Static task
static1
Behavioral task
behavioral1
Sample
525ad0d5b78603d6020db05fc61dfe00.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
525ad0d5b78603d6020db05fc61dfe00.exe
Resource
win10v2004-20231222-en
General
-
Target
525ad0d5b78603d6020db05fc61dfe00
-
Size
390KB
-
MD5
525ad0d5b78603d6020db05fc61dfe00
-
SHA1
1ac542c5b79dc6b66dab7d5fcd4954395995c081
-
SHA256
2cd53e5f221a7201f84ed6e3ac055b790d8fea6e84ee2ee88669ecf9c0cf0f33
-
SHA512
915532b15318162d3b3e4f5c31e58886a88adbff4c8b37afbbc7f759045f982be215a9905b59ec9f50d429ff9d3f191fe23538c5cc24761444bc67cd81597d0a
-
SSDEEP
6144:6BxIK3CTW8TMjp41u6nyHGri6UCb6lTHns2HLxHklUxrOPAfhOJ9rB8r:CxIK9V14ImyHcqnZHLxH8UxrnQJ9rBI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 525ad0d5b78603d6020db05fc61dfe00
Files
-
525ad0d5b78603d6020db05fc61dfe00.exe windows:4 windows x86 arch:x86
cd53f40caa7b95431b2b290227ed4aed
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
L`zw� P��~c����~èF�׀~w��x���{�o�\\zw� L��~D�|w� ��� �t��x��g�҇DXzw� P��~c����~èF�׀~wx�Ē{�o�T\zw� H��~D�}w� ��� �t��x��g�҇LTzw� P��~\\zw� ��� �t��~w��gv�D�}w� ��� �t��~w��gVчD�{w� ���0x��l��ՂOOٰAHid��~��_�B|���������>�p���s�x��4��x�ljb��83�p��q��HAHLB���jiO��� ���1x� @AHLBӨg�q��ooӨg�q��oc5�4��x��] V��z�����SH�os�x��4��x��hG];Ɠ5�� �hHTX>W_��Q�� �t����;O,��x��]�~��z������ �hL:x��4��x��dHu>Ɠ5�� �d�:Y�_��d�?CV�YB����zB�3�7w��~�W_��5x��~�x��hH� ��C���Ղ�]Bp�x��GG�� U<�G3�PBd�����ܾ�8��u�x�����J3�PBd�������vS7
CreateDirectoryA
CreateProcessA
CreateSemaphoreA
DeleteFileA
ExitProcess
FindAtomA
�x��dHu>Ɠ5�� �d�:Y�_��d�?CV�YB����zB�3�7w��~�W_��5x��~�x��hH� ��C���Ղ�]Bp�x��GG�� U<�G3�PBd�����ܾ�8��u�x�����J3�PBd�������vS7
GetCommandLineA
GetLastError
��~wL �v��|�K���~x��`\��xJ �v�����~wJ�v����K���~w��~`(AxL �v��|�K���~w��~` ��xL �w��~x��{w�K��w�x� �v��~w��g������h���~�Hi��k�Ä?D�{w�d���K���~���D�{w��`H�9���������~èg�u�?\x��F���x��5}t�xG �w�� �~wwx� Ü�KÜÄx� ����ox�KÜ�x�KÜä_��K����x� �t��~w��g��������~wHȣ��ȣ���x�ȣ���x�ȣ|��x���x��``wxBp�?����D�~w� ���<nx�KÜ�,o��о�~èg��?����D�~w� ���nx�KÜLjx�о�~��D�}w� ����{�KÜLjx�KÜä_�����~èF�׀~wx���{�KÜLjx�ĀHȣ|L �t��|�K���~z��`���xL �v��83 ��� �t���x��gʏ����?��y��D�~w� Ü����~èg���?��y��D�~w� Ü����~èg�2�c^K��_d�x�$mx� Ü�KÜ�$_�����~èF�׀~w��x���z�lf���π~wJ�t��ˀ~wBA�t�������~w��D�{w�Ew��d�\�{w��B��\��mx� ���~D�{w� |��~�|�{w����@ �t��~x�� �À~w�|�9�� ǀ~w�FHG�d`�rxH t�� ��~wH{s��5�~w����D�zw��x�t��~9��@X�x��~�� W
GetModuleHandleA
GetStartupInfoA
InterlockedDecrement
InterlockedIncrement
ReleaseSemaphore
SetFileAttributesA
SetLastError
SetUnhandledExceptionFilter
Sleep
TlsAlloc
TlsFree
TlsGetValue
x��]�~��z������ �hL:x��4��x��dHu>Ɠ5�� �d�:Y�_��d�?CV�YB����zB�3�7w��~�W_��5x��~�x��hH� ��C���Ղ�]Bp�x��GG�� U<�G3�PBd�����ܾ�8��u�x�����J3�PBd�������vS7
WaitForSingleObject
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
��qx���������I�SF:� �y�� �� ����w��~`�1xH �w��9���� ���~�Cc�x�K���~wHF ���@���n��|w� ྃ~�u�[��Ԕ�xyw� �HJɛèg�l�|�~w��8���D�~w� ?t�~w� Ծ�~L�~w������D�x�=�x��7����� ���~�C߀x�zĄ��2��������xJٓ�
LocalFree
��~wL �v��|�K���~x��`\��xJ �v�����~wJ�v����K���~w��~`(AxL �v��|�K���~w��~` ��xL �w��~x��{w�K��w�x� �v��~w��g������h���~�Hi��k�Ä?D�{w�d���K���~���D�{w��`H�9���������~èg�u�?\x��F���x��5}t�xG �w�� �~wwx� Ü�KÜÄx� ����ox�KÜ�x�KÜä_��K����x� �t��~w��g��������~wHȣ��ȣ���x�ȣ���x�ȣ|��x���x��``wxBp�?����D�~w� ���<nx�KÜ�,o��о�~èg��?����D�~w� ���nx�KÜLjx�о�~��D�}w� ����{�KÜLjx�KÜä_�����~èF�׀~wx���{�KÜLjx�ĀHȣ|L �t��|�K���~z��`���xL �v��83 ��� �t���x��gʏ����?��y��D�~w� Ü����~èg���?��y��D�~w� Ü����~èg�2�c^K��_d�x�$mx� Ü�KÜ�$_�����~èF�׀~w��x���z�lf���π~wJ�t��ˀ~wBA�t�������~w��D�{w�Ew��d�\�{w��B��\��mx� ���~D�{w� |��~�|�{w����@ �t��~x�� �À~w�|�9�� ǀ~w�FHG�d`�rxH t�� ��~wH{s��5�~w����D�zw��x�t��~9��@X�x��~�� W
ExitProcess
ྃ~g ��~d�~w���xw��ؾ�~d�~w��u �k� #�~wdd��j�wy���+�~wj �w���add��ق~wj �w��8z������~n��>d�~w��e��~w��m��� о�~c����jͼ�~yj����t�~w��od�~w�侃~g���~d�~w�����xw��
_fdopen
�uD�k�~wL gv��|�K0��~w��~`袂xJ +v���o�~w����4��~T(}w���~D,}w�`��~èF�w�~w��x�l�{� ��~T(}w���~èF�w�~w��~w��Ax�,��~èg�{�D4}w�C������;O�]����p�x�KĽ�~X��?D�}w��D��̽�~l�yԘ�� �|H��D�}w� ����:x�K����x�tx� ��� tx�KÜ�x�KÜä_��K����x� �v��~w��g������F�㌏��F���h�F|��x?lFp��d�KÜ�x�KÜϤ_��KÜ˅x�KÜDŽx�KÜôo��%���|�lp��d�%���|�lp��d�K�\��x�:�ͯ�
_strdup
� �d�:Y�_��d�?CV�YB����zB�3�7w��~�W_��5x��~�x��hH� ��C���Ղ�]Bp�x��GG�� U<�G3�PBd�����ܾ�8��u�x�����J3�PBd�������vS7
__getmainargs
__mb_cur_max
__p__environ
__p__fmode
d�m�v�� �� ��� �v���x��gꋄc��J �v�����~wJ�v�� ��~wL �v��|�K���~x��`\��xJ �v�����~wJ�v����K���~w��~`(AxL �v��|�K���~w��~` ��xL �w��~x��{w�K��w�x� �v��~w��g������h���~�Hi��k�Ä?D�{w�d���K���~���D�{w��`H�9���������~èg�u�?\x��F���x��5}t�xG �w�� �~wwx� Ü�KÜÄx� ����ox�KÜ�x�KÜä_��K����x� �t��~w��g��������~wHȣ��ȣ���x�ȣ���x�ȣ|��x���x��``wxBp�?����D�~w� ���<nx�KÜ�,o��о�~èg��?����D�~w� ���nx�KÜLjx�о�~��D�}w� ����{�KÜLjx�KÜä_�����~èF�׀~wx���{�KÜLjx�ĀHȣ|L �t��|�K���~z��`���xL �v��83 ��� �t���x��gʏ����?��y��D�~w� Ü����~èg���?��y��D�~w� Ü����~èg�2�c^K��_d�x�$mx� Ü�KÜ�$_�����~èF�׀~w��x���z�lf���π~wJ�t��ˀ~wBA�t�������~w��D�{w�Ew��d�\�{w��B��\��mx� ���~D�{w� |��~�|�{w����@ �t��~x�� �À~w�|�9�� ǀ~w�FHG�d`�rxH t�� ��~wH{s��5�~w����D�zw��x�t��~9��@X�x��~�� W
_assert
_cexit
������ �s��xJϯ˨g>���8���y83� ���xH��|J�3�� � ���$wx�l p�� �/e�xH�gVw���tgη�� ˜��x����ä�xH��`X;xHGg���ۨgB�����8�����H��`|xJ�3��h;�~5�4��x��]Bp�?è�x��~�K��x�L}w�,��x��]Bp�?è�x��~�K��x�,}w�,��x�� ����xHi�w����� ���xHi�w�O�]m�2��OO�]Bp��|�l^z���� ������lHȣ|L�{èg*P�� �pJ�{tE���F���x��`��w���g���t��� �� ���@�y� @� ͧ�A�u��z�?
_errno
_fstati64
_iob
_isctype
_lseeki64
_onexit
��� �hL:x��4��x��dHu>Ɠ5�� �d�:Y�_��d�?CV�YB����zB�3�7w��~�W_��5x��~�x��hH� ��C���Ղ�]Bp�x��GG�� U<�G3�PBd�����ܾ�8��u�x�����J3�PBd�������vS7
_setmode
_strnicmp
_vsnprintf
abort
atexit
fclose
fflush
fopen
fprintf
Ü�གྷ~ègJ݇D�}w� ��� �v���x��gB܇D�~w� ���{w�?�C�x����~èg>�����F�㌟x��F���x���7�~wH��`�wxJ �w���7�~w�ȣ|Tt�xL �w��|�l�k���7�~wH��`�NxH�ch|�K���~y��`�PxH �w��5/�~w����>Ą_���F�㌟x��F���x���7�~wH��`tvxJ �w���7�~w�ȣ|Tt�xL �w��|�l2j�� �/�~wBD���D�~w� ���qx�KÜ�o�����~èg���D�~w� ����qx�g~%'����7Ę���;�7�~w$�ʇ~�����4��~w�����C�����{��w������>}Ӥ�x?@����~�4��7Ę���;�3�~w���>Ą_����7�~wH��?D�}w��x�lvr��8� x�����d�x�����D�~w� �����x����~èg.���b�����>}Ӥ�x��テ~x�C����>C��w���~����E���~w���7Ę���J�3�~w��>}Ӥ�x��뾃~x�ȣ|��xL �w��|�l>k��d�m�v�� �� ��� �v���x��gꋄc��J �v�����~wJ�v�� ��~wL �v��|�K���~x��`\��xJ �v�����~wJ�v����K���~w��~`(AxL �v��|�K���~w��~` ��xL �w��~x��{w�K��w�x� �v��~w��g������h���~�Hi��k�Ä?D�{w�d���K���~���D�{w��`H�9���������~èg�u�?\x��F���x��5}t�xG �w�� �~wwx� Ü�KÜÄx� ����ox�KÜ�x�KÜä_��K����x� �t��~w��g��������~wHȣ��ȣ���x�ȣ���x�ȣ|��x���x��``wxBp�?����D�~w� ���<nx�KÜ�,o��о�~èg��?����D�~w� ���nx�KÜLjx�о�~��D�}w� ����{�KÜLjx�KÜä_�����~èF�׀~wx���{�KÜLjx�ĀHȣ|L �t��|�K���~z��`���xL �v��83 ��� �t���x��gʏ����?��y��D�~w� Ü����~èg���?��y��D�~w� Ü����~èg�2�c^K��_d�x�$mx� Ü�KÜ�$_�����~èF�׀~w��x���z�lf���π~wJ�t��ˀ~wBA�t�������~w��D�{w�Ew��d�\�{w��B��\��mx� ���~D�{w� |��~�|�{w����@ �t��~x�� �À~w�|�9�� ǀ~w�FHG�d`�rxH t�� ��~wH{s��5�~w����D�zw��x�t��~9��@X�x��~�� W
localeconv
malloc
memchr
����>�A}�x���`�lxB}�6Äx3�q�B�x���_Hz4��x��.NJϋ�uD�IJׇx��lvu�� ��C���;O5x��~�x��]Bp�4|>J�ճ R<�GH�o� ���ԇ���t xH�o��2��xJ����ͯ Ӝ� ���ԏ��?���hy�x� �xHJ�w<�dGu�x��] V�HJ���� �� �dJч���wO����hH\g���~t;DV��HtgN��~pr��~w�?��<�x��<����G<˵?���;O�]L�g��
memmove
memset
rand
�7�~wH��`�NxH�ch|�K���~y��`�PxH �w��5/�~w����>Ą_���F�㌟x��F���x���7�~wH��`tvxJ �w���7�~w�ȣ|Tt�xL �w��|�l2j�� �/�~wBD���D�~w� ���qx�KÜ�o�����~èg���D�~w� ����qx�g~%'����7Ę���;�7�~w$�ʇ~�����4��~w�����C�����{��w������>}Ӥ�x?@����~�4��7Ę���;�3�~w���>Ą_����7�~wH��?D�}w��x�lvr��8� x�����d�x�����D�~w� �����x����~èg.���b�����>}Ӥ�x��テ~x�C����>C��w���~����E���~w���7Ę���J�3�~w��>}Ӥ�x��뾃~x�ȣ|��xL �w��|�l>k��d�m�v�� �� ��� �v���x��gꋄc��J �v�����~wJ�v�� ��~wL �v��|�K���~x��`\��xJ �v�����~wJ�v����K���~w��~`(AxL �v��|�K���~w��~` ��xL �w��~x��{w�K��w�x� �v��~w��g������h���~�Hi��k�Ä?D�{w�d���K���~���D�{w��`H�9���������~èg�u�?\x��F���x��5}t�xG �w�� �~wwx� Ü�KÜÄx� ����ox�KÜ�x�KÜä_��K����x� �t��~w��g��������~wHȣ��ȣ���x�ȣ���x�ȣ|��x���x��``wxBp�?����D�~w� ���<nx�KÜ�,o��о�~èg��?����D�~w� ���nx�KÜLjx�о�~��D�}w� ����{�KÜLjx�KÜä_�����~èF�׀~wx���{�KÜLjx�ĀHȣ|L �t��|�K���~z��`���xL �v��83 ��� �t���x��gʏ����?��y��D�~w� Ü����~èg���?��y��D�~w� Ü����~èg�2�c^K��_d�x�$mx� Ü�KÜ�$_�����~èF�׀~w��x���z�lf���π~wJ�t��ˀ~wBA�t�������~w��D�{w�Ew��d�\�{w��B��\��mx� ���~D�{w� |��~�|�{w����@ �t��~x�� �À~w�|�9�� ǀ~w�FHG�d`�rxH t�� ��~wH{s��5�~w����D�zw��x�t��~9��@X�x��~�� W
setvbuf
signal
srand
pz�:��?~~�7�d�:Y�?|H�g�l.u�� ͧ xӨ:H\gV��~��d�:��GƓv��tp��}w��hHK ͫ�W��.�� ͫ��L�o�lbu�� ů Fp�@HƏ���p��Ղ�dHƃp�.���ӂ?�i�d�ċx��ct5x��~�x��]�u�Bp���5���~�� @6��xBe������>�A}�x���`�lxB}�6Äx3�q�B�x���_Hz4��x��.NJϋ�uD�IJׇx��lvu�� ��C���;O5x��~�x��]Bp�4|>J�ճ R<�GH�o� ���ԇ���t xH�o��2��xJ����ͯ Ӝ� ���ԏ��?���hy�x� �xHJ�w<�dGu�x��] V�HJ���� �� �dJч���wO����hH\g���~t;DV��HtgN��~pr��~w�?��<�x��<����G<˵?���;O�]L�g��
strcmp
strcoll
strcpy
strftime
strlen
strtod
strxfrm
time
shell32
SHGetFolderPathA
ShellExecuteA
Sections
.text Size: - Virtual size: 239KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 18KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol 0 Size: - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.NewSec Size: - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol 1 Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE