Static task
static1
Behavioral task
behavioral1
Sample
a70e71ca8e6a281391504d3375dbb1ddd62205c6d1e9348e044d62103ad2c7c3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a70e71ca8e6a281391504d3375dbb1ddd62205c6d1e9348e044d62103ad2c7c3.exe
Resource
win10v2004-20240226-en
General
-
Target
a70e71ca8e6a281391504d3375dbb1ddd62205c6d1e9348e044d62103ad2c7c3
-
Size
404KB
-
MD5
fd95117cbeed1461ae218006f8d0a2f5
-
SHA1
ba5edaa8e2c43f589fa57f4b6d95d4d9db9910c0
-
SHA256
a70e71ca8e6a281391504d3375dbb1ddd62205c6d1e9348e044d62103ad2c7c3
-
SHA512
805bbc48cd716c519cbc97685724f83c8d575aca45c21c32f222d994b90e6c6a5465fcb68aed912c0c5779edfd3119622c4b2ab90a6120dbad5366433e07d537
-
SSDEEP
12288:dbnxqw35Ud7wyC5IsE5wtSCMldmckN0i6qpsXzYGddyjUmU/F6l+COmwJL1ZLMBB:dzyC5IsE5wtSCMldmckN0i6KsXzYGddi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a70e71ca8e6a281391504d3375dbb1ddd62205c6d1e9348e044d62103ad2c7c3
Files
-
a70e71ca8e6a281391504d3375dbb1ddd62205c6d1e9348e044d62103ad2c7c3.exe windows:6 windows x86 arch:x86
7eaf6f9a4ae04f836d95bba0074e50d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcp140
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Xout_of_range@std@@YAXPBD@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Xinvalid_argument@std@@YAXPBD@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
vcruntime140
_except_handler4_common
_purecall
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
__current_exception
__current_exception_context
memmove
__CxxQueryExceptionSize
__CxxExceptionFilter
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
wcschr
wcsstr
__FrameUnwindFilter
api-ms-win-crt-stdio-l1-1-0
ferror
_wfopen
fclose
__p__commode
fwrite
_set_fmode
api-ms-win-crt-runtime-l1-1-0
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_narrow_winmain_command_line
_initialize_narrow_environment
abort
exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_configure_narrow_argv
_initterm_e
_seh_filter_exe
_initterm
_set_app_type
_invalid_parameter_noinfo_noreturn
_beginthreadex
_errno
api-ms-win-crt-math-l1-1-0
_finite
__setusermatherr
_isnan
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_callnewh
free
_set_new_mode
malloc
kernel32
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
TerminateProcess
DeleteFileW
LocalFree
SetCurrentDirectoryW
GetSystemDirectoryW
GetPrivateProfileStringW
FreeLibrary
LoadLibraryW
Sleep
GetProcAddress
GetModuleHandleA
K32EnumProcesses
IsWow64Process
CloseHandle
QueryFullProcessImageNameW
OpenProcess
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
user32
TranslateMessage
TranslateAcceleratorA
LoadAcceleratorsA
SetTimer
GetMessageA
DispatchMessageA
UnhookWindowsHookEx
KillTimer
IsWindow
SendMessageW
GetWindowThreadProcessId
FindWindowA
ChangeWindowMessageFilter
SetWindowsHookExA
PostMessageA
BeginPaint
EndPaint
DefWindowProcW
LoadCursorA
RegisterClassExW
CreateWindowExW
PostQuitMessage
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
oleaut32
VariantClear
VariantInit
shell32
ShellExecuteA
ShellExecuteW
shlwapi
PathFileExistsW
PathRemoveBackslashW
PathRemoveFileSpecW
api-ms-win-crt-convert-l1-1-0
_ecvt_s
wcstod
wcstol
mscoree
_CorExeMain
Sections
.text Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ