Static task
static1
Behavioral task
behavioral1
Sample
2d49dda5f20b6ed48c6213a00e1b07d9dbb0bc8edf8828cbd656ccb08ecd8efb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2d49dda5f20b6ed48c6213a00e1b07d9dbb0bc8edf8828cbd656ccb08ecd8efb.exe
Resource
win10v2004-20240226-en
General
-
Target
2d49dda5f20b6ed48c6213a00e1b07d9dbb0bc8edf8828cbd656ccb08ecd8efb
-
Size
132KB
-
MD5
1fffd05f17fa961d83b2a7f1c8866fe9
-
SHA1
06c3074865da12a6d974ed023c7cc4d5a4f19174
-
SHA256
2d49dda5f20b6ed48c6213a00e1b07d9dbb0bc8edf8828cbd656ccb08ecd8efb
-
SHA512
f77d8f7128c9873cc6bd51f050bf67a5e4b49a6c93ffab2e95f5329807d01dafee10e98bfac5fc39b7f970bc5bfa833811378e621f9f19915e48e7dda79eef6c
-
SSDEEP
3072:ntPm7WIFBvSAv24R/0piyn/r+E4p521J2zLD9CMKsPLg2PRFXBrXucSYWRfMP472:S/SAnMDj+Ekr/9CzGL3X/wtC47zQP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2d49dda5f20b6ed48c6213a00e1b07d9dbb0bc8edf8828cbd656ccb08ecd8efb
Files
-
2d49dda5f20b6ed48c6213a00e1b07d9dbb0bc8edf8828cbd656ccb08ecd8efb.exe windows:4 windows x86 arch:x86
7bee1cee5c8953e6e2eae637f72e136c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
lstrlenA
lstrcmpiW
WideCharToMultiByte
lstrlenW
InterlockedIncrement
InterlockedDecrement
GetShortPathNameA
GetModuleHandleA
SetEvent
WaitForSingleObject
CreateThread
CreateEventA
Sleep
lstrcmpiA
GetCommandLineA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
CreateToolhelp32Snapshot
lstrcatA
LeaveCriticalSection
EnterCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
FlushInstructionCache
LocalFree
GetStartupInfoA
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
GetExitCodeThread
GlobalFree
VirtualQuery
Thread32First
Thread32Next
FindFirstFileA
LoadLibraryExA
OutputDebugStringA
FindNextFileA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
CreateFileA
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GetLastError
CloseHandle
FreeLibrary
lstrcpyA
SetUnhandledExceptionFilter
user32
GetFocus
EndPaint
BeginPaint
IsWindow
SetFocus
ShowWindow
GetParent
InvalidateRect
GetKeyState
IsChild
UnionRect
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
CallWindowProcA
CreateWindowExA
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
GetDC
ReleaseDC
PtInRect
SetWindowLongA
DefWindowProcA
GetWindowLongA
DestroyWindow
PostMessageA
SendMessageA
GetClientRect
PostThreadMessageA
GetMessageA
DispatchMessageA
CharNextA
gdi32
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
TextOutA
SetTextAlign
Rectangle
CreateRectRgnIndirect
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
CreateMetaFileA
RestoreDC
ole32
CreateOleAdviseHolder
CreateDataAdviseHolder
OleRegEnumVerbs
CoTaskMemFree
OleLoadFromStream
CoTaskMemAlloc
OleRegGetUserType
OleRegGetMiscStatus
OleSaveToStream
CoRevokeClassObject
CoRegisterClassObject
CoInitialize
CoUninitialize
CoCreateInstance
WriteClassStm
oleaut32
SysFreeString
SysAllocString
VariantClear
SysAllocStringLen
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
SysStringLen
SysStringByteLen
VariantChangeType
SysAllocStringByteLen
OleCreatePropertyFrame
shlwapi
PathAddBackslashA
PathAppendA
PathRemoveFileSpecA
msvcp60
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@D@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_7bad_cast@std@@6B@
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
msvcrt
mbstowcs
free
memcmp
_CxxThrowException
_purecall
strcmp
_mbstok
_access
??2@YAPAXI@Z
memcpy
_mbsrchr
memset
strcat
_snprintf
fopen
fwrite
fclose
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
wcslen
_mbsnbcpy
tolower
_mbsnbcat
__CxxFrameHandler
sprintf
sscanf
printf
malloc
realloc
_ftol
?name@type_info@@QBEPBDXZ
strncpy
??0exception@@QAE@ABQBD@Z
_mbsncpy
strlen
strcpy
_mbscmp
??0exception@@QAE@ABV0@@Z
comdlg32
GetSaveFileNameA
GetOpenFileNameA
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Sections
.text Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ