Static task
static1
Behavioral task
behavioral1
Sample
cb19ad66e4b4bebcdefa93eec38a1520.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb19ad66e4b4bebcdefa93eec38a1520.exe
Resource
win10v2004-20240226-en
General
-
Target
cb19ad66e4b4bebcdefa93eec38a1520
-
Size
398KB
-
MD5
cb19ad66e4b4bebcdefa93eec38a1520
-
SHA1
860838641e51f16fb97fe499e449afec950cd209
-
SHA256
813fca251369cb71ea98dc0d75dc0c205e2971a44fef0ae7caff5e5e240dedfd
-
SHA512
32a78fc455ce64175903c07b84cd3afad5930fe33c2eb0b638d3b0512506609ab0719dcb46a60cfd7f586df5b0fba85ee86e85b16c73be095a4435a1548cee38
-
SSDEEP
12288:Ttfgo8RAkeFvg9eKcgJRddlFrlJ4pPOia4xikZWqyroDt1Ec:Tdgo8RAkeZmjFlJ4pPjawikYpoDt1Ec
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cb19ad66e4b4bebcdefa93eec38a1520
Files
-
cb19ad66e4b4bebcdefa93eec38a1520.exe windows:5 windows x86 arch:x86
e978405453d37d3b648567ffe2daea3d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mprapi
MprAdminTransportSetInfo
MprAdminInterfaceGetInfo
MprConfigServerInstall
MprInfoDuplicate
MprInfoBlockQuerySize
MprAdminBufferFree
MprAdminInterfaceUpdateRoutes
MprInfoCreate
MprConfigInterfaceGetInfo
MprConfigInterfaceEnum
MprConfigInterfaceSetInfo
MprConfigInterfaceTransportAdd
MprConfigTransportSetInfo
MprAdminInterfaceSetCredentials
MprConfigInterfaceTransportGetHandle
MprAdminUserGetInfo
MprAdminPortReset
MprAdminUserRead
MprAdminTransportGetInfo
MprAdminPortGetInfo
MprAdminUserServerDisconnect
MprAdminInterfaceTransportSetInfo
MprDomainRegisterRasServer
MprAdminConnectionEnum
RasPrivilegeAndCallBackNumber
MprConfigInterfaceTransportRemove
MprAdminInterfaceDeviceGetInfo
MprAdminInterfaceGetCredentialsEx
MprAdminInterfaceDeviceSetInfo
MprAdminInterfaceGetHandle
MprAdminDeviceEnum
MprAdminServerGetCredentials
MprAdminDeregisterConnectionNotification
MprAdminUserServerConnect
MprAdminInterfaceTransportRemove
MprAdminInterfaceDisconnect
MprAdminUserWriteProfFlags
MprConfigInterfaceCreate
MprConfigInterfaceTransportGetInfo
MprAdminMIBEntryCreate
mapi32
MapStorageSCode@4
BMAPIResolveName
EncodeID@12
DeregisterIdleRoutine@4
FtDivFtBogus@20
InstallFilterHook@4
FBadRglpNameID@8
HrComposeMsgID@24
RTFSync@12
FBadRowSet@4
cmc_logon
MAPIDeinitIdle@0
HrEntryIDFromSz@12
UFromSz@4
MAPILogonEx
UlRelease@4
MAPIFindNext
FtgRegisterIdleRoutine@20
PRProviderInit
HrIStorageFromStream@16
MAPIOpenFormMgr@8
MAPIAllocateBuffer
WrapCompressedRTFStream
EnableIdleRoutine@8
BMAPIFindNext
MNLS_WideCharToMultiByte@32
FBadRow@4
HrSetOneProp@8
HrDecomposeMsgID@24
RTFSync
CchOfEncoding@4
OpenIMsgOnIStg@44
ScCountNotifications@12
OpenIMsgSession@12
MNLS_MultiByteToWideChar@24
UNKOBJ_ScAllocateMore@16
FtMulDw@12
crtdll
realloc
_pclose
abort
is_wctype
_ultow
_dup
_mbscat
_mbsspnp
_wtol
_errno
iswalpha
fflush
free
strtod
_mbsnicmp
getenv
_fileno
iswascii
_daylight_dll
_ismbblead
localeconv
_itoa
_strnextc
_mbctoupper
cos
_eof
_expand
_execve
wcscpy
_initterm
wcstombs
_endthread
_pctype_dll
_mbsnbicmp
_fullpath
_CIatan
_wtoi
_loaddll
_umask
_execvpe
_wcsnicmp
msvcp60
?pbackfail@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGG@Z
??4?$numeric_limits@O@std@@QAEAAV01@ABV01@@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDH@Z
??0?$moneypunct@G$0A@@std@@QAE@ABV_Locinfo@1@I@Z
_FDenorm
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?id@?$numpunct@G@std@@2V0locale@2@A
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@KAPADPADDH@Z
??0_Locinfo@std@@QAE@HPBD@Z
??Dstd@@YA?AV?$complex@M@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@GABV10@@Z
??_F?$collate@G@std@@QAEXXZ
?do_in@?$codecvt@DDH@std@@MBEHAAHPBD1AAPBDPAD3AAPAD@Z
??_7?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??0?$complex@M@std@@QAE@ABM0@Z
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
??_7domain_error@std@@6B@
?do_tolower@?$ctype@D@std@@MBEDD@Z
?pow@std@@YA?AV?$complex@M@1@ABV21@0@Z
?sqrt@std@@YA?AV?$complex@N@1@ABV21@@Z
?do_compare@?$collate@G@std@@MBEHPBG000@Z
??1?$ctype@G@std@@UAE@XZ
?unsetf@ios_base@std@@QAEXH@Z
?assign@?$char_traits@D@std@@SAPADPADIABD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@ios_base@std@@QAEXH_N@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?infinity@?$numeric_limits@J@std@@SAJXZ
??_7range_error@std@@6B@
?imag@?$_Complex_base@M@std@@QBEMXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IABV12@II@Z
??8std@@YA_NABOABV?$complex@O@0@@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXF@Z
kernel32
EnterCriticalSection
VirtualAlloc
GetShortPathNameW
GetDiskFreeSpaceExA
_lcreat
ExitProcess
LoadLibraryA
EnumResourceTypesW
FindResourceW
GetProfileStringA
RtlFillMemory
SetProcessPriorityBoost
VerSetConditionMask
GetConsoleCP
GetVolumeNameForVolumeMountPointA
SetDefaultCommConfigW
GetSystemTimeAdjustment
DebugBreakProcess
RegisterWaitForSingleObject
EraseTape
UnregisterWait
GetCommConfig
LZOpenFileA
WriteConsoleA
DeleteCriticalSection
GetStartupInfoA
LeaveCriticalSection
CreateNamedPipeA
OpenSemaphoreW
MoveFileExA
DebugBreak
GetLocaleInfoA
CreateHardLinkW
ifsutil
?AddEntry@AUTOREG@@SGEPBVWSTRING@@@Z
?QueryNtfsSupportInfo@DP_DRIVE@@SGJPAXPAE@Z
?GetCannedSecurity@IFS_SYSTEM@@SGPAVCANNED_SECURITY@@XZ
?RemoveEdge@DIGRAPH@@QAEEKK@Z
??0READ_CACHE@@QAE@XZ
?GetCannedSecurityDescriptor@CANNED_SECURITY@@QAEPAXW4_CANNED_SECURITY_TYPE@@PAK@Z
?CloseDriveHandle@DP_DRIVE@@QAEXXZ
?GetBuffer@TLINK@@QAEPAXPAX@Z
?QueryPageSize@IFS_SYSTEM@@SGKXZ
??1SPARSE_SET@@UAE@XZ
?GetSortedFirst@TLINK@@QAEPAXXZ
?Initialize@DP_DRIVE@@QAEEPBVWSTRING@@PAVMESSAGE@@EEG@Z
?QueryFreeDiskSpace@IFS_SYSTEM@@SGEPBVWSTRING@@PAVBIG_INT@@@Z
?Write@SECRUN@@UAEEXZ
?Read@LOG_IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
?AddDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?QueryDriveName@MOUNT_POINT_MAP@@QAEEPAVWSTRING@@0@Z
?Initialize@LOG_IO_DP_DRIVE@@QAEEPBVWSTRING@@0PAVMESSAGE@@E@Z
??0INTSTACK@@QAE@XZ
??0LOG_IO_DP_DRIVE@@QAE@XZ
?QueryNumber@NUMBER_SET@@QBE?AVBIG_INT@@V2@@Z
?Initialize@TLINK@@QAEEG@Z
?RemoveAll@NUMBER_SET@@QAEEXZ
?NtDriveNameToDosDriveName@IFS_SYSTEM@@SGEPBVWSTRING@@PAV2@@Z
?FileSetAttributes@IFS_SYSTEM@@SGEPBVWSTRING@@KPAK@Z
??0DIGRAPH@@QAE@XZ
?Initialize@READ_WRITE_CACHE@@QAEEPAVIO_DP_DRIVE@@K@Z
?QuerySize@TLINK@@QBEGXZ
?Add@NUMBER_SET@@QAEEVBIG_INT@@@Z
?ReverseCopy@INTSTACK@@QAEEPAV1@@Z
?QueryDisjointRange@NUMBER_SET@@QBEXKPAVBIG_INT@@0@Z
??0MOUNT_POINT_MAP@@QAE@XZ
?Read@IO_DP_DRIVE@@QAEEVBIG_INT@@KPAX@Z
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 93KB - Virtual size: 606KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ