Static task
static1
Behavioral task
behavioral1
Sample
6202b1211d2346c1417cecb7655bb2092f6b84292b92ee778aac987ce39081f7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6202b1211d2346c1417cecb7655bb2092f6b84292b92ee778aac987ce39081f7.exe
Resource
win10v2004-20231215-en
General
-
Target
6202b1211d2346c1417cecb7655bb2092f6b84292b92ee778aac987ce39081f7
-
Size
3.4MB
-
MD5
86da18701104df99416bb1e51bff1918
-
SHA1
c8e4307f01c42fa9437ce051c3670cfa385ee563
-
SHA256
6202b1211d2346c1417cecb7655bb2092f6b84292b92ee778aac987ce39081f7
-
SHA512
04bc340b3bd5d0f93d248d559a4f9b369d700d0d64e23eb426d124d07dc7265620932c594a7c40ef782049462c469bf15e932f897b3f94a63947f647817d1d48
-
SSDEEP
49152:WX3XKG+EfU3V1Vf6f7qtfDH/hE44lLExVTVNG7gqXAsXzQoM7gdyq7h/SbjxaVw9:Ugj72qtVECVTvG0dsXzQoM7gdF7h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6202b1211d2346c1417cecb7655bb2092f6b84292b92ee778aac987ce39081f7
Files
-
6202b1211d2346c1417cecb7655bb2092f6b84292b92ee778aac987ce39081f7.exe windows:6 windows x86 arch:x86
126c1a2652b02ce8e0468f437ad90b91
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ImageList_Add
ImageList_Create
ImageList_Destroy
ord410
ord17
ord412
ord413
winmm
timeEndPeriod
timeBeginPeriod
shlwapi
StrCmpLogicalW
SHDeleteKeyW
SHAutoComplete
ord12
uxtheme
DrawThemeBackground
IsThemePartDefined
OpenThemeData
SetWindowTheme
GetThemePartSize
EnableThemeDialogTexture
CloseThemeData
kernel32
TryEnterCriticalSection
SetThreadPriority
GetSystemPowerStatus
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
SystemTimeToFileTime
LocalFileTimeToFileTime
ResumeThread
GetLocaleInfoW
GetNumberFormatW
DecodePointer
GlobalSize
LoadLibraryW
CreateEventW
FindResourceW
FindResourceExW
LoadResource
LockResource
SizeofResource
SetEndOfFile
GetFileTime
FlushFileBuffers
CreateFileW
GetDiskFreeSpaceExW
FindFirstFileW
DeleteFileW
RemoveDirectoryW
GetFileAttributesW
MoveFileExW
GetFileAttributesExW
FindNextFileW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
EnterCriticalSection
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
InitOnceComplete
FindClose
SystemTimeToTzSpecificLocalTime
NormalizeString
Sleep
OutputDebugStringW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
DeviceIoControl
SetFileTime
SetFilePointer
DosDateTimeToFileTime
GetFileSizeEx
FileTimeToSystemTime
GetSystemTimeAsFileTime
ReadDirectoryChangesW
GetThreadPriority
GetThreadId
GetFileInformationByHandle
TerminateProcess
GetCurrentProcess
DuplicateHandle
WriteFile
CancelIo
GetOverlappedResult
ReadFile
WideCharToMultiByte
MultiByteToWideChar
WaitForMultipleObjects
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
GetCommandLineW
LoadLibraryExW
lstrlenW
GetNativeSystemInfo
GetVersionExW
PowerCreateRequest
PowerClearRequest
PowerSetRequest
LeaveCriticalSection
GetTickCount64
CreateMutexW
GetCurrentThread
GetExitCodeThread
GetCurrentProcessId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CopyFileW
VirtualQuery
VirtualProtect
GetSystemInfo
IsDebuggerPresent
FreeLibrary
SetDllDirectoryW
SetEvent
ResetEvent
CloseHandle
WaitForSingleObject
GetModuleHandleW
GetProcAddress
GetTickCount
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
MulDiv
SetErrorMode
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSectionEx
GetLastError
RaiseException
GetCurrentThreadId
InitOnceBeginInitialize
SetLastError
LoadLibraryExA
user32
UnregisterClassW
CreateDialogParamW
SetWindowLongW
SendDlgItemMessageW
GetActiveWindow
GetWindowLongW
GetClientRect
ClientToScreen
GetWindowRect
SetWindowPos
SetLayeredWindowAttributes
BeginPaint
CharUpperW
GetComboBoxInfo
GetSystemMetrics
EnumThreadWindows
GetWindowPlacement
IsIconic
AdjustWindowRect
DrawEdge
SetClipboardData
CloseClipboard
OpenClipboard
FillRect
GetWindowTextLengthW
GetWindowTextW
NotifyWinEvent
RedrawWindow
SetWindowTextW
DrawTextW
TrackMouseEvent
InflateRect
FrameRect
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetNextDlgTabItem
InvalidateRgn
SystemParametersInfoW
ScrollWindowEx
SetScrollPos
UpdateWindow
SetScrollInfo
SetRectEmpty
SetGestureConfig
CloseGestureInfoHandle
GetGestureInfo
GetScrollInfo
MapDialogRect
IsZoomed
SetMenuItemInfoW
GetMenuItemInfoW
GetDC
EndPaint
InvalidateRect
IsWindowEnabled
PostMessageW
CreateWindowExW
ScreenToClient
IntersectRect
PtInRect
DefWindowProcW
GetCursorPos
SetFocus
KillTimer
SetCapture
SetCursor
LoadCursorW
SetTimer
RegisterClassExW
GetClassInfoExW
CallWindowProcW
GetWindowDC
ReleaseDC
EnableWindow
ShowWindow
SendMessageW
GetDlgItem
DestroyWindow
RegisterShellHookWindow
CheckMenuRadioItem
WindowFromPoint
GetWindowThreadProcessId
GetClassNameW
EnumWindows
AllowSetForegroundWindow
DrawTextExW
GetClipboardData
IsCharAlphaW
IsClipboardFormatAvailable
LoadImageW
GetDesktopWindow
GetWindow
OffsetRect
CopyRect
MonitorFromWindow
LoadIconW
RegisterClipboardFormatW
MonitorFromRect
CharLowerW
EndDeferWindowPos
BeginDeferWindowPos
DeferWindowPos
EmptyClipboard
IsWindowVisible
MoveWindow
IsRectEmpty
AppendMenuW
SetForegroundWindow
IsChild
DeregisterShellHookWindow
DrawFrameControl
GetParent
GetKeyState
GetMessagePos
wsprintfW
TrackPopupMenu
CreatePopupMenu
MonitorFromPoint
GetMonitorInfoW
DestroyMenu
MessageBoxW
EndDialog
DialogBoxParamW
MessageBeep
SetActiveWindow
EnumChildWindows
MapWindowPoints
SetMenuDefaultItem
TrackPopupMenuEx
GetDlgCtrlID
GetSysColor
GetFocus
TranslateAcceleratorW
LoadAcceleratorsW
DestroyAcceleratorTable
RegisterHotKey
UnregisterHotKey
SetDlgItemTextW
MapVirtualKeyW
AdjustWindowRectEx
GetMenu
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetMessageW
PostQuitMessage
TranslateMessage
DispatchMessageW
RegisterClassW
RegisterWindowMessageW
gdi32
CreateCompatibleBitmap
ExtTextOutW
SetBkColor
SetTextColor
DeleteDC
DeleteObject
GetObjectW
CreateFontIndirectW
CreatePen
OffsetRgn
SelectObject
GetStockObject
SetDCBrushColor
CreateRectRgnIndirect
CreateRectRgn
GetTextExtentPoint32W
GetTextColor
CreateCompatibleDC
GetBkColor
GetDeviceCaps
GetTextMetricsW
LPtoDP
SaveDC
RestoreDC
OffsetWindowOrgEx
SetWindowOrgEx
IntersectClipRect
CreatePolygonRgn
FrameRgn
FillRgn
SetViewportOrgEx
BitBlt
CombineRgn
SetDCPenColor
LineTo
MoveToEx
SetBkMode
GetCurrentObject
advapi32
CryptDestroyHash
RegSetValueExW
RegCloseKey
RegOpenKeyW
RegCreateKeyW
RegDeleteValueW
RegQueryInfoKeyW
CryptGetHashParam
CryptVerifySignatureW
CryptHashData
CryptCreateHash
RegGetValueW
CryptDestroyKey
RegQueryValueExW
CryptReleaseContext
CryptImportKey
CryptAcquireContextW
RegOpenKeyExW
RegEnumKeyExW
RegEnumValueW
shell32
SHGetDesktopFolder
SHOpenFolderAndSelectItems
SHGetFolderPathW
ord74
ShellExecuteExW
ShellExecuteW
ord680
DragAcceptFiles
DragFinish
SHCreateItemFromIDList
ole32
CoCreateInstance
OleSetClipboard
OleGetClipboard
CoTaskMemFree
PropVariantClear
CLSIDFromString
CoTaskMemAlloc
CoCreateGuid
CoUninitialize
CoInitialize
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
RegisterDragDrop
RevokeDragDrop
DoDragDrop
ReleaseStgMedium
oleaut32
VariantClear
VariantInit
SysAllocString
zlib1
inflateEnd
inflate
inflateInit2_
crc32
sqlite3
sqlite3_busy_timeout
sqlite3_close
sqlite3_errmsg
sqlite3_open_v2
sqlite3_column_name
sqlite3_column_count
sqlite3_step
sqlite3_bind_blob
sqlite3_prepare_v2
sqlite3_finalize
sqlite3_bind_text
sqlite3_column_int
sqlite3_exec
sqlite3_changes
sqlite3_clear_bindings
sqlite3_column_type
sqlite3_bind_null
sqlite3_bind_double
sqlite3_bind_int64
sqlite3_column_double
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_column_text
sqlite3_column_int64
sqlite3_reset
sqlite3_bind_int
sqlite3_last_insert_rowid
shared
?create@t_font_description@@QBGPAUHFONT__@@XZ
?g_from_system@t_font_description@@SG?AU1@H@Z
_uPrintCrashInfo_AddEnvironmentInfo@4
_uCharUpper@4
?popup_dialog@t_font_description@@QAG_NPAUHWND__@@@Z
_uGetClipboardString@4
_uFixAmpersandChars_v2@8
_uDragQueryFile@12
_uDragQueryFileCount@4
_uSetWindowTextEx@12
_stricmp_utf8_max@12
_stricmp_utf8_ex@16
_uCharLower@4
?scale@audio_math@@YGXPBMIPAMM@Z
_uGetCommandLine@4
_LoadSystemLibrary@4
_uGetModuleHandle@4
_uSetCurrentDirectory@4
_uPrintCrashInfo_SetDumpPath@4
_uPrintCrashInfo_StartLogging@4
_uPrintCrashInfo_Init@4
_uGetCurrentDirectory@4
_uGetEnvironmentVariable@8
_uCreateFile@28
_uEvalKnownFolder@4
_uReplaceCharAdd@24
_uRemovePanicHandler@4
_uAddPanicHandler@4
_uSearchPath@16
_uFixPathCaps@8
_uCreateDirectory@8
_uGetFileAttributes@4
_uAddStringLower@12
_uAddStringUpper@12
_uBrowseForFolder@12
_uBrowseForFolderEx@12
_uGetOpenFileName@32
_uGetOpenFileNameMulti@24
_uSendDlgItemMessageText@20
_uSendMessageText@16
_uAppendMenu@16
_ModalDialog_Switch@4
_uSetClipboardString@4
?uPrintCrashInfo_Suppress@@YGXXZ
_uPrintCrashInfo_SetComponentList@4
_uMessageBox@16
_uLoadLibrary@4
_uFindFirstFile@4
_GetInfiniteWaitEvent@0
?convert_to_int32@audio_math@@YGXPBMIPAHM@Z
?convert_to_int16@audio_math@@YGXPBMIPAFM@Z
_uGetTempFileName@16
_uGetTempPath@4
_stricmp_utf8@8
_uGetModuleFileName@8
_stricmp_utf8_partial@12
_ModalDialog_PokeExisting@0
_ModalDialog_CanCreateNew@0
_PokeWindow@4
_LoadResourceEx@16
_uFileExists@4
_uShellExecute@24
_uStringCompare@8
??1uCallStackTracker@@QAE@XZ
??0uCallStackTracker@@QAE@PBD@Z
_uGetDlgItemText@12
_uSetDlgItemText@12
_FindOwningPopup@4
_uGetWindowText@8
_uExceptFilterProc@4
_uSetWindowText@8
_uPrintCrashInfo_OnEvent@8
_uBugCheck@0
?calculate_peak@audio_math@@YGMPBMI@Z
_uFormatSystemErrorMessage@8
_uGetKeyNameText@8
msvcp140
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Mtx_destroy_in_situ
_Cnd_wait
_Mtx_init_in_situ
_Cnd_broadcast
_Mtx_unlock
_Mtx_lock
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Thrd_hardware_concurrency
_Thrd_id
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
?uncaught_exceptions@std@@YAHXZ
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
msimg32
GradientFill
oleacc
AccessibleObjectFromWindow
LresultFromObject
crypt32
CertVerifyRevocation
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertVerifyTimeValidity
CertCloseStore
CertFreeCertificateChain
CertFreeCertificateContext
winhttp
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpOpen
gdiplus
GdipFree
GdipDrawLineI
GdipDeletePen
GdipCreatePen1
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipLoadImageFromStream
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipDrawImageRect
GdipSetSmoothingMode
GdipSetCompositingMode
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageType
GdiplusStartup
GdipCreateBitmapFromStream
GdipCloneImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdiplusShutdown
secur32
AcquireCredentialsHandleW
FreeContextBuffer
AcceptSecurityContext
DecryptMessage
InitializeSecurityContextW
EncryptMessage
QueryContextAttributesW
FreeCredentialsHandle
DeleteSecurityContext
vcruntime140
memchr
_except_handler3
__CxxFrameHandler3
__std_terminate
__std_exception_copy
__std_exception_destroy
_purecall
strchr
strstr
wcschr
_set_purecall_handler
strrchr
wcsstr
memcpy
memset
memmove
memcmp
_except_handler4_common
__current_exception
__current_exception_context
_CxxThrowException
api-ms-win-crt-heap-l1-1-0
_expand
realloc
malloc
free
_aligned_malloc
_aligned_realloc
_recalloc
_aligned_free
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
abort
_controlfp_s
terminate
_beginthreadex
_invalid_parameter_noinfo
_errno
_set_invalid_parameter_handler
_set_abort_behavior
_get_wide_winmain_command_line
signal
_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
exit
_configure_wide_argv
_initialize_wide_environment
_initterm_e
_initterm
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-math-l1-1-0
__libm_sse2_tan
__libm_sse2_sin
_fpclass
__libm_sse2_exp
llround
lround
floor
__libm_sse2_log
__setusermatherr
__libm_sse2_log10
pow
__libm_sse2_pow
ceil
lroundf
llroundf
log2
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsprintf_s
__p__commode
__stdio_common_vsprintf
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
wcsncmp
wcstok_s
strcpy_s
wcscpy_s
wcsnlen
wmemcpy_s
strlen
strncmp
strcmp
isalpha
_strdup
wcsncpy_s
strcat_s
wcslen
api-ms-win-crt-convert-l1-1-0
atoi
atoll
_wtoi
_atoi64
api-ms-win-crt-utility-l1-1-0
srand
rand
_byteswap_ushort
_byteswap_ulong
_byteswap_uint64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 473KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 87KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_RDATA Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.movehcs Size: 8KB - Virtual size: 8KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE