Static task
static1
Behavioral task
behavioral1
Sample
sc_2.exe
Resource
win10v2004-20231215-en
General
-
Target
sc_2.exe
-
Size
1.5MB
-
MD5
6c0f26788a21b6aeb5d5b8df2bd7a104
-
SHA1
27e7dc1e53461032360b3a66d6f146a7e2537f18
-
SHA256
47bbd28a10e11e3199a72f15d84f62de5100b2c3055e6b4c89f05744fe8fd287
-
SHA512
7daaa89fab18161e65b30b6c3edf98114f09ff1951e29729c3f89581e2ecfd6ee01219a555148732009a5cad95784aab2c81ac3af1ab3e96d473ca50266f6e56
-
SSDEEP
24576:jjbysRpYBSSLINLOg56JNw+5oS9Y5HGScipOzpO546BItm1MB1vc3nXQIomN:jvhYBRl3+4EXzeO54k1ManXQD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sc_2.exe
Files
-
sc_2.exe.exe windows:6 windows x64 arch:x64
17d139529248975a7afde64a0bc64071
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetSystemWindowsDirectoryW
Wow64DisableWow64FsRedirection
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
GetWindowsDirectoryW
GetFullPathNameW
Thread32Next
Thread32First
OpenProcess
CreateToolhelp32Snapshot
QueueUserAPC
Module32FirstW
Module32NextW
VirtualFreeEx
OpenThread
WaitForSingleObject
GetBinaryTypeW
GetWriteWatch
ResetWriteWatch
GlobalGetAtomNameW
HeapQueryInformation
ReadProcessMemory
IsDebuggerPresent
CreateRemoteThread
RaiseException
SetUnhandledExceptionFilter
CheckRemoteDebuggerPresent
OutputDebugStringW
GetSystemInfo
QueryDosDeviceW
GetModuleHandleExW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
GetSystemDirectoryW
K32GetModuleInformation
K32GetMappedFileNameW
VirtualQuery
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleTitleA
lstrlenW
FormatMessageW
LocalSize
GetComputerNameW
AddVectoredExceptionHandler
GetCurrentThread
CreateEventW
SetEvent
SwitchToThread
LoadLibraryW
QueryInformationJobObject
GetFileAttributesW
Process32NextW
Process32FirstW
LocalAlloc
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
ResetEvent
InitializeCriticalSectionAndSpinCount
GetFileInformationByHandleEx
AreFileApisANSI
GetFileAttributesExW
FindFirstFileW
FindClose
GetLocaleInfoEx
GlobalMemoryStatusEx
GetComputerNameExW
GetFileSizeEx
GetDiskFreeSpaceExW
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
LocalFree
FormatMessageA
SetLastError
VerifyVersionInfoA
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
QueryFullProcessImageNameW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
VirtualProtect
CreateThread
GetCurrentProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
AllocConsole
SetThreadContext
lstrcpyW
GetConsoleWindow
CreateProcessW
VirtualAllocEx
GetThreadContext
lstrcatW
GetLastError
ResumeThread
GetEnvironmentVariableW
GetModuleFileNameW
TerminateProcess
GetShortPathNameW
WriteProcessMemory
GetModuleFileNameA
CreateDirectoryW
QueryPerformanceCounter
VerifyVersionInfoW
FreeLibrary
GetModuleHandleW
VerSetConditionMask
QueryPerformanceFrequency
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetTempPathW
Sleep
GetCurrentProcessId
GetProcAddress
CloseHandle
GetModuleHandleA
GetCurrentThreadId
CreateFileW
VirtualAlloc
DeviceIoControl
RemoveVectoredExceptionHandler
VirtualFree
user32
DestroyWindow
GetKeyState
AdjustWindowRectEx
DefWindowProcW
GetWindowLongW
UpdateWindow
MessageBoxA
SetClipboardData
SetWindowTextW
UnregisterClassW
CloseClipboard
SetWindowsHookExW
GetWindowThreadProcessId
GetShellWindow
FindWindowW
GetWindowRect
MessageBoxW
GetSystemMetrics
DispatchMessageW
PeekMessageW
BlockInput
TranslateMessage
PostQuitMessage
GetDesktopWindow
RegisterClassExW
WindowFromPoint
ShowWindow
GetCapture
GetMonitorInfoW
ClientToScreen
IsChild
GetForegroundWindow
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
LoadCursorW
SetCapture
SetCursor
SetWindowLongW
GetClientRect
ScreenToClient
EnumDisplayMonitors
OpenClipboard
GetCursorPos
ReleaseDC
CreateWindowExW
SetCursorPos
IsIconic
SetForegroundWindow
ReleaseCapture
SetWindowPos
MonitorFromWindow
EmptyClipboard
GetClipboardData
GetDC
gdi32
GetDeviceCaps
GetObjectW
DeleteDC
GetBitmapBits
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteObject
advapi32
RegCreateKeyW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
EnumServicesStatusExW
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
GetUserNameW
RegQueryValueExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
OpenProcessToken
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenServiceW
RegSetKeyValueW
RegCloseKey
RegOpenKeyW
shell32
SHGetSpecialFolderPathW
ShellExecuteA
ShellExecuteW
ole32
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoUninitialize
oleaut32
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SysFreeString
SafeArrayGetElement
SafeArrayGetUBound
SysAllocString
msvcp140
?_Xinvalid_argument@std@@YAXPEBD@Z
_Equivalent
_To_wide
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPEBD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?_Winerror_map@std@@YAHH@Z
?_Throw_C_error@std@@YAXH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Random_device@std@@YAIXZ
?_Syserror_map@std@@YAPEBDH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
_Query_perf_counter
_Thrd_detach
_Xtime_get_ticks
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
ntdll
RtlInitUnicodeString
NtQuerySystemInformation
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemoryEx
normaliz
IdnToAscii
wldap32
ord45
ord60
ord211
ord41
ord46
ord50
ord217
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord301
ord22
ord143
crypt32
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
ws2_32
closesocket
recv
WSAGetLastError
bind
connect
ntohl
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
getpeername
gethostname
WSAIoctl
WSASetLastError
getsockname
socket
setsockopt
ntohs
htons
getsockopt
send
shlwapi
StrChrW
PathCombineW
StrStrIW
PathRemoveExtensionW
PathFindFileNameW
StrCmpW
StrCmpNIW
StrCmpIW
PathGetDriveNumberW
wnsprintfW
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
mpr
WNetGetProviderNameW
iphlpapi
GetAdaptersInfo
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
powrprof
GetPwrCapabilities
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
memchr
memcmp
memmove
strrchr
__C_specific_handler
memcpy
__current_exception_context
memset
strchr
strstr
__std_terminate
wcsstr
__std_exception_destroy
__current_exception
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
ungetc
fflush
_wfopen_s
fclose
__stdio_common_vsscanf
fsetpos
__stdio_common_vfwprintf
__acrt_iob_func
fread
_pclose
__stdio_common_vswprintf_s
_fseeki64
feof
_get_stream_buffer_pointers
_lseeki64
_popen
__stdio_common_vsprintf
fputc
fopen
fgets
ftell
_set_fmode
fopen_s
fputs
_wfopen
setvbuf
__p__commode
__stdio_common_vswprintf
fgetpos
fgetc
_read
_write
_close
_open
fwrite
fseek
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
malloc
realloc
_callnewh
free
calloc
_set_new_mode
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-filesystem-l1-1-0
_stat64
_lock_file
rename
_fstat64
_access
_unlink
_wremove
remove
_unlock_file
api-ms-win-crt-string-l1-1-0
toupper
strncpy
_strdup
tolower
strpbrk
strcmp
strcspn
strspn
isupper
_wcsicmp
isxdigit
strtok_s
strncmp
_stricmp
api-ms-win-crt-time-l1-1-0
strftime
_time64
_wasctime_s
_localtime64_s
_gmtime64
api-ms-win-crt-runtime-l1-1-0
exit
_invalid_parameter_noinfo_noreturn
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_exit
strerror
_initterm_e
_initterm
__sys_nerr
_invalid_parameter_noinfo
terminate
_resetstkoflw
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
system
_getpid
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex
api-ms-win-crt-convert-l1-1-0
strtoul
strtol
strtoull
strtod
strtoll
atoi
_wcstoui64_l
api-ms-win-crt-math-l1-1-0
_dsign
sqrtf
acosf
_dclass
ceilf
__setusermatherr
cosf
fmodf
sinf
api-ms-win-crt-locale-l1-1-0
_get_current_locale
_configthreadlocale
___lc_codepage_func
localeconv
Sections
.text Size: 998KB - Virtual size: 998KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 374KB - Virtual size: 373KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 111KB - Virtual size: 115KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ