch:x86
7aeb47d8f3f78c49e5ebff2e8b102c17
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
emduilib
??1CDuiString@DuiLib@@QAE@XZ
??BCDuiString@DuiLib@@QBEPB_WXZ
??0CDuiString@DuiLib@@QAE@PB_WH@Z
?messageMap@WindowImplBase@DuiLib@@1UDUI_MSGMAP@2@B
?SetDPI@CPaintManagerUI@DuiLib@@QAEXH@Z
?GetMainMonitorDPI@CDPI@DuiLib@@SAHXZ
?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@PB_W@Z
?HandleCustomMessage@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?GetSuperClassName@CWindowWnd@DuiLib@@MBEPB_WXZ
?GetClassStyle@WindowImplBase@DuiLib@@UBEIXZ
?FitDpiBeforeShowWindow@WindowImplBase@DuiLib@@UAEX_NHVCDuiPoint@2@@Z
?HandleMessage@WindowImplBase@DuiLib@@UAEJIIJ@Z
?OnFinalMessage@WindowImplBase@DuiLib@@UAEXPAUHWND__@@@Z
?IsInStaticControl@WindowImplBase@DuiLib@@MAEHPAVCControlUI@2@@Z
?GetWndDPI@WindowImplBase@DuiLib@@MAEHXZ
?ResponseDefaultKeyEvent@WindowImplBase@DuiLib@@MAEJI@Z
?OnClose@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnDestroy@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcActivate@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcCalcSize@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcPaint@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcHitTest@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcLButtonDBClick@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnGetMinMaxInfo@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseWheel@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseHover@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSize@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnChar@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSysCommand@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnCreate@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKeyDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKillFocus@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSetFocus@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnLButtonDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnLButtonUp@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseMove@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?GetStyle@WindowImplBase@DuiLib@@UAEJXZ
?Notify@WindowImplBase@DuiLib@@UAEXAAUtagTNotifyUI@2@@Z
?MessageHandler@WindowImplBase@DuiLib@@UAEJIIJAA_N@Z
?CreateControl@WindowImplBase@DuiLib@@UAEPAVCControlUI@2@PB_W@Z
?QueryControlText@WindowImplBase@DuiLib@@UAEPB_WPB_W0@Z
?GetManagerName@WindowImplBase@DuiLib@@MAEPB_WXZ
?GetSkinType@WindowImplBase@DuiLib@@MAE?AVCDuiString@2@XZ
?InitResource@WindowImplBase@DuiLib@@UAEXXZ
??1WindowImplBase@DuiLib@@UAE@XZ
??0WindowImplBase@DuiLib@@QAE@XZ
?Close@CWindowWnd@DuiLib@@QAEXI@Z
?IsSelected@COptionUI@DuiLib@@QBE_NXZ
?GetMessageMap@WindowImplBase@DuiLib@@MBEPBUDUI_MSGMAP@2@XZ
??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
?Create@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKKHHHHPAUHMENU__@@@Z
?SetResourcePath@CPaintManagerUI@DuiLib@@SAXPB_W@Z
?SetInstance@CPaintManagerUI@DuiLib@@SAXPAUHINSTANCE__@@@Z
?SetSkinMode@CUIPaletteManager@DuiLib@@QAEXW4SWCLIENT_SKIN@2@_N1@Z
?GetInstance@CUIPaletteManager@DuiLib@@SAPAV12@XZ
mfc140u
ord14234
ord13028
ord13087
ord3605
ord14047
ord4648
ord8365
ord8811
ord13070
ord3864
ord2520
ord1391
ord890
ord8776
ord3833
ord7441
ord2350
ord6486
ord1108
ord450
ord280
ord286
ord2385
ord2389
ord1523
ord7654
ord4886
ord1133
ord1002
ord1476
ord6549
ord9209
ord10255
ord8219
ord5409
ord7712
ord7723
ord7722
ord5228
ord5411
ord5252
ord5790
ord5525
ord9350
ord5760
ord5549
ord5249
ord12168
ord3265
ord7815
ord3372
ord3941
ord12124
ord2682
ord5935
ord13703
ord11717
ord6877
ord14596
ord7923
ord14667
ord3055
ord4494
ord9693
ord4502
ord4988
ord4927
ord4912
ord4974
ord5019
ord4942
ord4997
ord5013
ord4954
ord4960
ord4966
ord4948
ord5003
ord4090
ord1777
ord1756
ord1770
ord1744
ord1722
ord12258
ord12262
ord13878
ord3266
ord9256
ord11002
ord6978
ord12220
ord8965
ord14588
ord11936
ord3838
ord12089
ord9139
ord11726
ord11725
ord5652
ord8817
ord13544
ord9377
ord7820
ord4881
ord501
ord1143
ord6225
ord4093
ord6316
ord2996
ord14364
ord1513
ord265
ord266
ord8470
ord8386
ord12865
ord8324
ord5357
ord2486
ord12541
ord12542
ord14589
ord7922
ord14595
ord9398
ord3371
ord4152
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2761
ord8210
ord3302
ord3305
ord13756
ord6220
ord13293
ord6348
ord12947
ord6559
ord7941
ord13085
ord2034
ord6812
ord11983
ord6489
ord14669
ord14466
ord13086
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord8217
ord12531
ord10433
ord12251
ord2522
ord12219
ord12928
ord5763
ord10250
ord6860
ord4589
ord2246
ord13911
ord7313
ord13442
ord952
ord6566
ord3882
ord7997
ord1472
ord995
ord7653
ord10379
ord8360
ord12921
ord12884
ord4664
ord2990
ord14137
ord12559
ord5117
ord296
ord3171
ord4936
ord4815
ord2304
ord8000
ord14590
ord4649
ord6795
ord2409
ord1045
ord1511
ord11982
kernel32
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetModuleFileNameW
CreateMutexW
CloseHandle
ReleaseMutex
DeleteCriticalSection
GetACP
MultiByteToWideChar
FormatMessageW
OutputDebugStringW
WideCharToMultiByte
GetProcAddress
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
SetEvent
user32
InvalidateRgn
ShowWindow
IsWindow
InvalidateRect
GetAsyncKeyState
SetCursor
IsWindowVisible
LoadCursorW
PtInRect
GetCursorPos
GetClientRect
SetWindowPos
SetForegroundWindow
LoadImageW
SetClipboardData
GetWindowLongW
GetDC
ClientToScreen
EnableWindow
SendMessageW
GetParent
PostMessageW
SetWindowRgn
GetWindowRect
GetSystemMetrics
EnumChildWindows
IsIconic
GetClassNameW
EqualRect
MoveWindow
DestroyWindow
GetDesktopWindow
ReleaseDC
OpenClipboard
RedrawWindow
ScreenToClient
EmptyClipboard
FillRect
SetWindowLongW
EnumWindows
CloseClipboard
gdi32
CreatePolygonRgn
CreatePen
CreateBrushIndirect
Rectangle
CreateFontIndirectW
SelectObject
GetObjectW
GetStockObject
BitBlt
CreateCompatibleDC
CreateSolidBrush
CreateCompatibleBitmap
StretchBlt
GetPixel
CreatePatternBrush
GetTextExtentPoint32W
DeleteObject
CreateRectRgnIndirect
CombineRgn
GetDeviceCaps
DeleteDC
msimg32
AlphaBlend
shlwapi
StrCpyW
PathFindExtensionW
gdiplus
GdipDrawImageRectI
GdipGetImageWidth
GdipGetImageHeight
GdipLoadImageFromFile
GdiplusStartup
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdiplusShutdown
GdipDrawEllipseI
GdipDrawLineI
GdipSetSmoothingMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipSetPenWidth
GdipSetPenLineJoin
GdipSetPenLineCap197819
GdipSetPenMode
GdipSetPenDashStyle
GdipCreatePen1
GdipFree
GdipAlloc
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
vcruntime140
wcsstr
wcschr
memcpy
__RTDynamicCast
_CxxThrowException
_purecall
__std_terminate
__CxxFrameHandler3
_except_handler4_common
memmove
memset
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_set_app_type
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-string-l1-1-0
wcsncmp
tolower
_wcsicmp
wcscpy_s
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstol
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
api-ms-win-crt-time-l1-1-0
_time64
wcsftime
_localtime64_s
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fread
_ftelli64
__p__commode
__stdio_common_vswprintf
fwrite
fclose
_wfopen
_set_fmode
api-ms-win-crt-math-l1-1-0
_libm_sse2_cos_precise
__setusermatherr
_CIatan2
_libm_sse2_sin_precise
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ