Static task
static1
Behavioral task
behavioral1
Sample
6541cbe2119a364234ab5d98a1c54709.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6541cbe2119a364234ab5d98a1c54709.exe
Resource
win10v2004-20231215-en
General
-
Target
6541cbe2119a364234ab5d98a1c54709
-
Size
415KB
-
MD5
6541cbe2119a364234ab5d98a1c54709
-
SHA1
cd5b101bcdfabfedce9e25eaa7a399df98b72a68
-
SHA256
9081296eb6d1325f668122ae53161b0bc5186add8a22ae75a5ab13aa78974292
-
SHA512
7c9d2d7a0f7646d6f365e7151a039a5ae0c71fdbc9ccef5f6e964b14c8243d836576c810334fa43d67e1f8eb163ab77715f6612bb82cb40bf1b4c38a828efd8a
-
SSDEEP
6144:kgwIfdUopdYFyRjunPFgfmL5V/rKBu8127gEcecLJyQjOZypq5XgcinyhxBPo:z+sinPFmmLvDKG7TcFy4o5Xu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6541cbe2119a364234ab5d98a1c54709
Files
-
6541cbe2119a364234ab5d98a1c54709.exe windows:6 windows x64 arch:x64
81a88a0afcd662baae8f86e9b596f79d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
TraceEvent
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
RegEnumKeyW
RegEnumValueW
CryptReleaseContext
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegNotifyChangeKeyValue
kernel32
HeapDestroy
GetVersionExA
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
GetModuleHandleW
InitializeCriticalSection
LoadLibraryW
VirtualFree
InterlockedPopEntrySList
VirtualAlloc
InterlockedPushEntrySList
GetStartupInfoW
SetUnhandledExceptionFilter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
OutputDebugStringA
WaitForMultipleObjects
ExpandEnvironmentStringsW
GlobalFree
GetTempFileNameW
CreateFileW
WriteFile
SizeofResource
GetModuleFileNameW
MultiByteToWideChar
lstrlenW
RaiseException
GetLastError
GetProcAddress
lstrcmpiW
HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
GetCommandLineW
CloseHandle
WaitForSingleObject
Sleep
HeapSetInformation
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
SetLastError
GetCurrentProcess
FlushInstructionCache
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
LockResource
FindResourceExW
OutputDebugStringW
GetTempPathW
GetVersionExW
GetTickCount
GetUserDefaultUILanguage
InitializeCriticalSectionAndSpinCount
RegisterApplicationRestart
QueryPerformanceCounter
QueryPerformanceFrequency
SetEvent
GetFileAttributesExW
CompareStringW
CreateProcessW
HeapSize
DeleteCriticalSection
CreateEventW
gdi32
GetStockObject
GetObjectW
GetDeviceCaps
DeleteDC
DeleteObject
SelectObject
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC
BitBlt
user32
GetClassNameW
IsWindow
SendMessageW
GetDlgItem
GetWindow
SetFocus
GetFocus
IsChild
EndPaint
BeginPaint
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
GetSysColor
LoadIconW
SetForegroundWindow
CreateWindowExW
SetTimer
GetPropW
KillTimer
RemovePropW
SetWindowPos
LoadBitmapW
GetKeyboardLayout
UnregisterClassW
EnumThreadWindows
AllowSetForegroundWindow
DestroyAcceleratorTable
RedrawWindow
GetClassInfoExW
DestroyWindow
SystemParametersInfoW
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
GetClientRect
InvalidateRect
InvalidateRgn
CallWindowProcW
CharNextW
FillRect
GetDC
GetDesktopWindow
ReleaseDC
GetKeyboardLayoutList
UnregisterClassA
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassExW
LoadCursorW
DefWindowProcW
SetWindowLongW
GetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
SetPropW
msvcrt
wcscat_s
wcscpy_s
_wcsicmp
wcschr
_wcsnicmp
_beginthreadex
_itow
memcmp
memcpy
vswprintf_s
swprintf_s
iswspace
memmove_s
wcsstr
??2@YAPEAX_K@Z
memcpy_s
_purecall
??_V@YAXPEAX@Z
malloc
free
??_U@YAPEAX_K@Z
wcsncpy_s
_vscwprintf
_endthreadex
_vsnwprintf
__CxxFrameHandler3
??3@YAXPEAX@Z
memset
__C_specific_handler
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
realloc
_errno
??1type_info@@UEAA@XZ
_unlock
__dllonexit
_lock
_onexit
qsort
_CxxThrowException
dui70
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
UnInitThread
InitThread
?EraseBkgnd@HWNDHost@DirectUI@@MEAA_NPEAUHDC__@@PEA_J@Z
?SetWindowDirection@HWNDHost@DirectUI@@UEAAXPEAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UEAAHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UEAAX_KPEBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnSysChar@HWNDHost@DirectUI@@UEAA_NG@Z
?OnMessage@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?OnNotify@HWNDHost@DirectUI@@UEAA_NI_K_JPEA_J@Z
?GetHWND@HWNDHost@DirectUI@@UEAAPEAUHWND__@@XZ
?DefaultAction@Element@DirectUI@@UEAAJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UEAA_NXZ
?OnUnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MEAAXPEAVElement@2@@Z
?MessageCallback@HWNDHost@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UEAAXXZ
?Paint@HWNDHost@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UEAAXXZ
?OnInput@HWNDHost@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
??0HWNDHost@DirectUI@@QEAA@XZ
?GetClassInfoPtr@HWNDHost@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@HWNDHost@DirectUI@@QEAAJIIPEAVElement@2@PEAK@Z
?Register@HWNDHost@DirectUI@@SAJXZ
?SetAccDesc@Element@DirectUI@@QEAAJPEBG@Z
CreateDUIWrapper
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?IsDescendent@Element@DirectUI@@QEAA_NPEAV12@@Z
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
??1HWNDHost@DirectUI@@UEAA@XZ
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ
?OnReset@TaskPage@DirectUI@@MEAA_JXZ
?OnKillActive@TaskPage@DirectUI@@MEAA_JXZ
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z
?GetPageResID@TaskPage@DirectUI@@MEAAPEBGXZ
?GetPageRCID@TaskPage@DirectUI@@MEAAIXZ
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?DestroyAll@Element@DirectUI@@QEAAJ_N@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?SetHeight@Element@DirectUI@@QEAAJH@Z
?SetWidth@Element@DirectUI@@QEAAJH@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetExpanded@Expandable@DirectUI@@QEAAJ_N@Z
?Click@Button@DirectUI@@SA?AVUID@@XZ
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@P6APEBUPropertyInfo@2@XZHPEAUUpdateCache@2@@Z
?GetChildren@Element@DirectUI@@QEAAPEAV?$DynamicArray@PEAVElement@DirectUI@@$0A@@2@PEAPEAVValue@2@@Z
?SetDataEntry@PText@DirectUI@@QEAAXPEAUIDataEntry@2@@Z
?EndDefer@Element@DirectUI@@QEAAXK@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
??0TaskPage@DirectUI@@QEAA@XZ
??1TaskPage@DirectUI@@UEAA@XZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z
??1IDataEntry@DirectUI@@UEAA@XZ
??0IDataEntry@DirectUI@@QEAA@XZ
StrToID
UnInitProcessPriv
InitProcessPriv
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UEBAXXZ
?GetChildren@ClassInfoBase@DirectUI@@UEBAHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UEAAXXZ
?AddChild@ClassInfoBase@DirectUI@@UEAAXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UEBA_NXZ
?GetModule@ClassInfoBase@DirectUI@@UEBAPEAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UEBA_NPEAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UEBA_NPEBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UEBAPEBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UEBAIXZ
?GetPICount@ClassInfoBase@DirectUI@@UEBAIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UEAAPEBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UEAAHXZ
?AddRef@ClassInfoBase@DirectUI@@UEAAXXZ
?OnReceivedDialogFocus@Button@DirectUI@@UEAA_NPEAVDialogElement@2@@Z
?OnLostDialogFocus@Button@DirectUI@@UEAA_NPEAVDialogElement@2@@Z
?HandleUiaEventListener@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UEAAXXZ
?GetElementProviderImpl@Element@DirectUI@@UEAAJPEAVInvokeHelper@2@PEAPEAVElementProvider@2@@Z
?DefaultAction@Button@DirectUI@@UEAAJXZ
?GetAccessibleImpl@Element@DirectUI@@UEAAJPEAPEAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UEAA_NXZ
?RemoveTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?UpdateTooltip@Element@DirectUI@@MEAAXPEAV12@@Z
?OnUnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?OnHosted@Element@DirectUI@@MEAAXPEAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MEAAXHH@Z
?QueryInterface@Element@DirectUI@@UEAAJAEBU_GUID@@PEAPEAX@Z
?MessageCallback@Element@DirectUI@@UEAAIPEAUtagGMSG@@@Z
?SetKeyFocus@Element@DirectUI@@UEAAXXZ
?EnsureVisible@Element@DirectUI@@UEAA_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UEAAPEAV12@PEAV12@HPEBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Insert@Element@DirectUI@@UEAAJPEAPEAV12@II@Z
?Add@Element@DirectUI@@UEAAJPEAPEAV12@I@Z
?Paint@Element@DirectUI@@UEAAXPEAUHDC__@@PEBUtagRECT@@1PEAU4@2@Z
?OnEvent@Element@DirectUI@@UEAAXPEAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UEAAXXZ
?OnMouseFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UEAAXPEAV12@0@Z
?OnInput@Button@DirectUI@@UEAAXPEAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UEAAXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UEAAXPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEAUPropertyInfo@2@HPEAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UEAA_NPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UEAAPEBGPEAPEAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UEAA_NXZ
?IsRTLReading@Element@DirectUI@@UEAA_NXZ
??1ClassInfoBase@DirectUI@@UEAA@XZ
??0ClassInfoBase@DirectUI@@QEAA@XZ
?GetClassInfoPtr@Button@DirectUI@@SAPEAUIClassInfo@2@XZ
?Initialize@Button@DirectUI@@QEAAJIPEAVElement@2@PEAK@Z
?Initialize@ClassInfoBase@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG_NPEBQEBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QEAAJXZ
?ClassExist@ClassInfoBase@DirectUI@@SA_NPEAPEAUIClassInfo@2@PEBQEBUPropertyInfo@2@IPEAU32@PEAUHINSTANCE__@@PEBG_N@Z
??1CritSecLock@DirectUI@@QEAA@XZ
??0Button@DirectUI@@QEAA@XZ
??1Button@DirectUI@@UEAA@XZ
?BackgroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?Release@Value@DirectUI@@QEAAXXZ
?ForegroundProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?GetContentSize@Element@DirectUI@@UEAA?AUtagSIZE@@HHPEAVSurface@2@@Z
?GetHeight@Element@DirectUI@@QEAAHXZ
?GetWidth@Element@DirectUI@@QEAAHXZ
?AddRef@Value@DirectUI@@QEAAXXZ
?GetValue@Element@DirectUI@@QEAAPEAVValue@2@PEBUPropertyInfo@2@HPEAUUpdateCache@2@@Z
ColorFromEnumI
GetThemeHandle
?OnPropertyChanged@Button@DirectUI@@UEAAXPEBUPropertyInfo@2@HPEAVValue@2@1@Z
?ActivateTooltip@Element@DirectUI@@MEAAXPEAV12@K@Z
?Register@Button@DirectUI@@SAJXZ
??0CritSecLock@DirectUI@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
?GetFactoryLock@Element@DirectUI@@SAPEAU_RTL_CRITICAL_SECTION@@XZ
comctl32
ord345
PropertySheetW
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
ole32
CoReleaseMarshalData
CoMarshalInterThreadInterfaceInStream
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoUninitialize
OleInitialize
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
CoGetInterfaceAndReleaseStream
OleUninitialize
CoInitializeEx
CoRevokeClassObject
CoResumeClassObjects
CoRegisterClassObject
StringFromGUID2
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoSuspendClassObjects
StringFromCLSID
OleLockRunning
oleaut32
SysFreeString
UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
VarBstrCmp
OleCreateFontIndirect
LoadRegTypeLi
SysStringByteLen
VariantClear
VariantInit
SysAllocStringLen
VariantCopy
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringByteLen
SafeArrayGetVartype
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
VariantChangeType
SafeArrayCreate
VarUI4FromStr
shlwapi
StrCmpW
SHRegGetValueW
PathFileExistsW
uxtheme
CloseThemeData
OpenThemeData
GetThemeColor
shell32
ShellExecuteW
wer
WerReportSetParameter
WerReportCloseHandle
WerReportSubmit
WerReportCreate
WerReportAddFile
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
EtwLogTraceEvent
Sections
.text Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE