Static task
static1
Behavioral task
behavioral1
Sample
d8b7a02f8b52db585d3d1bc9351833b3abc01494ffa8c1c1bd7a5dcf5d220128.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d8b7a02f8b52db585d3d1bc9351833b3abc01494ffa8c1c1bd7a5dcf5d220128.exe
Resource
win10v2004-20231222-en
General
-
Target
d8b7a02f8b52db585d3d1bc9351833b3abc01494ffa8c1c1bd7a5dcf5d220128
-
Size
1.6MB
-
MD5
f32b927a52a9b714bc578f120aee0a77
-
SHA1
790d45410c4af89e49f0484a5339e97c1e8e7204
-
SHA256
d8b7a02f8b52db585d3d1bc9351833b3abc01494ffa8c1c1bd7a5dcf5d220128
-
SHA512
c91c2c6ba1ade6a2a202c8b4c5aaf9d878ca2e2d50693400c495ef4f0e8526ec14566700dd3177b08dc8d936345027458dfb558a3ad5a05a0d905bf6087d6a2a
-
SSDEEP
24576:CeS/D9Te2Gubh7Ub9lqsyUJ5oOCWPp1XWdIm2IjkbUzp4MYbp:XIe2Gubh7Ubl5NXWdIIzWMYbp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d8b7a02f8b52db585d3d1bc9351833b3abc01494ffa8c1c1bd7a5dcf5d220128
Files
-
d8b7a02f8b52db585d3d1bc9351833b3abc01494ffa8c1c1bd7a5dcf5d220128.exe windows:6 windows x86 arch:x86
dbe12583e4f29b74b710d05ff3b1216c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140u
ord12947
ord4090
ord4152
ord9398
ord14595
ord7922
ord14589
ord12542
ord12541
ord10293
ord5357
ord8324
ord12865
ord8386
ord8470
ord14598
ord11171
ord6531
ord1693
ord2172
ord14600
ord6316
ord4093
ord1143
ord501
ord6499
ord5962
ord11014
ord9039
ord4094
ord509
ord3171
ord1133
ord6549
ord8754
ord14547
ord1066
ord6490
ord9126
ord3145
ord4219
ord8365
ord8811
ord13085
ord13086
ord6795
ord3957
ord13985
ord13062
ord6812
ord2383
ord2385
ord2389
ord7787
ord10048
ord10047
ord11146
ord9011
ord11122
ord11746
ord8913
ord8923
ord11117
ord9526
ord9991
ord9986
ord9514
ord9524
ord9509
ord11278
ord11275
ord8304
ord12088
ord6876
ord2680
ord12123
ord9226
ord14239
ord13940
ord10509
ord7632
ord1427
ord947
ord7395
ord12584
ord12762
ord3846
ord3849
ord12317
ord11995
ord545
ord8776
ord6489
ord357
ord8345
ord7820
ord6973
ord13293
ord14047
ord6559
ord1446
ord6834
ord9135
ord3257
ord4236
ord7941
ord5669
ord1687
ord14377
ord4885
ord5882
ord2526
ord8464
ord3932
ord6607
ord4227
ord8746
ord5850
ord5813
ord13646
ord13656
ord8067
ord8062
ord6966
ord7642
ord13544
ord8817
ord8070
ord1454
ord6842
ord6117
ord9138
ord3260
ord3366
ord4239
ord7418
ord1689
ord1692
ord1525
ord7654
ord7073
ord6977
ord4881
ord7509
ord12251
ord9132
ord4225
ord7165
ord3864
ord13070
ord2520
ord1108
ord450
ord12189
ord4055
ord9235
ord6533
ord4882
ord4886
ord12928
ord7525
ord1214
ord595
ord8171
ord2766
ord1070
ord1002
ord6497
ord9209
ord6129
ord12220
ord9128
ord2761
ord13756
ord6220
ord3147
ord4222
ord8744
ord2993
ord3872
ord2990
ord3833
ord9468
ord14131
ord4477
ord2246
ord10472
ord7493
ord1111
ord458
ord7107
ord266
ord265
ord12763
ord12131
ord9040
ord11015
ord11396
ord3404
ord3403
ord3164
ord2409
ord6218
ord13752
ord3305
ord3302
ord8210
ord2760
ord2034
ord11982
ord11983
ord14466
ord12531
ord8000
ord14667
ord6348
ord14669
ord6350
ord14668
ord6349
ord3852
ord5918
ord12239
ord12247
ord4589
ord8217
ord7410
ord10433
ord14785
ord10285
ord10287
ord10286
ord10284
ord10288
ord5652
ord11725
ord11726
ord9139
ord12089
ord3838
ord11936
ord14588
ord8965
ord6978
ord11002
ord9256
ord3266
ord13878
ord12262
ord12258
ord1722
ord1744
ord1770
ord1756
ord1777
ord4936
ord5003
ord4948
ord4966
ord4960
ord4954
ord5013
ord4997
ord4942
ord5019
ord4974
ord4912
ord4927
ord4988
ord4502
ord9693
ord4494
ord3055
ord14590
ord7923
ord14596
ord6877
ord11717
ord13703
ord5935
ord2682
ord12124
ord3941
ord3372
ord3371
ord3265
ord12168
ord5249
ord5549
ord5760
ord9350
ord5525
ord5790
ord5252
ord5411
ord5228
ord7722
ord7723
ord7712
ord5409
ord8219
ord10255
ord9210
ord1511
ord5763
ord1180
ord12219
ord5419
ord9377
ord4649
ord1391
ord890
ord4092
ord12172
ord2215
ord13028
ord5422
ord14234
ord285
ord5921
ord3009
ord280
ord2029
ord13473
ord1523
ord5427
ord10250
ord6860
ord7313
ord286
ord13442
ord952
ord2205
ord7997
ord2345
ord4499
ord2562
ord1474
ord997
ord976
ord14137
ord3697
ord1452
ord6501
ord1472
ord995
ord7653
ord1462
ord985
ord6566
ord9418
ord3882
ord296
ord11905
ord1045
ord7495
ord13042
ord13935
ord6880
ord13275
ord12173
ord1113
ord462
ord7109
ord13087
ord1442
ord6830
ord3254
ord3363
ord7125
ord4815
ord1526
ord3580
ord5172
ord13335
ord1179
ord6493
ord2304
ord6486
ord5960
ord4992
ord5007
ord4931
ord1713
ord9127
ord3146
ord4220
ord8742
ord2994
ord3874
ord1663
ord14573
ord10473
ord2753
ord2522
ord2486
ord1513
kernel32
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
CreateMutexW
CopyFileW
OutputDebugStringW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
LocalFree
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
MulDiv
DeleteFileW
SetThreadUILanguage
GlobalUnlock
GlobalLock
GlobalAlloc
FindResourceW
LoadResource
CreateDirectoryW
GetSystemDirectoryW
GetFileAttributesW
WideCharToMultiByte
MultiByteToWideChar
GetEnvironmentVariableW
FreeLibrary
GetProcAddress
LoadLibraryW
SetUnhandledExceptionFilter
SetErrorMode
GetTempPathW
UnhandledExceptionFilter
CloseHandle
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetLocalTime
GetSystemTimes
GetModuleFileNameW
GetLastError
GlobalMemoryStatusEx
user32
GetWindowLongW
MoveWindow
IsRectEmpty
CheckMenuItem
EnableMenuItem
SetTimer
GetDlgCtrlID
ReleaseDC
GetDC
DrawIconEx
GetMenuItemID
GetMenuItemCount
LoadImageW
GetWindow
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetShellWindow
GetClassNameW
GetForegroundWindow
FillRect
SetWindowLongW
LoadCursorW
SetLayeredWindowAttributes
ChildWindowFromPoint
ScreenToClient
GetCursorPos
IsWindow
CheckMenuRadioItem
GetSubMenu
PtInRect
OffsetRect
LoadMenuW
InvalidateRect
GetDesktopWindow
SetParent
InflateRect
GetParent
SetForegroundWindow
ShowWindow
PostMessageW
LoadIconW
EnableWindow
LoadBitmapW
GetWindowRect
GetClientRect
SendMessageW
GetSysColor
SetMenuItemInfoW
MonitorFromRect
FindWindowW
FindWindowExW
SetRectEmpty
SetMenuDefaultItem
GetKeyState
SetWindowRgn
CreatePopupMenu
GetClassInfoW
GetMonitorInfoW
EnumDisplayMonitors
RegisterWindowMessageW
EqualRect
GetSystemMetrics
CopyRect
KillTimer
SetCursor
DeleteMenu
AppendMenuW
gdi32
SetRectRgn
EqualRgn
SetDIBColorTable
DeleteObject
CreateFontW
GetDeviceCaps
GetPixel
CreateRectRgn
Rectangle
CreatePen
CreateDIBSection
GetCurrentObject
DeleteDC
StretchBlt
SetBrushOrgEx
CreateRectRgnIndirect
GetTextExtentPoint32W
SelectObject
CreateFontIndirectW
GetObjectW
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
CombineRgn
advapi32
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
Shell_NotifyIconW
ShellExecuteW
comctl32
_TrackMouseEvent
InitCommonControlsEx
ord381
shlwapi
PathFileExistsW
ord191
uxtheme
DrawThemeParentBackground
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
oleaut32
SysAllocString
VariantClear
VariantInit
SysFreeString
gdiplus
GdiplusStartup
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdiplusShutdown
msvcp140
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Xbad_function_call@std@@YAXXZ
pdh
PdhAddCounterW
PdhCollectQueryData
PdhGetRawCounterValue
PdhCalculateCounterFromRawValue
PdhCloseQuery
PdhOpenQueryW
dbghelp
MiniDumpWriteDump
iphlpapi
GetAdaptersInfo
GetIfTable
GetNumberOfInterfaces
vcruntime140
memcpy
memchr
__RTDynamicCast
_CxxThrowException
__CxxFrameHandler3
__std_terminate
__std_exception_destroy
__std_exception_copy
_purecall
strchr
memset
__current_exception
__current_exception_context
_except_handler4_common
memmove
api-ms-win-crt-convert-l1-1-0
_wtoi
atoi
atoll
api-ms-win-crt-runtime-l1-1-0
_errno
_controlfp_s
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_resetstkoflw
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_invalid_parameter_noinfo
api-ms-win-crt-string-l1-1-0
isspace
isdigit
strncmp
isalpha
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf
fflush
__stdio_common_vsnprintf_s
setvbuf
_set_fmode
__p__commode
__stdio_common_vswprintf_s
__stdio_common_vsprintf_s
fclose
_get_stream_buffer_pointers
fputc
ungetc
fgetc
fread
fwrite
fgetpos
_fseeki64
fsetpos
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_wfindfirst64i32
_wfindnext64i32
_unlock_file
_findclose
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
_libm_sse2_log_precise
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 377KB - Virtual size: 377KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 54KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE