Static task
static1
Behavioral task
behavioral1
Sample
57ed317492f63d6002eebfe0f760b2cd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
57ed317492f63d6002eebfe0f760b2cd.exe
Resource
win10v2004-20231215-en
General
-
Target
57ed317492f63d6002eebfe0f760b2cd
-
Size
360KB
-
MD5
57ed317492f63d6002eebfe0f760b2cd
-
SHA1
eb53db13063697e4affeb003bb12b28cf3e2b194
-
SHA256
b799a89946e9d53fa3261a28ffef040907155102d43c7a2d27cfac4037c1e141
-
SHA512
af2ff3f11f54e5a6d5d5770bb9bc4574b7e721c423521ffd499ecef77c5fdfb9c4e265b1c2cf6116676358f6ec78b8a3fe52e49d9a7f472773d428b8515caf0f
-
SSDEEP
6144:ortZM/TvfqK4hO9kg0zJdJCBQJC01kZJCWULKLi5eadeSo1hBS:oE7fT9kbJ31GhU+yebG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57ed317492f63d6002eebfe0f760b2cd
Files
-
57ed317492f63d6002eebfe0f760b2cd.exe windows:4 windows x86 arch:x86
a84932d9a0c2467cf4a8299aa84277ba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
socket
gethostbyname
connect
recv
send
sendto
accept
inet_ntoa
closesocket
setsockopt
inet_addr
htons
bind
listen
mfc42
ord2614
ord5572
ord2919
ord2863
ord2546
ord291
ord4264
ord6232
ord6230
ord6148
ord2568
ord6268
ord6271
ord3225
ord3912
ord2544
ord2543
ord2511
ord978
ord1731
ord5851
ord2883
ord2398
ord2418
ord6224
ord6226
ord2429
ord2250
ord2259
ord4836
ord4440
ord3720
ord794
ord527
ord3481
ord2642
ord4284
ord3779
ord3092
ord1234
ord4083
ord1928
ord3138
ord3257
ord4871
ord2233
ord5949
ord3916
ord3495
ord2252
ord5265
ord4376
ord4853
ord4998
ord2514
ord6052
ord1775
ord5280
ord4425
ord3597
ord641
ord324
ord2841
ord4234
ord5910
ord4710
ord922
ord924
ord2915
ord6805
ord6597
ord2092
ord366
ord1233
ord1920
ord2107
ord5450
ord5440
ord6383
ord6394
ord1997
ord6392
ord798
ord5194
ord939
ord533
ord5808
ord5204
ord690
ord668
ord3229
ord6059
ord1228
ord4277
ord5683
ord2770
ord941
ord356
ord389
ord2096
ord4589
ord4588
ord4899
ord4370
ord4892
ord4533
ord5076
ord4340
ord4347
ord4889
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4963
ord4960
ord4108
ord6054
ord5240
ord5281
ord3748
ord1725
ord5260
ord2091
ord4432
ord364
ord784
ord765
ord2370
ord2302
ord4241
ord2086
ord5677
ord4720
ord6334
ord3301
ord3698
ord1768
ord4673
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord940
ord3721
ord795
ord6453
ord3797
ord5216
ord936
ord932
ord3370
ord2582
ord4402
ord3640
ord693
ord4243
ord3286
ord2408
ord801
ord541
ord6907
ord6007
ord6143
ord2100
ord6675
ord2862
ord2380
ord6888
ord6905
ord538
ord1175
ord2859
ord2763
ord5710
ord858
ord4129
ord384
ord686
ord3654
ord2584
ord4220
ord860
ord535
ord1644
ord6270
ord2438
ord2089
ord4287
ord6199
ord5736
ord5678
ord2818
ord1200
ord5781
ord3706
ord4224
ord6215
ord1197
ord1570
ord5606
ord3986
ord5860
ord5788
ord4297
ord4133
ord2567
ord5875
ord470
ord323
ord1640
ord1641
ord5785
ord2714
ord2414
ord640
ord755
ord3626
ord3571
ord3663
ord289
ord2754
ord613
ord6197
ord6442
ord6142
ord500
ord472
ord1168
ord1146
ord537
ord818
ord783
ord772
ord3711
ord1949
ord823
ord6605
ord6880
ord562
ord2860
ord5789
ord4299
ord816
ord5981
ord2379
ord3874
ord2864
ord4275
ord800
ord825
ord567
ord540
ord656
ord3610
ord4424
ord4627
ord4080
ord3079
ord3825
ord3831
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord1841
ord1576
msvcrt
_XcptFilter
_exit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
calloc
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_except_handler3
exit
_purecall
acos
cos
sin
ceil
floor
realloc
toupper
strcpy
sprintf
strcat
fopen
fwrite
fclose
malloc
free
strlen
memcpy
strncpy
strcmp
memset
_mbsicmp
atoi
strtoul
strtod
memmove
_mbsstr
_ftol
_mbscmp
__CxxFrameHandler
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
remove
_stricmp
_setmbcp
_controlfp
kernel32
lstrlenA
Sleep
GlobalFree
LoadResource
FindResourceA
GlobalReAlloc
GlobalAlloc
GetVersion
GetPrivateProfileStringA
GetPrivateProfileIntA
GetCurrentDirectoryA
CreateDirectoryA
WaitForMultipleObjects
CreateEventA
CloseHandle
MulDiv
SizeofResource
WaitForSingleObject
ResetEvent
SetEvent
lstrcatA
CreateThread
InitializeCriticalSection
lstrcpyA
lstrcmpiA
GetCurrentThreadId
lstrcmpA
LeaveCriticalSection
GetProcAddress
GetModuleHandleA
EnterCriticalSection
GetVersionExA
GetModuleFileNameA
GetTempFileNameA
GetTempPathA
LoadLibraryA
FreeLibrary
HeapAlloc
GetProcessHeap
HeapFree
GetWindowsDirectoryA
DeleteCriticalSection
LockResource
GetStartupInfoA
user32
EnableScrollBar
GetScrollInfo
GetScrollPos
GetScrollRange
SetScrollInfo
SetScrollPos
SetScrollRange
ShowScrollBar
GetIconInfo
CharUpperBuffA
GetWindowTextA
IsWindowEnabled
DestroyIcon
EnumChildWindows
SetFocus
SetWindowWord
GetWindowWord
IntersectRect
ValidateRect
GetWindowPlacement
CharLowerA
CharUpperA
DestroyCursor
LoadStringA
CopyIcon
MapWindowPoints
DrawTextExA
CreateIconIndirect
InsertMenuItemA
GetMenuItemInfoA
IsWindowVisible
GetCursorPos
DestroyWindow
DrawEdge
BeginPaint
EndPaint
CreateWindowExA
GetMenu
SetMenu
GetClassLongA
GetWindowInfo
GetWindow
IsZoomed
MoveWindow
ShowWindow
GetWindowDC
EnableMenuItem
SetWindowPos
RemovePropA
SetPropA
CallWindowProcA
DefWindowProcA
GetSysColorBrush
IsWindow
GetActiveWindow
GetClassNameA
GetPropA
GetWindowLongA
LockWindowUpdate
SetWindowLongA
FillRect
IsIconic
DrawIcon
FindWindowA
SetForegroundWindow
LoadIconA
LoadImageA
GetWindowRect
EqualRect
BeginDeferWindowPos
EndDeferWindowPos
RedrawWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuStringA
ModifyMenuA
GetMenuState
LoadBitmapA
GetTabbedTextExtentA
DrawStateA
SystemParametersInfoA
GetDC
DrawIconEx
IsRectEmpty
GetSystemMenu
ReleaseDC
DrawFrameControl
UpdateWindow
CreatePopupMenu
AppendMenuA
ClientToScreen
DrawTextA
DispatchMessageA
GetCapture
SetCapture
GetMessageA
ReleaseCapture
GetCursor
SendMessageA
GetParent
SetWindowRgn
DestroyMenu
SetCursor
GetFocus
IsChild
SetTimer
InflateRect
GetSystemMetrics
SetRect
OffsetRect
CopyRect
GetMessagePos
ScreenToClient
PtInRect
KillTimer
InvalidateRect
GetSysColor
LoadCursorA
EnableWindow
GetClientRect
PostMessageA
gdi32
CreateRectRgn
OffsetRgn
SetBkMode
SetTextColor
GetTextExtentPointA
ExtCreateRegion
GetRegionData
GetDIBits
CreateICA
SetBkColor
CreateBitmap
RealizePalette
SelectPalette
StretchBlt
Polygon
RestoreDC
SaveDC
CreateDIBitmap
CreateDIBSection
SetDIBitsToDevice
SetStretchBltMode
CombineRgn
GetClipBox
RectVisible
StretchDIBits
PtInRegion
ExcludeClipRect
LineTo
MoveToEx
CreatePen
SelectClipRgn
GetClipRgn
TextOutA
IntersectClipRect
UnrealizeObject
SetBrushOrgEx
CreatePatternBrush
ExtTextOutA
CreateSolidBrush
DeleteObject
CreateFontIndirectA
DeleteDC
SelectObject
GetPixel
GetTextExtentPoint32A
CreateRectRgnIndirect
GetObjectA
PatBlt
CreateCompatibleDC
GetDeviceCaps
GetTextMetricsA
CreateCompatibleBitmap
BitBlt
ExtSelectClipRgn
GetStockObject
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueA
shell32
ShellExecuteA
ExtractIconExA
comctl32
ImageList_GetIconSize
ImageList_DrawEx
_TrackMouseEvent
ImageList_AddMasked
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_Draw
ImageList_Destroy
ImageList_GetImageCount
ImageList_SetBkColor
msvcp60
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Xran@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??_7out_of_range@std@@6B@
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
Sections
.text Size: 288KB - Virtual size: 284KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ