Static task
static1
Behavioral task
behavioral1
Sample
51b63f14ad255e489f5877b3c03fbe832dea4915e33857f0a0d95b79e2d94694.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
51b63f14ad255e489f5877b3c03fbe832dea4915e33857f0a0d95b79e2d94694.exe
Resource
win10v2004-20231215-en
General
-
Target
51b63f14ad255e489f5877b3c03fbe832dea4915e33857f0a0d95b79e2d94694
-
Size
2.0MB
-
MD5
ca74fa6d40b8516884f4eaad59772ac1
-
SHA1
2ccfc0dc8830abbf6d20bf19584d8e54112bd960
-
SHA256
51b63f14ad255e489f5877b3c03fbe832dea4915e33857f0a0d95b79e2d94694
-
SHA512
5affeeb39be95c02eb902f3c4f922959c97c5f5cc395665cab41a29b237151cf006e3d3d42327a57dbb9a0977cc2ecb64317b40cfd4a2cd0d0c80fc203193909
-
SSDEEP
49152:+fJF1fj7T6TuB7Hy0V+vl6LJlOpp/xe2u6aS2J:+xnfXT+vl6dluxe2uy2J
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 51b63f14ad255e489f5877b3c03fbe832dea4915e33857f0a0d95b79e2d94694
Files
-
51b63f14ad255e489f5877b3c03fbe832dea4915e33857f0a0d95b79e2d94694.exe windows:4 windows x86 arch:x86
ce77a24968d8cf2d82c868ae99cc4d3b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenFileMappingW
MapViewOfFile
WaitNamedPipeW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetPrivateProfileStringW
FreeLibrary
LocalAlloc
SetFilePointer
GetExitCodeThread
SetFileAttributesW
WaitForSingleObject
FileTimeToSystemTime
GetModuleHandleW
GetFileInformationByHandle
GetTempPathW
lstrlenW
MultiByteToWideChar
ReadFile
UnmapViewOfFile
CreateFileW
lstrlenA
WriteFile
SystemTimeToFileTime
MoveFileExW
RemoveDirectoryW
MoveFileExA
SetLastError
FormatMessageA
GetStdHandle
GetFileType
WaitForMultipleObjects
PeekNamedPipe
GetEnvironmentVariableA
SleepEx
QueryPerformanceFrequency
GetModuleHandleA
LoadLibraryA
GetSystemDirectoryA
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
GetLastError
CreateDirectoryW
GetFileAttributesW
GetModuleFileNameW
WideCharToMultiByte
CloseHandle
LocalFree
GetTickCount
CreateMutexW
OutputDebugStringW
GetFileSize
ReleaseMutex
GlobalMemoryStatus
GetVersion
FlushConsoleInputBuffer
GetSystemTime
Sleep
GetProcAddress
LoadLibraryW
FindResourceExW
LoadResource
LockResource
SizeofResource
GetLocalTime
HeapDestroy
HeapAlloc
FindResourceW
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
user32
wsprintfW
GetDesktopWindow
UnregisterClassA
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptDecrypt
CryptSetHashParam
CryptSignHashA
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyW
RegCreateKeyExW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
CryptEnumProvidersA
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextA
CryptGetUserKey
CryptExportKey
CryptDestroyHash
RegSetValueExW
CryptCreateHash
shell32
SHFileOperationW
ShellExecuteW
ShellExecuteExW
shlwapi
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
msvcp80
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?str@?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
msvcr80
_wfopen_s
ftell
fputc
isalpha
isalnum
strchr
strncmp
isspace
tolower
wcscpy_s
_wtol
wcsncmp
rand
srand
strncpy
_fstat64i32
_fileno
memset
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
abort
_open
_close
_unlink
_write
_read
_access
_strdup
_vsnprintf_s
fprintf
atoi
_stricmp
ferror
malloc
wcsncpy
__RTDynamicCast
_snwprintf
_vsnwprintf_s
wcstok
_wstat32
wcsstr
_recalloc
calloc
free
iswspace
_wcsicmp
vswprintf_s
_vscwprintf
_wcslwr_s
_wtoi
wcschr
_CxxThrowException
__CxxFrameHandler3
_strtoi64
_gmtime64
__sys_nerr
fgets
strspn
strcspn
wcspbrk
wcsspn
wcsrchr
wcscspn
fseek
fwrite
??_V@YAXPAX@Z
vsprintf_s
_vscprintf
fclose
fread
memcpy_s
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_beginthreadex
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
_purecall
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
memmove_s
??3@YAXPAX@Z
_stat64i32
getenv
signal
_getch
isxdigit
isdigit
_setmode
_vsnprintf
raise
strcmp
_strnicmp
_lseeki64
printf
isupper
toupper
_wfopen
_wcslwr
realloc
__iob_func
memcpy
_errno
_mbspbrk
strstr
fopen
strerror
strtoul
strtol
strrchr
_stat64
feof
memmove
_time64
sscanf
qsort
fputs
strcpy_s
strncpy_s
sprintf_s
strcat_s
sprintf
setvbuf
fflush
strpbrk
_getpid
memchr
_fstat64
floor
wldap32
ord32
ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord200
ord30
ord26
ord50
ord143
ord217
ord211
ord22
ord60
ws2_32
send
WSACleanup
WSAStartup
recv
WSAIoctl
setsockopt
getsockname
htons
ntohs
bind
WSASetLastError
connect
socket
getpeername
getsockopt
closesocket
shutdown
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
accept
listen
sendto
recvfrom
__WSAFDIsSet
select
ioctlsocket
gethostname
WSAGetLastError
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
CertFreeCertificateContext
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 348KB - Virtual size: 346KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 44KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE