Static task
static1
Behavioral task
behavioral1
Sample
ijriejir.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ijriejir.exe
Resource
win10v2004-20231222-en
General
-
Target
ijriejir.exe
-
Size
891KB
-
MD5
a36c7dab334cef2b9dec9e9ebf8f7060
-
SHA1
06ee9ce33776698d717266f6efb1b969ad1e392f
-
SHA256
5b724737c050318ddfe0b959adb48bf9957cce58c8d12fdd7f44968e26105b8b
-
SHA512
595bbf4947aaa77e6f306273ab3adf5f2ad4d56fb9e2857de296d6fbe8225aa33ea99076fc90927b898105ee99bf5f2ecb04e06e965b84b3f48dac93d7a5194a
-
SSDEEP
24576:D1NJhZVgMscLi9uO9zWs9p0rQkYiuMB3JqmJpAphnDWI:jiwOAcb8o+pMnD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ijriejir.exe
Files
-
ijriejir.exe.exe windows:6 windows x64 arch:x64
3c394cc1d43d9364d8eee174dc22a1cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForMultipleObjects
CreateFileA
GetFileSizeEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
HeapAlloc
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
CreateFileMappingW
PeekNamedPipe
GetLastError
HeapSize
GetCurrentThreadId
CreateFileW
InitializeCriticalSectionEx
VirtualAlloc
MapViewOfFile
GetTickCount
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
DeviceIoControl
VirtualFree
HeapFree
QueryPerformanceCounter
FreeLibrary
VirtualProtect
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
MoveFileExA
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LocalFree
FormatMessageA
QueryFullProcessImageNameW
GetModuleHandleW
GetModuleFileNameA
UnmapViewOfFile
LoadLibraryA
HeapReAlloc
GetTempPathW
SetUnhandledExceptionFilter
Beep
CreateThread
LoadLibraryW
Process32FirstW
Process32NextW
Sleep
CreateToolhelp32Snapshot
SetLastError
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
HeapDestroy
CloseHandle
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
UnhandledExceptionFilter
MultiByteToWideChar
GetCurrentProcess
user32
ShowWindow
GetSystemMetrics
EnumWindows
SetClipboardData
GetClipboardData
EmptyClipboard
SetWindowPos
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
GetClientRect
SetCursor
DefWindowProcA
LoadCursorW
ClientToScreen
ScreenToClient
GetKeyState
UpdateWindow
RegisterClassExA
GetDesktopWindow
SetWindowLongW
DestroyWindow
MessageBoxA
GetAsyncKeyState
DispatchMessageW
PeekMessageW
GetWindowRect
GetWindow
GetWindowThreadProcessId
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
GetForegroundWindow
MoveWindow
LoadIconW
GetWindowLongW
advapi32
CryptDestroyHash
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegSetKeyValueW
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
RegOpenKeyW
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
OpenProcessToken
CryptHashData
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContextEx
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?good@ios_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitUnicodeString
NtQuerySystemInformation
d3d9
Direct3DCreate9Ex
normaliz
IdnToAscii
wldap32
ord301
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord143
crypt32
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CertCloseStore
ws2_32
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
WSAGetLastError
send
recv
closesocket
bind
rpcrt4
UuidCreate
UuidToStringA
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
__std_terminate
strchr
__std_exception_destroy
__std_exception_copy
_CxxThrowException
memchr
memcmp
memcpy
memmove
memset
strrchr
__current_exception
__current_exception_context
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
fopen
fgets
_open
ftell
__acrt_iob_func
fflush
_popen
_write
_read
__stdio_common_vsprintf_s
__p__commode
fclose
_set_fmode
_get_stream_buffer_pointers
_close
_fseeki64
fsetpos
ungetc
_pclose
fseek
setvbuf
fgetpos
_lseeki64
__stdio_common_vfprintf
fgetc
fwrite
_wfopen
__stdio_common_vsprintf
fputs
fputc
fread
__stdio_common_vsscanf
feof
api-ms-win-crt-string-l1-1-0
strpbrk
_strdup
tolower
strncmp
strncpy
isupper
strcmp
_stricmp
strcspn
strspn
api-ms-win-crt-utility-l1-1-0
rand
qsort
srand
api-ms-win-crt-heap-l1-1-0
free
_callnewh
realloc
_set_new_mode
malloc
calloc
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
strtoll
strtod
strtoull
atoi
api-ms-win-crt-filesystem-l1-1-0
_access
_unlock_file
_wremove
_stat64
_unlink
_lock_file
_fstat64
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_cexit
_beginthreadex
strerror
terminate
_errno
_crt_atexit
_getpid
system
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_set_app_type
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-math-l1-1-0
cosf
sinf
sqrtf
_dclass
tanf
acosf
ceilf
__setusermatherr
shell32
ShellExecuteA
Sections
.text Size: 680KB - Virtual size: 680KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 177KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ