d:\Icar\Desarrollo\Web\ICAR Licenses\SPLInterface\Release\SPLInterface.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2f2eafdc82d09cb31b8498d38c1815052650c8024090eb3a3a00b74a6a379c3d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f2eafdc82d09cb31b8498d38c1815052650c8024090eb3a3a00b74a6a379c3d.exe
Resource
win10v2004-20240226-en
General
-
Target
2f2eafdc82d09cb31b8498d38c1815052650c8024090eb3a3a00b74a6a379c3d
-
Size
4.4MB
-
MD5
7fc845e2458bcb5f5c8e86db2bffb69c
-
SHA1
21f7aa47d95ebb7a6f2e6b9a9499e5b12b519e04
-
SHA256
2f2eafdc82d09cb31b8498d38c1815052650c8024090eb3a3a00b74a6a379c3d
-
SHA512
c225929e7588f7a172058b675188ec592c39ff8a1826cdb86260da3a9c816e13c78f905241e793bb22ed4cb53587ff1de3b9ea9a3fac8277fc3bfb9423eda4c0
-
SSDEEP
12288:1N99zYwWVqEgw00+8fxPE6NMY4936zBIzj/eFpuGXe/zOb94:xlYz0Egw00s6ut6NIzj/eFpuGXwzG4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f2eafdc82d09cb31b8498d38c1815052650c8024090eb3a3a00b74a6a379c3d -
resource yara_rule sample dropper_html
Files
-
2f2eafdc82d09cb31b8498d38c1815052650c8024090eb3a3a00b74a6a379c3d.exe windows:4 windows x86 arch:x86
b5b512b7f6e394afb976532553840cdb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
xerces-c_2_6
??1MemBufInputSource@xercesc_2_6@@UAE@XZ
??0MemBufInputSource@xercesc_2_6@@QAE@QBEIQBD_NQAVMemoryManager@1@@Z
?parse@AbstractDOMParser@xercesc_2_6@@QAEXABVInputSource@2@@Z
?getDocument@AbstractDOMParser@xercesc_2_6@@QAEPAVDOMDocument@2@XZ
?makeStream@MemBufInputSource@xercesc_2_6@@UBEPAVBinInputStream@2@XZ
?getEncoding@InputSource@xercesc_2_6@@UBEPBGXZ
?getPublicId@InputSource@xercesc_2_6@@UBEPBGXZ
?getSystemId@InputSource@xercesc_2_6@@UBEPBGXZ
?getIssueFatalErrorIfNotFound@InputSource@xercesc_2_6@@UBE_NXZ
?setEncoding@InputSource@xercesc_2_6@@UAEXQBG@Z
?setPublicId@InputSource@xercesc_2_6@@UAEXQBG@Z
?setSystemId@InputSource@xercesc_2_6@@UAEXQBG@Z
?setIssueFatalErrorIfNotFound@InputSource@xercesc_2_6@@UAEX_N@Z
??1XercesDOMParser@xercesc_2_6@@UAE@XZ
??2XMemory@xercesc_2_6@@SAPAXI@Z
?fgMemoryManager@XMLPlatformUtils@xercesc_2_6@@2PAVMemoryManager@2@A
??0XercesDOMParser@xercesc_2_6@@QAE@QAVXMLValidator@1@QAVMemoryManager@1@QAVXMLGrammarPool@1@@Z
?setValidationScheme@AbstractDOMParser@xercesc_2_6@@QAEXW4ValSchemes@12@@Z
?setDoNamespaces@AbstractDOMParser@xercesc_2_6@@QAEX_N@Z
?setDoSchema@AbstractDOMParser@xercesc_2_6@@QAEX_N@Z
?setValidationSchemaFullChecking@AbstractDOMParser@xercesc_2_6@@QAEX_N@Z
??3XMemory@xercesc_2_6@@SAXPAX@Z
?docCharacters@AbstractDOMParser@xercesc_2_6@@UAEXQBGI_N@Z
?docComment@AbstractDOMParser@xercesc_2_6@@UAEXQBG@Z
?docPI@AbstractDOMParser@xercesc_2_6@@UAEXQBG0@Z
?endDocument@AbstractDOMParser@xercesc_2_6@@UAEXXZ
?endElement@AbstractDOMParser@xercesc_2_6@@UAEXABVXMLElementDecl@2@I_NQBG@Z
?endEntityReference@AbstractDOMParser@xercesc_2_6@@UAEXABVXMLEntityDecl@2@@Z
?ignorableWhitespace@AbstractDOMParser@xercesc_2_6@@UAEXQBGI_N@Z
?resetDocument@AbstractDOMParser@xercesc_2_6@@UAEXXZ
?startDocument@AbstractDOMParser@xercesc_2_6@@UAEXXZ
?startElement@AbstractDOMParser@xercesc_2_6@@UAEXABVXMLElementDecl@2@IQBGABV?$RefVectorOf@VXMLAttr@xercesc_2_6@@@2@I_N3@Z
?startEntityReference@AbstractDOMParser@xercesc_2_6@@UAEXABVXMLEntityDecl@2@@Z
?XMLDecl@AbstractDOMParser@xercesc_2_6@@UAEXQBG000@Z
?elementTypeInfo@AbstractDOMParser@xercesc_2_6@@UAEXQBG0@Z
?setPSVIHandler@AbstractDOMParser@xercesc_2_6@@UAEXQAVPSVIHandler@2@@Z
?createElementNSNode@AbstractDOMParser@xercesc_2_6@@MAEPAVDOMElement@2@PBG0@Z
?error@XercesDOMParser@xercesc_2_6@@UAEXIQBGW4ErrTypes@XMLErrorReporter@2@000JJ@Z
?resetErrors@XercesDOMParser@xercesc_2_6@@UAEXXZ
?endInputSource@XercesDOMParser@xercesc_2_6@@UAEXABVInputSource@2@@Z
?expandSystemId@XercesDOMParser@xercesc_2_6@@UAE_NQBGAAVXMLBuffer@2@@Z
?resetEntities@XercesDOMParser@xercesc_2_6@@UAEXXZ
?resolveEntity@XercesDOMParser@xercesc_2_6@@UAEPAVInputSource@2@PAVXMLResourceIdentifier@2@@Z
?resolveEntity@XercesDOMParser@xercesc_2_6@@UAEPAVInputSource@2@QBG00@Z
?startInputSource@XercesDOMParser@xercesc_2_6@@UAEXABVInputSource@2@@Z
?attDef@AbstractDOMParser@xercesc_2_6@@UAEXABVDTDElementDecl@2@ABVDTDAttDef@2@_N@Z
?doctypeComment@AbstractDOMParser@xercesc_2_6@@UAEXQBG@Z
?doctypeDecl@AbstractDOMParser@xercesc_2_6@@UAEXABVDTDElementDecl@2@QBG1_N2@Z
?doctypePI@AbstractDOMParser@xercesc_2_6@@UAEXQBG0@Z
?doctypeWhitespace@AbstractDOMParser@xercesc_2_6@@UAEXQBGI@Z
?elementDecl@AbstractDOMParser@xercesc_2_6@@UAEXABVDTDElementDecl@2@_N@Z
?endAttList@AbstractDOMParser@xercesc_2_6@@UAEXABVDTDElementDecl@2@@Z
?endIntSubset@AbstractDOMParser@xercesc_2_6@@UAEXXZ
?endExtSubset@AbstractDOMParser@xercesc_2_6@@UAEXXZ
?entityDecl@AbstractDOMParser@xercesc_2_6@@UAEXABVDTDEntityDecl@2@_N1@Z
?resetDocType@AbstractDOMParser@xercesc_2_6@@UAEXXZ
?notationDecl@AbstractDOMParser@xercesc_2_6@@UAEXABVXMLNotationDecl@2@_N@Z
?startAttList@AbstractDOMParser@xercesc_2_6@@UAEXABVDTDElementDecl@2@@Z
?startIntSubset@AbstractDOMParser@xercesc_2_6@@UAEXXZ
?startExtSubset@AbstractDOMParser@xercesc_2_6@@UAEXXZ
?TextDecl@AbstractDOMParser@xercesc_2_6@@UAEXQBG0@Z
?handleElementPSVI@AbstractDOMParser@xercesc_2_6@@UAEXQBG0PAVPSVIElement@2@@Z
?handlePartialElementPSVI@AbstractDOMParser@xercesc_2_6@@UAEXQBG0PAVPSVIElement@2@@Z
?handleAttributesPSVI@AbstractDOMParser@xercesc_2_6@@UAEXQBG0PAVPSVIAttributeList@2@@Z
?fgXercescDefaultLocale@XMLUni@xercesc_2_6@@2QBDB
?Initialize@XMLPlatformUtils@xercesc_2_6@@SAXQBD0QAVPanicHandler@2@QAVMemoryManager@2@@Z
?Terminate@XMLPlatformUtils@xercesc_2_6@@SAXXZ
kernel32
GetCurrentThreadId
FreeResource
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
CloseHandle
DuplicateHandle
GetCurrentProcess
lstrcpyA
FindClose
FindFirstFileA
GetFullPathNameA
CreateFileA
lstrcmpA
EnumResourceLanguagesA
ConvertDefaultLocale
GetCurrentThread
WritePrivateProfileStringA
InterlockedDecrement
InterlockedIncrement
GlobalGetAtomNameA
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesA
GetFileTime
GlobalAddAtomA
ExitProcess
RtlUnwind
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
TerminateProcess
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
QueryPerformanceCounter
GetCurrentProcessId
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetEnvironmentVariableA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
lstrcmpW
GetModuleHandleA
GetProcAddress
SetLastError
GlobalFree
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
lstrcpynA
LocalFree
GetVolumeInformationA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetPrivateProfileStringA
GetPrivateProfileIntA
Sleep
GetModuleFileNameA
CompareStringW
CompareStringA
lstrlenA
lstrcmpiA
GetVersion
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
FileTimeToSystemTime
GetTickCount
user32
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
IsWindowEnabled
GetMenuCheckMarkDimensions
CheckMenuItem
EnableMenuItem
ModifyMenuA
SetMenuItemBitmaps
GetDC
ReleaseDC
wsprintfA
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
GetActiveWindow
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
GetWindowDC
BeginPaint
EndPaint
PostQuitMessage
SetCursor
ValidateRect
TranslateMessage
GetMessageA
MapDialogRect
SetWindowContextHelpId
WaitMessage
DestroyMenu
IsRectEmpty
SetRect
CopyAcceleratorTableA
InvalidateRgn
CharNextA
GetSysColorBrush
LoadCursorA
MessageBeep
GetNextDlgGroupItem
RegisterClipboardFormatA
PostThreadMessageA
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
GetFocus
IsChild
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MessageBoxA
GetKeyState
SetForegroundWindow
UpdateWindow
GetMenu
GetSysColor
AdjustWindowRectEx
EqualRect
GetClassInfoA
RegisterClassA
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetWindowLongA
SetWindowLongA
SetWindowPos
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
RegisterWindowMessageA
UnregisterClassA
LoadBitmapA
LoadIconA
GetSystemMetrics
SetTimer
InvalidateRect
IsIconic
GetSystemMenu
AppendMenuA
DrawIcon
IsWindow
ReleaseCapture
GetCursorPos
GetParent
GetDesktopWindow
SetCapture
RedrawWindow
IsWindowVisible
ClientToScreen
MapWindowPoints
GetClientRect
GetWindowRect
PostMessageA
InflateRect
PtInRect
CopyRect
CharUpperA
WinHelpA
GetCapture
CreateWindowExA
SetFocus
SendMessageA
EnableWindow
CallNextHookEx
GetWindow
KillTimer
SetWindowsHookExA
gdi32
Rectangle
GetTextExtentPoint32A
GetDeviceCaps
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
CreateRectRgnIndirect
SaveDC
RestoreDC
SetBkMode
SetMapMode
LineTo
MoveToEx
DeleteObject
GetViewportExtEx
GetWindowExtEx
BitBlt
PtVisible
RectVisible
CreateFontIndirectA
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
Polygon
ExtSelectClipRgn
DeleteDC
CreateCompatibleDC
GetStockObject
ExtTextOutA
CreatePen
CreateSolidBrush
GetRgnBox
GetBkColor
GetTextColor
GetMapMode
SelectObject
GetObjectA
CreateFontA
TextOutA
Escape
comdlg32
GetFileTitleA
winspool.drv
DocumentPropertiesA
ClosePrinter
OpenPrinterA
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
comctl32
ord17
shlwapi
PathIsUNCA
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
oledlg
ord8
ole32
CoRegisterMessageFilter
OleFlushClipboard
CoTaskMemFree
CoTaskMemAlloc
OleRun
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard
oleaut32
OleCreateFontIndirect
SysFreeString
SysAllocStringLen
VariantInit
VariantClear
VariantCopy
VariantChangeType
DispCallFunc
SysAllocString
LoadRegTypeLi
SysStringLen
SysAllocStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SafeArrayDestroy
SystemTimeToVariantTime
ws2_32
inet_ntoa
gethostbyname
gethostname
recv
send
WSAAsyncSelect
recvfrom
sendto
connect
WSAGetLastError
bind
inet_addr
htons
htonl
select
socket
accept
closesocket
WSACleanup
WSAStartup
WSASetLastError
Sections
.text Size: 272KB - Virtual size: 269KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ