Static task
static1
Behavioral task
behavioral1
Sample
6fb5e20375555e0ef0a04828844bd98b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6fb5e20375555e0ef0a04828844bd98b.exe
Resource
win10v2004-20231215-en
General
-
Target
6fb5e20375555e0ef0a04828844bd98b
-
Size
416KB
-
MD5
6fb5e20375555e0ef0a04828844bd98b
-
SHA1
16f984fab2d7afe633ef06ff75829b8d4898232e
-
SHA256
b2e09b3f5169cfd01ef6e2e813a06faaaaab2dd44fd9700e05f95e1b8ad66cee
-
SHA512
4654b0781278b497f3ec998a19c4c9d5289ca7743a06215742df963c908d71d0cab4bcbabe312ce655b906e4cf542c8510ce3349f910be2e33b128d717ddafc3
-
SSDEEP
12288:lA4dZUXepPH5fqx4MsCq/1HtfAQELQgYlD4Cv:SYbPH5yx4Vf2LQgYlD4Cv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6fb5e20375555e0ef0a04828844bd98b
Files
-
6fb5e20375555e0ef0a04828844bd98b.exe windows:4 windows x86 arch:x86
30911c7a111ae2d48655e611fc365171
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
shlwapi
PathCombineA
PathFileExistsA
PathIsURLA
PathFindFileNameA
PathRemoveFileSpecA
PathRenameExtensionA
PathFindExtensionA
PathRemoveBackslashA
kernel32
GetACP
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetTempFileNameA
GetCurrentThreadId
lstrcmpiA
CopyFileA
CreateThread
GetLastError
LocalFree
FormatMessageA
Sleep
ExitProcess
GetModuleHandleA
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryA
DeleteFileA
GetTempPathA
GetLocaleInfoA
GetThreadLocale
GetVersionExA
CreateDirectoryA
user32
CheckDlgButton
IsWindowVisible
MessageBoxA
GetDC
CallNextHookEx
TranslateAcceleratorA
EndDialog
UnhookWindowsHookEx
CreateWindowExW
SetDlgItemTextA
SetWindowTextA
SendMessageA
LoadIconA
DialogBoxParamA
ShowWindow
EnableWindow
GetDlgItem
RemoveMenu
GetMenu
SetWindowsHookExA
DestroyAcceleratorTable
LoadAcceleratorsA
GetDlgItemTextA
IsDlgButtonChecked
GetDlgItemInt
SetWindowPos
SetWindowLongA
GetWindowLongA
EndPaint
GetClientRect
BeginPaint
CallWindowProcA
InvalidateRect
GetWindowRect
KillTimer
SetTimer
GetDesktopWindow
CreateDialogParamA
DestroyWindow
SetFocus
SendDlgItemMessageA
ole32
CoUninitialize
CoInitialize
CoGetClassObject
OleSetContainedObject
msvcp71
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?eof@?$char_traits@D@std@@SAHXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Xran@_String_base@std@@QBEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?clear@ios_base@std@@QAEXH_N@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AVconst_iterator@12@XZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AVconst_iterator@12@XZ
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?_Nomemory@std@@YAXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
msvcr71
isalnum
isalpha
tolower
strncmp
malloc
_snprintf
fgetc
fputc
calloc
_setjmp3
longjmp
_iob
_CIpow
exit
getenv
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__dllonexit
_onexit
?terminate@@YAXXZ
_controlfp
fputs
fprintf
fgets
_purecall
??_V@YAXPAX@Z
strchr
strtod
strtol
isspace
isdigit
memmove
fseek
ftell
fread
sscanf
??0exception@@QAE@XZ
??1exception@@UAE@XZ
free
vsprintf
_CxxThrowException
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
_rmdir
sprintf
_mkdir
_except_handler3
fopen
fwrite
fclose
??3@YAXPAX@Z
_strcmpi
_stricmp
_strnicmp
memset
ws2_32
WSACleanup
WSAStartup
htonl
htons
ntohs
inet_ntoa
WSAGetLastError
closesocket
socket
bind
listen
gethostbyaddr
gethostbyname
getsockname
accept
connect
send
select
recv
gdi32
CreateDIBSection
CreateSolidBrush
GetStockObject
SelectObject
Rectangle
DeleteObject
CreateCompatibleDC
BitBlt
DeleteDC
comdlg32
GetOpenFileNameA
GetSaveFileNameA
ChooseColorA
shell32
ShellExecuteExW
ShellExecuteExA
oleaut32
SysFreeString
SysAllocStringLen
Sections
.text Size: 304KB - Virtual size: 300KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 731KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.urbrd Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE