Static task
static1
Behavioral task
behavioral1
Sample
4f4659cf589a8f9a83c729c8f38b8b39.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4f4659cf589a8f9a83c729c8f38b8b39.exe
Resource
win10v2004-20231222-en
General
-
Target
4f4659cf589a8f9a83c729c8f38b8b39
-
Size
1.1MB
-
MD5
4f4659cf589a8f9a83c729c8f38b8b39
-
SHA1
a45f81cae04621dbe7bfa26ab46fc0ad05430ca0
-
SHA256
f17ddee098c25de5a35b8289a19aad8e0b22ecdbf1edfec51984eac369426053
-
SHA512
9fe70695c68a702a408b78c385a60d9da60ab67c1a1da07ea0f1f0decb9c6b1ce1146a773d3b4ae4c6b2386b9319617f1ab6350d723d79dee16f036d48bf04de
-
SSDEEP
24576:9WU9qUvT3L9/2nx8oBNDP8Fkf7zFg9Ow+DEdYx:MF4TKp3UUm9oEu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f4659cf589a8f9a83c729c8f38b8b39
Files
-
4f4659cf589a8f9a83c729c8f38b8b39.exe windows:4 windows x86 arch:x86
d46ff2f1a341f7805616610e9bd52ae4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathW
ExtractIconExW
ShellExecuteW
kernel32
WriteProcessMemory
LocalFree
Sleep
GetTempPathW
CloseHandle
VirtualFreeEx
VirtualAllocEx
OpenProcess
GetExitCodeThread
CreateThread
GetLongPathNameW
DeviceIoControl
CreateFileW
GetLastError
GetVersionExW
GetVolumeInformationW
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleW
GlobalFree
SizeofResource
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryW
SystemTimeToFileTime
CompareFileTime
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
GetSystemDirectoryW
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetDateFormatW
GetStartupInfoW
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
MulDiv
user32
GetDC
DefWindowProcW
PostThreadMessageW
FindWindowW
GetWindowThreadProcessId
PostMessageW
ShowWindow
InvalidateRect
UpdateWindow
GetMessageW
DispatchMessageW
DestroyWindow
CallWindowProcW
ReleaseDC
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
RedrawWindow
IsWindow
GetWindowDC
EndDialog
FillRect
GetActiveWindow
DialogBoxParamW
MessageBoxW
GetWindowTextW
SetFocus
ScreenToClient
MoveWindow
SetWindowTextW
SendMessageW
HideCaret
SetWindowLongW
CreateWindowExW
GetWindowLongW
GetParent
GetWindow
SystemParametersInfoW
MapWindowPoints
SetWindowPos
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetClientRect
GetWindowRect
gdi32
GetTextExtentPoint32W
CreateFontW
CreateSolidBrush
GetDeviceCaps
DeleteDC
DeleteObject
CreateFontIndirectW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
IsTextUnicode
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
ole32
CLSIDFromProgID
CoInitialize
CreateStreamOnHGlobal
CoInitializeSecurity
CoUninitialize
CoCreateInstance
oleaut32
OleLoadPicture
VariantChangeType
SysAllocString
VariantInit
VariantCopy
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
CreateErrorInfo
msvcp60
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@DABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$ctype@G@std@@UAE@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??0?$ctype@G@std@@QAE@I@Z
?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z
?do_is@?$ctype@G@std@@MBE_NFG@Z
?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z
?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z
?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_tolower@?$ctype@G@std@@MBEGG@Z
?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_toupper@?$ctype@G@std@@MBEGG@Z
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z
?do_widen@?$ctype@G@std@@MBEGD@Z
?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z
?do_narrow@?$ctype@G@std@@MBEDGD@Z
??1?$ctype@D@std@@UAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z
?_Iscloc@locale@std@@QBE_NXZ
??0?$ctype@D@std@@QAE@PBF_NI@Z
??_7bad_cast@std@@6B@
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_tolower@?$ctype@D@std@@MBEDD@Z
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_toupper@?$ctype@D@std@@MBEDD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??1locale@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_Doraise@runtime_error@std@@MBEXXZ
?what@runtime_error@std@@UBEPBDXZ
??_7runtime_error@std@@6B@
?_Xran@std@@YAXXZ
?_Xlen@std@@YAXXZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0runtime_error@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0locale@std@@QAE@XZ
msvcrt
strchr
atol
localtime
_findclose
_wfindnext
_wfindfirst
_ftime
??0exception@@QAE@XZ
_purecall
strcmp
strncmp
?name@type_info@@QBEPBDXZ
??9type_info@@QBEHABV0@@Z
??8type_info@@QBEHABV0@@Z
wcscat
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_stricmp
fprintf
fgets
fgetc
isalpha
pow
log
fread
__CxxFrameHandler
_ftol
memcpy
wcslen
swprintf
wcschr
??2@YAPAXI@Z
strlen
wcstol
_wcsnicmp
srand
clock
time
__p___wargv
__p___argc
??1exception@@UAE@XZ
_wcsicmp
wcscpy
memset
fabs
wcsncpy
_wtol
_wmkdir
_wchdir
fclose
fwrite
_wfopen
_waccess
_wgetenv
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
abs
_CxxThrowException
_wtoi
_wrmdir
_wremove
_wfullpath
_wgetcwd
malloc
free
wcstok
_wcsdup
_wsplitpath
strcpy
toupper
tolower
rand
wcscmp
sprintf
strncpy
isprint
isspace
isalnum
_lrotl
_lrotr
memcmp
strrchr
fsetpos
fseek
fgetpos
Sections
.text Size: 236KB - Virtual size: 233KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 788KB - Virtual size: 785KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ