Static task
static1
Behavioral task
behavioral1
Sample
C.H.A.O.S.exe
Resource
win10-20240214-en
General
-
Target
C.H.A.O.S.exe
-
Size
92KB
-
MD5
a4d262ef780dd48173735a8125562f7b
-
SHA1
81f83bc43cd6e6b95d620323e08865c478e303b5
-
SHA256
4ac1cc65862b9c501bbb5ee8434dda7f62057722bc570bcaaa3ceed640c646df
-
SHA512
6a990d5f64ae24dfa676166e7cf4bcbaf090236898aefbd5121b3455662b982de22d6a88fd58d5f86d4bacccb395f31a733db8c4fc8a31665f8dc111df5a73cf
-
SSDEEP
768:jGTg731+Brp3KslKzAvIUX8u0fFEM4qXk1CZGN4M4zyHy8nHFa0N/7XpG7+Hxr+8:/73cBl3KQK11u0tlrZEqzyH/U05k7+HF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource C.H.A.O.S.exe
Files
-
C.H.A.O.S.exe.exe windows:4 windows x86 arch:x86
3dbe26e5384fb64cda97614b441ccec3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
AllocateAndInitializeSid
LookupPrivilegeValueA
OpenProcessToken
SetNamedSecurityInfoA
gdi32
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBSection
CreateSolidBrush
DeleteDC
DeleteObject
Ellipse
PlgBlt
SelectObject
StretchBlt
kernel32
CloseHandle
CreateFileW
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FindFirstFileA
FindNextFileA
FreeLibrary
GetConsoleWindow
GetCurrentProcess
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetStartupInfoA
HeapAlloc
HeapFree
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
RemoveDirectoryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WriteFile
msimg32
AlphaBlend
api-ms-win-crt-environment-l1-1-0
__p__environ
__p__wenviron
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
memcpy
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
__p___wargv
__p__acmdln
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_initialize_narrow_environment
_set_app_type
_initialize_wide_environment
_initterm
_set_invalid_parameter_handler
abort
exit
signal
system
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
fclose
fopen
fputc
fwrite
puts
api-ms-win-crt-string-l1-1-0
memset
strcmp
strlen
strncmp
api-ms-win-crt-time-l1-1-0
__daylight
__timezone
__tzname
_time64
_tzset
api-ms-win-crt-utility-l1-1-0
rand
user32
ChangeDisplaySettingsExA
DestroyCursor
DestroyIcon
DestroyWindow
DrawIcon
EnumDisplaySettingsA
EnumWindows
GetClientRect
GetCursorInfo
GetCursorPos
GetDC
GetDesktopWindow
GetSystemMetrics
InvalidateRect
LoadIconA
MessageBoxA
RedrawWindow
ReleaseDC
SetCursorPos
SetWindowPos
SetWindowTextA
ShowWindow
UpdateWindow
mouse_event
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 200B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/14 Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/29 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/41 Size: 512B - Virtual size: 175B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/55 Size: 512B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/67 Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/80 Size: 512B - Virtual size: 119B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/91 Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ