Static task
static1
Behavioral task
behavioral1
Sample
9aa621d25408bbc5c5456c7a69913e87bcdcdd08a1bafc43419e98be9b55e9d1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9aa621d25408bbc5c5456c7a69913e87bcdcdd08a1bafc43419e98be9b55e9d1.exe
Resource
win10v2004-20231215-en
General
-
Target
9aa621d25408bbc5c5456c7a69913e87bcdcdd08a1bafc43419e98be9b55e9d1
-
Size
6.5MB
-
MD5
1235b992c31ebf943d56bc84958388c1
-
SHA1
c8bc7dcaee24fc9baa9593e57ac218de24473f3c
-
SHA256
9aa621d25408bbc5c5456c7a69913e87bcdcdd08a1bafc43419e98be9b55e9d1
-
SHA512
9ed5b265afe3af60813a866887683099585541f0f3f4dbda244358609372e53941ddf777e07f8ca83e12fa98ab1b7da6577bef8abb2f37cfaad1eb7b1f2d6361
-
SSDEEP
49152:h5o1t1Nbo0XR67/dYJzASV1xtK3R94OXvgzZ+2OzYPRBKBn7rOSKlVnan9QRIy0A:nH1YJzZJCb2ZjpP3KZO9EeRIy04Ky
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9aa621d25408bbc5c5456c7a69913e87bcdcdd08a1bafc43419e98be9b55e9d1
Files
-
9aa621d25408bbc5c5456c7a69913e87bcdcdd08a1bafc43419e98be9b55e9d1.exe windows:6 windows x86 arch:x86
1df2fdf1e7086ab76d8b6703e56e695d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc120u
ord14447
ord8846
ord11811
ord3795
ord11964
ord9020
ord11601
ord11600
ord5557
ord10169
ord10165
ord10167
ord10168
ord10166
ord2718
ord8092
ord3260
ord3263
ord13612
ord6121
ord3122
ord3361
ord3362
ord11271
ord10896
ord8921
ord12006
ord6875
ord10883
ord9116
ord3224
ord13738
ord12134
ord12132
ord1711
ord1723
ord1731
ord1727
ord1736
ord4879
ord4920
ord4887
ord4899
ord4895
ord4891
ord4928
ord4916
ord4883
ord4932
ord6961
ord3103
ord4905
ord4867
ord4874
ord6123
ord13616
ord2719
ord9007
ord12095
ord9137
ord999
ord1063
ord7543
ord2341
ord2343
ord2347
ord4838
ord4843
ord13153
ord8227
ord4605
ord7704
ord12958
ord4839
ord286
ord7004
ord4909
ord4459
ord9574
ord4451
ord3013
ord14449
ord7807
ord14455
ord6774
ord11592
ord13563
ord5838
ord2640
ord11999
ord3898
ord3330
ord3329
ord3223
ord12043
ord5693
ord10136
ord9091
ord6436
ord12048
ord9246
ord8636
ord2214
ord13997
ord3790
ord8655
ord3821
ord12941
ord2478
ord1105
ord450
ord1386
ord887
ord2708
ord8699
ord2480
ord6389
ord4434
ord14187
ord13991
ord5327
ord10353
ord7384
ord3562
ord2204
ord2173
ord462
ord8352
ord8268
ord12736
ord8206
ord5262
ord2444
ord12412
ord12413
ord14448
ord7806
ord14454
ord9279
ord4109
ord4047
ord12818
ord7825
ord1992
ord11857
ord11858
ord14326
ord12402
ord7884
ord14526
ord6251
ord14528
ord6253
ord14527
ord6252
ord3809
ord5821
ord12114
ord12122
ord4546
ord8099
ord10314
ord12126
ord12094
ord12799
ord5157
ord5454
ord5664
ord9231
ord5430
ord5667
ord5160
ord5316
ord5137
ord7609
ord7610
ord7600
ord5314
ord8101
ord10131
ord9090
ord6758
ord1110
ord6392
ord1108
ord6462
ord6469
ord3839
ord296
ord1042
ord4772
ord2262
ord4049
ord13771
ord7206
ord13302
ord949
ord7881
ord1467
ord992
ord7542
ord266
ord1506
ord265
ord4442
ord1508
ord2367
msvcr120
_exit
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
_onexit
__dllonexit
_calloc_crt
_unlock
memmove
memcpy_s
memchr
??0exception@std@@QAE@ABV01@@Z
fgetc
fputc
ungetc
exit
atoi
_lock_file
_unlock_file
fwrite
_fseeki64
fgetpos
fsetpos
setvbuf
fflush
fclose
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
_purecall
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
?terminate@@YAXXZ
sprintf
_vsnwprintf_s
_access
_mkdir
_errno
strtol
sprintf_s
malloc
_resetstkoflw
free
swprintf_s
_wtoi
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
__RTDynamicCast
_aligned_free
_aligned_malloc
??0exception@std@@QAE@ABQBDH@Z
?what@exception@std@@UBEPBDXZ
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
_lock
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
??1type_info@@UAE@XZ
kernel32
DecodePointer
QueryPerformanceCounter
EncodePointer
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
GlobalUnlock
GlobalLock
LoadResource
SizeofResource
FindResourceW
InitializeCriticalSectionEx
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GlobalFree
GlobalAlloc
WinExec
Sleep
GetModuleFileNameA
WideCharToMultiByte
MultiByteToWideChar
GetCurrentDirectoryW
LoadLibraryW
OutputDebugStringW
GetProcAddress
user32
LoadBitmapW
SetForegroundWindow
BringWindowToTop
IsIconic
GetSystemMetrics
GetClientRect
LoadImageW
PostMessageW
SetTimer
SendMessageW
GetWindowRect
EnableWindow
GetDC
ReleaseDC
InvalidateRect
ClientToScreen
WindowFromPoint
GetParent
MapWindowPoints
CopyRect
LoadIconW
KillTimer
MessageBoxW
gdi32
SetTextColor
SetBkMode
GetDIBColorTable
BitBlt
CreateCompatibleBitmap
CreateDIBSection
SetDIBColorTable
SelectObject
DeleteDC
DeleteObject
StretchBlt
CreateCompatibleDC
GetObjectW
GetStockObject
msimg32
AlphaBlend
TransparentBlt
shell32
SHGetSpecialFolderPathW
ShellExecuteW
comctl32
_TrackMouseEvent
ole32
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
gdiplus
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipDisposeImage
GdipFree
GdipAlloc
GdipCloneImage
GdipCreateBitmapFromScan0
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdiplusStartup
GdiplusShutdown
msvcp120
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??0_Pad@std@@QAE@XZ
?_Release@_Pad@std@@QAEXXZ
??1_Pad@std@@QAE@XZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bios_base@std@@QBE_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
wininet
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
advapi32
RegDeleteKeyA
Sections
.text Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ