Static task
static1
Behavioral task
behavioral1
Sample
1b1eb1c9ff1b60ba0643a80698404f9169d0006469303aa77e235ee8dd00d213.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1b1eb1c9ff1b60ba0643a80698404f9169d0006469303aa77e235ee8dd00d213.exe
Resource
win10v2004-20240226-en
General
-
Target
1b1eb1c9ff1b60ba0643a80698404f9169d0006469303aa77e235ee8dd00d213
-
Size
1.0MB
-
MD5
993781f5c5c34bac61ea54ef608fde37
-
SHA1
da96a8c04edf8c39d9f9a98381d0d549d1a887e8
-
SHA256
1b1eb1c9ff1b60ba0643a80698404f9169d0006469303aa77e235ee8dd00d213
-
SHA512
8a601db639c2ccdd33e6ce902f0f004b87cbf2895d91192cf31e3b653752441e660eeb6a7fed964fa6550c545ed0862f14ea8702f939dfd9cb4c439ea21b725a
-
SSDEEP
24576:v9jPf9jXZ7fMqQ0YUmJCM+eUwwXbjfb7nea5R+A:vZNjJBk+e43ea5r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b1eb1c9ff1b60ba0643a80698404f9169d0006469303aa77e235ee8dd00d213
Files
-
1b1eb1c9ff1b60ba0643a80698404f9169d0006469303aa77e235ee8dd00d213.exe windows:5 windows x86 arch:x86
dc4c31ecbdcbcad9b4b69f2557cb870b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAStartup
WSAIoctl
__WSAFDIsSet
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
select
accept
htonl
listen
recv
bind
connect
send
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
WSASetLastError
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
gethostname
wldap32
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord301
ord41
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
crypt32
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
normaliz
IdnToAscii
kernel32
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
SetLastError
GetSystemDirectoryA
QueryPerformanceFrequency
WaitForMultipleObjects
InitializeCriticalSectionEx
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
VerSetConditionMask
VerifyVersionInfoW
SleepEx
GetFileSizeEx
SetEvent
ResetEvent
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
PeekNamedPipe
FreeLibrary
SystemTimeToFileTime
GetCurrentProcessId
GetModuleFileNameA
SizeofResource
HeapFree
EnterCriticalSection
WriteFile
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetModuleHandleA
HeapSize
MultiByteToWideChar
Sleep
GetLastError
CreateFileA
LockResource
DeleteFileA
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
SetFileAttributesA
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
GetComputerNameA
AreFileApisANSI
ReadFile
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
LoadLibraryA
GetVersionExA
DeleteFileW
GetSystemInfo
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
InitializeSListHead
user32
GetClipboardData
OpenClipboard
CloseClipboard
keybd_event
gdi32
DeleteObject
GetObjectA
advapi32
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegOpenKeyExA
shell32
ShellExecuteA
SHGetKnownFolderPath
ole32
CoUninitialize
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
oleaut32
VariantClear
SysAllocString
VariantInit
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
shlwapi
ord214
ord184
ord213
gdiplus
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipCreateBitmapFromScan0
vcruntime140
memmove
__std_exception_destroy
__std_exception_copy
_purecall
memchr
strstr
__vcrt_InitializeCriticalSectionEx
_CxxThrowException
_except_handler4_common
__CxxFrameHandler3
__std_terminate
memset
memcpy
strrchr
strchr
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
_initterm
_set_app_type
_initterm_e
_seh_filter_exe
_cexit
exit
_crt_atexit
_invalid_parameter_noinfo_noreturn
_errno
_exit
_register_onexit_function
__p___argc
__p___argv
_initialize_onexit_table
_c_exit
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_getpid
_beginthreadex
_invalid_parameter_noinfo
terminate
_controlfp_s
_resetstkoflw
__sys_nerr
__sys_errlist
api-ms-win-crt-stdio-l1-1-0
fclose
_open
__p__commode
fgets
fputc
ftell
_lseeki64
feof
_close
fopen
__stdio_common_vsprintf_s
fgetc
__stdio_common_vsscanf
fseek
fread
__acrt_iob_func
_set_fmode
_write
_get_stream_buffer_pointers
_fseeki64
fsetpos
fwrite
ungetc
_read
__stdio_common_vsprintf
setvbuf
fputs
fgetpos
fflush
api-ms-win-crt-math-l1-1-0
_dtest
_dsign
_except1
__setusermatherr
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-convert-l1-1-0
strtol
strtoul
wcstombs
atoi
strtoull
strtoll
strtod
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_localtime64
_localtime64_s
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlink
_access
_mkdir
_lock_file
_fstat64
_stat64
_unlock_file
api-ms-win-crt-string-l1-1-0
strnlen
strncmp
isalnum
isupper
strspn
_strdup
strcspn
strncpy
tolower
strpbrk
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
_msize
realloc
_set_new_mode
malloc
free
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 871KB - Virtual size: 870KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ