Static task
static1
Behavioral task
behavioral1
Sample
cd1f1696515aaf21bf7ce38670aca395.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cd1f1696515aaf21bf7ce38670aca395.exe
Resource
win10v2004-20240226-en
General
-
Target
cd1f1696515aaf21bf7ce38670aca395
-
Size
80KB
-
MD5
cd1f1696515aaf21bf7ce38670aca395
-
SHA1
71fe01fb7d5747a937523ed0a7b6a156310d2872
-
SHA256
e9e2eb560288794b19acad357477da576725bd9ddad89945cc39f39c8e85aeff
-
SHA512
5deab4f96709169abdc9bde10a72f11b2be79656009b1d12600a6fa6defcd94731023577584ee3ebba9e5634cafd5aa364d04ce1e6cd979fc07d0fe67845edff
-
SSDEEP
1536:c9H0oj8Ng0vloIizNN6bvVhbwZ9PxszWhelL6R/2ccHe/66CAHhCoTeT9oi2kf:cljM6lZN6hFa9x4rDceT9rf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cd1f1696515aaf21bf7ce38670aca395
Files
-
cd1f1696515aaf21bf7ce38670aca395.exe windows:4 windows x86 arch:x86
9f307757f7464b1e616582dcfd129d2a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteExA
Shell_NotifyIconA
ShellExecuteA
CommandLineToArgvW
SHGetSpecialFolderPathA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
gdi32
GetStockObject
wininet
InternetOpenA
InternetReadFile
InternetQueryDataAvailable
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetCloseHandle
atl
ord42
psapi
GetModuleFileNameExA
shlwapi
PathFindFileNameA
mfc42
ord825
ord1168
ord823
msvcrt
??0exception@@QAE@ABV0@@Z
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
memchr
atoi
_CxxThrowException
??0exception@@QAE@ABQBD@Z
_strdup
_except_handler3
malloc
wcsncpy
__CxxFrameHandler
wcscmp
memmove
strncat
sprintf
wcslen
free
kernel32
GetEnvironmentVariableA
ExitProcess
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
InterlockedDecrement
CreateMutexA
CreateEventA
WaitForSingleObject
DeleteCriticalSection
LocalFree
EnterCriticalSection
GetStartupInfoA
Process32First
LeaveCriticalSection
GetCurrentProcess
GetSystemInfo
VirtualQueryEx
ReadProcessMemory
OpenProcess
CreateToolhelp32Snapshot
Process32Next
TerminateThread
GetModuleFileNameA
GetLastError
GetTempPathA
GetTempFileNameA
CreateFileA
WriteFile
CloseHandle
GetModuleHandleA
CreateDirectoryA
InitializeCriticalSection
Sleep
CreateThread
lstrlenA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
user32
GetClientRect
DefWindowProcA
CallWindowProcA
DispatchMessageA
TranslateMessage
PeekMessageA
UpdateWindow
SetTimer
KillTimer
DestroyWindow
SetForegroundWindow
PostQuitMessage
GetSystemMetrics
LoadImageA
RegisterWindowMessageA
RegisterClassA
MessageBoxA
CreateWindowExA
ShowScrollBar
PostMessageA
GetWindowRect
SetWindowTextA
SetWindowPos
ShowWindow
GetClassInfoExA
RegisterClassExA
GetMessageA
ole32
CLSIDFromProgID
OleRun
CoInitialize
CoCreateInstance
CoUninitialize
CLSIDFromString
oleaut32
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayDestroy
SysFreeString
SysStringLen
SysAllocStringLen
VariantClear
SysAllocString
GetErrorInfo
msvcp60
?_Term@?$ctype@D@std@@KAXXZ
?_Cltab@?$ctype@D@std@@0PBFB
_Getctype
??0_Locinfo@std@@QAE@PBD@Z
??_7?$ctype@D@std@@6B@
??_7ctype_base@std@@6B@
??_7facet@locale@std@@6B@
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_tolower@?$ctype@D@std@@MBEDD@Z
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_toupper@?$ctype@D@std@@MBEDD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1_Locinfo@std@@QAE@XZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Xlen@std@@YAXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_7bad_cast@std@@6B@
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??1ctype_base@std@@UAE@XZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??1bad_cast@std@@UAE@XZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
??1locale@std@@QAE@XZ
??0locale@std@@QAE@PBDH@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??0bad_cast@std@@QAE@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Iscloc@locale@std@@QBE_NXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
??1?$ctype@D@std@@UAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Id_cnt@id@locale@std@@0HA
?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ