Static task
static1
Behavioral task
behavioral1
Sample
65168ba41f4064f71acdb207582403a3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
65168ba41f4064f71acdb207582403a3.exe
Resource
win10v2004-20231215-en
General
-
Target
65168ba41f4064f71acdb207582403a3
-
Size
7.3MB
-
MD5
65168ba41f4064f71acdb207582403a3
-
SHA1
97c106cd58723fab602f92ee27d34f896b6280ba
-
SHA256
f099247d9bbbc5d8b2cee7ec6104e08f28e23a6d3fa91de0dd3f8c5acff1cd68
-
SHA512
4b9dc7d413bbe2d8401d6a4c2858765be1341d9b96f26d9990cbbda83fb39d29e6c94b4971c48996f9eb4e96a4f00ab0e8cbf482edd2a53549b815d71c52ac97
-
SSDEEP
49152:mVvUoHN6Ngj7RnRdE/vAvUhzdGrR6ZqxozVRRFXfcGHSD3FGVvVJg29N/caPl8yR:R6lEA0GrR69rBSDVGV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 65168ba41f4064f71acdb207582403a3
Files
-
65168ba41f4064f71acdb207582403a3.exe windows:6 windows x86 arch:x86
8272dd5401862e63b04d784d99d3c753
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc120u
ord14057
ord6206
ord8333
ord12867
ord8697
ord3089
ord14301
ord10970
ord3296
ord11206
ord1733
ord4083
ord2025
ord4990
ord4995
ord3091
ord6179
ord13076
ord12023
ord3974
ord2630
ord8688
ord14175
ord8027
ord13340
ord11043
ord8883
ord8837
ord3188
ord3314
ord2576
ord2071
ord11011
ord3024
ord9172
ord8878
ord8836
ord8843
ord12547
ord13347
ord3973
ord4466
ord11145
ord14158
ord3310
ord12698
ord8270
ord8359
ord13174
ord7944
ord7945
ord7973
ord12522
ord12487
ord6371
ord8573
ord8566
ord3537
ord798
ord8576
ord8577
ord8581
ord3778
ord12743
ord5742
ord5701
ord13178
ord12608
ord2659
ord12747
ord7787
ord14255
ord12097
ord8727
ord11242
ord10243
ord11765
ord8968
ord8987
ord2614
ord4138
ord4151
ord2207
ord1717
ord9865
ord9387
ord9392
ord9402
ord8746
ord4670
ord2052
ord4226
ord3288
ord9263
ord4328
ord8904
ord1942
ord14033
ord2617
ord8819
ord12842
ord8308
ord14114
ord6438
ord12993
ord4869
ord4862
ord1719
ord12050
ord8057
ord8222
ord8100
ord7006
ord8107
ord5063
ord5341
ord2652
ord4353
ord4005
ord8875
ord8820
ord14058
ord8321
ord12854
ord14300
ord11630
ord11202
ord2592
ord4069
ord4000
ord8025
ord8881
ord8838
ord14221
ord11010
ord3022
ord11359
ord9547
ord8835
ord3971
ord4464
ord14156
ord3125
ord3124
ord3298
ord7774
ord2643
ord14111
ord5343
ord2501
ord3588
ord4006
ord3991
ord14333
ord13128
ord8440
ord3090
ord14163
ord4139
ord2056
ord11603
ord14142
ord13186
ord2720
ord2742
ord11472
ord1648
ord8599
ord7303
ord12958
ord13907
ord7001
ord14039
ord8702
ord3821
ord2948
ord9349
ord5119
ord12893
ord13983
ord12890
ord13972
ord8763
ord13975
ord13554
ord13149
ord12966
ord12738
ord12824
ord12449
ord12429
ord13635
ord13121
ord6431
ord13987
ord6763
ord7704
ord12633
ord4182
ord9013
ord5887
ord6492
ord1177
ord7271
ord911
ord1403
ord7515
ord11208
ord11810
ord10881
ord12091
ord10902
ord8923
ord8858
ord11116
ord10451
ord11050
ord11807
ord11808
ord11809
ord6212
ord10025
ord10028
ord10032
ord7542
ord993
ord1468
ord13108
ord7881
ord2265
ord2163
ord4416
ord13771
ord8344
ord7830
ord7883
ord7908
ord13937
ord7565
ord7199
ord366
ord1069
ord11902
ord2280
ord4547
ord1873
ord9089
ord11267
ord6759
ord12799
ord10314
ord12122
ord6252
ord14527
ord6253
ord14528
ord6251
ord14526
ord7884
ord12402
ord14326
ord11858
ord11857
ord1992
ord7825
ord12818
ord4047
ord4109
ord9279
ord14454
ord7806
ord14448
ord12413
ord12412
ord2444
ord5262
ord8206
ord12736
ord8268
ord8352
ord8343
ord2759
ord12878
ord11768
ord14076
ord8855
ord8361
ord14168
ord12454
ord921
ord1406
ord362
ord1065
ord3317
ord3195
ord6702
ord1400
ord8636
ord281
ord2823
ord3754
ord3761
ord13115
ord13118
ord7060
ord7398
ord5082
ord13197
ord5360
ord6228
ord5299
ord3651
ord12510
ord277
ord291
ord1683
ord3911
ord1521
ord4196
ord3324
ord3218
ord9019
ord6020
ord6743
ord1449
ord14458
ord7033
ord7394
ord514
ord1148
ord633
ord1236
ord751
ord1297
ord776
ord1314
ord5661
ord9183
ord4813
ord3194
ord2336
ord12219
ord14463
ord12276
ord14516
ord11977
ord786
ord4428
ord13302
ord7200
ord7203
ord8409
ord7206
ord7201
ord13334
ord7204
ord7205
ord7207
ord13854
ord7202
ord14517
ord8280
ord11338
ord11249
ord923
ord8775
ord9056
ord12052
ord12331
ord1746
ord11305
ord5858
ord9233
ord11675
ord7020
ord3182
ord3181
ord6643
ord1342
ord3736
ord6968
ord3829
ord2951
ord8626
ord4179
ord3105
ord9009
ord6400
ord1067
ord460
ord6997
ord9299
ord2484
ord2214
ord4842
ord365
ord4048
ord7545
ord13915
ord2363
ord9294
ord357
ord4606
ord8821
ord3129
ord1301
ord290
ord7272
ord7516
ord10379
ord9106
ord3012
ord9134
ord12092
ord3196
ord2552
ord501
ord1140
ord6128
ord4050
ord6219
ord494
ord7023
ord7220
ord5418
ord12655
ord492
ord1138
ord1408
ord12513
ord14237
ord1966
ord926
ord6706
ord6752
ord1459
ord7536
ord3650
ord3321
ord3212
ord6731
ord1437
ord10283
ord11370
ord4544
ord3800
ord5274
ord11670
ord8713
ord5841
ord13567
ord5842
ord13569
ord6033
ord4944
ord4943
ord3132
ord8091
ord11956
ord4452
ord2515
ord9118
ord13560
ord5837
ord9094
ord14265
ord13404
ord3765
ord1685
ord13824
ord1445
ord971
ord4984
ord8594
ord8242
ord4839
ord14129
ord5285
ord12136
ord3556
ord2318
ord8639
ord278
ord6434
ord13997
ord7382
ord458
ord8601
ord6402
ord5865
ord12047
ord10895
ord8920
ord4838
ord4063
ord903
ord5027
ord12430
ord2130
ord4621
msvcr120
_libm_sse2_sin_precise
_libm_sse2_sqrt_precise
_libm_sse2_tan_precise
ceil
_libm_sse2_pow_precise
floor
__CxxFrameHandler3
_CxxThrowException
_CIcosh
_CIfmod
_CIsinh
_CItanh
_libm_sse2_acos_precise
_libm_sse2_asin_precise
_libm_sse2_atan_precise
_libm_sse2_cos_precise
_libm_sse2_log10_precise
memcpy
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
memset
_wtoi
exit
_wsystem
_exit
wcscpy_s
_wtof
realloc
_mktime64
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
fgetc
ungetc
fwrite
fputc
_unlock_file
_lock_file
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
rand
srand
wcsftime
calloc
swprintf_s
free
_resetstkoflw
malloc
_recalloc
wcsnlen
_purecall
memmove
_localtime64_s
_time64
memcpy_s
_libm_sse2_log_precise
kernel32
GetCommState
SetupComm
GetOverlappedResult
ClearCommError
LoadLibraryW
FreeLibrary
TransmitCommChar
GetCommConfig
SetCommConfig
SetCommBreak
ClearCommBreak
GetDefaultCommConfigW
EscapeCommFunction
GetCommProperties
GetCommModemStatus
SetCommMask
GetCommMask
FlushFileBuffers
GetCommTimeouts
WaitCommEvent
DecodePointer
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileW
WriteFile
ReadFile
SetCommTimeouts
SetCommState
GetModuleHandleW
GetProcAddress
Beep
Process32NextW
CreateToolhelp32Snapshot
GetCurrentProcess
GetProcessId
CloseHandle
WaitForSingleObject
CreateProcessW
SetCurrentDirectoryW
FindClose
FindNextFileW
FileTimeToLocalFileTime
GetCurrentThreadId
FileTimeToSystemTime
FindFirstFileW
GetCurrentDirectoryW
lstrcpyW
LocalFree
FormatMessageW
lstrlenW
LocalAlloc
OutputDebugStringW
lstrlenA
MultiByteToWideChar
InitializeCriticalSectionEx
GetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
lstrcpynW
WideCharToMultiByte
ResumeThread
PurgeComm
user32
GetWindowRect
GetSystemMetrics
SetRect
SendMessageW
GetSubMenu
LoadMenuW
EqualRect
TrackPopupMenuEx
AppendMenuW
CreatePopupMenu
GetKeyState
RedrawWindow
ClientToScreen
UpdateWindow
EnumWindows
SetForegroundWindow
ShowWindow
GetWindowTextW
GetWindowThreadProcessId
PostMessageW
OffsetRect
EnableWindow
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetSysColor
ScreenToClient
SetRectEmpty
GetParent
FillRect
InflateRect
DrawIcon
IsIconic
LoadIconW
GetDC
KillTimer
PtInRect
CopyRect
LoadBitmapW
GetGUIThreadInfo
GetActiveWindow
IsWindowVisible
PostQuitMessage
SetCursor
SetTimer
GetClientRect
GetCursorPos
LoadCursorW
IsWindow
InvalidateRect
gdi32
GetDeviceCaps
Rectangle
CreateDCW
GetCurrentObject
EndDoc
CreateFontW
Escape
ExtTextOutW
TextOutW
StartPage
PtVisible
GetPixel
SetBkColor
GetStockObject
CreateHatchBrush
CreateSolidBrush
DPtoLP
CreatePen
Pie
EndPage
GetTextExtentPoint32W
StretchBlt
CreateDIBSection
SetDIBColorTable
DeleteDC
DeleteObject
RectVisible
CreateCompatibleBitmap
RoundRect
Ellipse
BitBlt
CreateCompatibleDC
GetObjectW
SelectObject
advapi32
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
Shell_NotifyIconW
comctl32
ImageList_AddMasked
InitCommonControlsEx
shlwapi
StrCpyW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromProgID
OleRun
oleaut32
GetErrorInfo
SysStringLen
SysFreeString
VariantChangeType
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocStringByteLen
SysStringByteLen
SysAllocString
VariantInit
VariantCopy
VariantClear
gdiplus
GdipAddPathRectangle
GdipAddPathEllipse
GdipRotateMatrix
GdipGetPathLastPoint
GdipAddPathPolygon
GdipScaleMatrix
GdipFillEllipse
GdipCreateLineBrushFromRect
GdipSetPathGradientBlend
GdipTransformPath
GdipCreateSolidFill
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipSetSmoothingMode
GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipSetWorldTransform
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipClonePath
GdipSetPathGradientFocusScales
GdipSetPathGradientLinearBlend
GdipGetPathGradientPointCount
GdipSetPathGradientSurroundColorsWithCount
GdipSetPathGradientCenterColor
GdipSetPathGradientCenterPointI
GdipCreatePathGradientFromPath
GdipAddPathPath
GdipSetLinePresetBlend
GdipCreateLineBrushFromRectI
GdipFillPath
GdipCloneBrush
GdipDeleteBrush
GdipDeletePath
GdipCreatePath
GdipClosePathFigure
GdipAddPathArcI
GdipResetPath
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipDisposeImage
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipDrawImageI
GdiplusStartup
GdipGetImageDecodersSize
GdipGetImageDecoders
GdiplusShutdown
GdipResetWorldTransform
msvcp120
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Winerror_map@std@@YAPBDH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_BADOFF@std@@3_JB
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 15.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 280KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ