Static task
static1
Behavioral task
behavioral1
Sample
85962b040feaffb4ef5e32374e652ec0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
85962b040feaffb4ef5e32374e652ec0.exe
Resource
win10v2004-20231215-en
General
-
Target
85962b040feaffb4ef5e32374e652ec0
-
Size
469KB
-
MD5
85962b040feaffb4ef5e32374e652ec0
-
SHA1
9ddac701800046873bbb398ba8baeea41f5c1df5
-
SHA256
c1e24c486ffefbf3220c14f84396d8d56a8ea76a240326bb1f16374293af7b39
-
SHA512
76dd602baf594badb2852ca3001cc5caed4e49a5e5906e0c0bfb05c403ca080b92d83b836658ca229cb097762f8631e42e4fa18343327e7e9bebef31a346d17a
-
SSDEEP
12288:NJCEZG5knWcrLoatusuX7m1OkPD8cuaT:NJCEZG5knRQCusH15PD8cuaT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85962b040feaffb4ef5e32374e652ec0
Files
-
85962b040feaffb4ef5e32374e652ec0.exe windows:4 windows x86 arch:x86
6ca668e8e634d95ac0393f0b04d03686
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4277
ord5683
ord2621
ord1134
ord2107
ord5450
ord5440
ord6383
ord6394
ord5265
ord4376
ord4853
ord4998
ord4710
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord4234
ord2625
ord1168
ord6199
ord4160
ord2379
ord755
ord470
ord3237
ord1113
ord3258
ord1114
ord6453
ord2065
ord1106
ord5207
ord2864
ord939
ord6883
ord1948
ord5303
ord4699
ord5715
ord817
ord565
ord2726
ord541
ord801
ord5651
ord3127
ord3616
ord2393
ord6385
ord1988
ord1979
ord2086
ord690
ord5186
ord350
ord6112
ord389
ord354
ord4278
ord6153
ord3790
ord4275
ord501
ord773
ord1083
ord5607
ord2919
ord6283
ord6282
ord5861
ord6876
ord4327
ord2762
ord3811
ord922
ord924
ord6928
ord6930
ord2781
ord668
ord2770
ord356
ord353
ord926
ord5442
ord5645
ord5583
ord3701
ord500
ord772
ord5860
ord6142
ord1832
ord3126
ord349
ord550
ord1833
ord2917
ord2803
ord958
ord6312
ord4177
ord3318
ord6010
ord5773
ord2601
ord3180
ord3183
ord3176
ord3507
ord6264
ord6215
ord2841
ord641
ord561
ord815
ord3738
ord3081
ord3262
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord3663
ord1146
ord2863
ord1576
ord539
ord4003
ord2486
ord4226
ord290
ord2623
ord614
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord2985
ord3136
ord4465
ord3259
ord3147
ord2982
ord1799
ord2915
ord5572
ord6779
ord941
ord2614
ord537
ord2764
ord1099
ord1574
ord823
ord825
ord6663
ord4129
ord858
ord535
ord860
ord6877
ord4202
ord2818
ord800
ord665
ord540
msvcrt
fclose
fwrite
fread
_mbsicmp
_stricmp
_splitpath
ftell
fseek
wcslen
_strcmpi
_controlfp
_setmbcp
__CxxFrameHandler
strrchr
isalnum
_mbscmp
atoi
strtok
srand
time
rand
_CxxThrowException
isspace
_mbschr
tolower
_ismbcspace
_mbspbrk
_mbsnbicmp
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_mbsicoll
_purecall
sprintf
_chdir
memmove
calloc
free
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
fopen
_getcwd
kernel32
GetProcAddress
FreeLibrary
OpenProcess
TerminateProcess
GetExitCodeProcess
Process32First
Process32Next
CreateToolhelp32Snapshot
Module32First
Module32Next
CloseHandle
Sleep
GetComputerNameA
GetWindowsDirectoryA
GetSystemDirectoryA
lstrlenW
ResumeThread
GetCommandLineA
GetModuleFileNameA
CreateFileA
GetLastError
GetTickCount
MultiByteToWideChar
OpenMutexA
CreateMutexA
GetModuleHandleA
CreateThread
ResetEvent
CreateEventA
SetEvent
MoveFileA
WaitForSingleObject
GetLocalTime
SizeofResource
LockResource
LoadResource
FindResourceA
GetFileSize
GetLongPathNameA
SetFileAttributesA
GetDriveTypeA
SetVolumeLabelA
GetDiskFreeSpaceA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SetFilePointer
GetStartupInfoA
LoadLibraryExA
SetErrorMode
DeleteFileA
FindClose
FindFirstFileA
CreateDirectoryA
lstrlenA
lstrcmpA
LocalFree
user32
GetCursorPos
EnableWindow
SetWindowPos
FindWindowA
GetWindow
GetWindowThreadProcessId
IsWindow
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
GetSystemMenu
AppendMenuA
KillTimer
LoadIconA
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
SendMessageA
wsprintfA
CharNextA
PostMessageA
SetTimer
advapi32
RegDeleteValueA
RegEnumValueA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateInstance
CoUninitialize
CoInitialize
OleRun
OleUninitialize
OleInitialize
oleaut32
VariantClear
SysAllocString
VariantInit
SysFreeString
msvcp60
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1runtime_error@std@@UAE@XZ
??0runtime_error@std@@QAE@ABV01@@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??_7out_of_range@std@@6B@
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??_8?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z
??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_7?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??_7?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
?_Tidy@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXXZ
??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@
??1locale@std@@QAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??_8?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@
??_8?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@
??0ios_base@std@@IAE@XZ
??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??_7?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z
??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@
?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??_8?$basic_ofstream@DU?$char_traits@D@std@@@std@@7B@
??_7?$basic_ofstream@DU?$char_traits@D@std@@@std@@6B@
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1ostrstream@std@@UAE@XZ
??1strstreambuf@std@@UAE@XZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Global@_Locimp@locale@std@@0PAV123@A
?_Init@strstreambuf@std@@IAEXHPAD0H@Z
?overflow@strstreambuf@std@@MAEHH@Z
?pbackfail@strstreambuf@std@@MAEHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z
?clear@ios_base@std@@QAEXH_N@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??1?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@UAE@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
??1ios_base@std@@UAE@XZ
?underflow@strstreambuf@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z
?seekoff@strstreambuf@std@@MAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z
?seekpos@strstreambuf@std@@MAE?AV?$fpos@H@2@V32@H@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?freeze@strstreambuf@std@@QAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??_7runtime_error@std@@6B@
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
netapi32
Netbios
ws2_32
WSAStartup
gethostname
gethostbyname
WSACleanup
inet_ntoa
wininet
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
Sections
.text Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
5.a6n51q Size: 251KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
v45283yp Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ