Static task
static1
Behavioral task
behavioral1
Sample
50a237351a247529e38aaf4d0d12a6633cf66206683ac2ba4e6333a02b3961eb.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
50a237351a247529e38aaf4d0d12a6633cf66206683ac2ba4e6333a02b3961eb.exe
Resource
win10v2004-20240226-en
General
-
Target
50a237351a247529e38aaf4d0d12a6633cf66206683ac2ba4e6333a02b3961eb
-
Size
1.0MB
-
MD5
725e427bac689c716f14eef57c9f396f
-
SHA1
42cb16fc35cfc30995e5c6a63e32e2f9522c2a77
-
SHA256
50a237351a247529e38aaf4d0d12a6633cf66206683ac2ba4e6333a02b3961eb
-
SHA512
2795b27f83e27b9e43fd92bc2bae70fe835fb04dc5be8ef41df9e9e798e11d1dca9f329e28fe5cbeceeb71dfda26f52dca0e2786133b45e849ae2db12b2630c1
-
SSDEEP
24576:Xw9eblc7202pZQGemUEhT6f/1sKhkEHa+n2dj:gUWg+bO1ma+Mj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50a237351a247529e38aaf4d0d12a6633cf66206683ac2ba4e6333a02b3961eb
Files
-
50a237351a247529e38aaf4d0d12a6633cf66206683ac2ba4e6333a02b3961eb.exe windows:5 windows x86 arch:x86
0042d6c9afa31ddd7ab700592cb39c05
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
WSAStartup
WSAIoctl
__WSAFDIsSet
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
select
accept
htonl
listen
recv
bind
connect
send
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
WSASetLastError
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
gethostname
wldap32
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord301
ord41
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
crypt32
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
normaliz
IdnToAscii
kernel32
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
SetLastError
GetSystemDirectoryA
QueryPerformanceFrequency
WaitForMultipleObjects
InitializeCriticalSectionEx
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
VerSetConditionMask
VerifyVersionInfoW
SleepEx
GetFileSizeEx
SetEvent
ResetEvent
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
PeekNamedPipe
FreeLibrary
SystemTimeToFileTime
GetCurrentProcessId
GetModuleFileNameA
SizeofResource
HeapFree
EnterCriticalSection
WriteFile
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetModuleHandleA
HeapSize
MultiByteToWideChar
Sleep
GetLastError
CreateFileA
LockResource
DeleteFileA
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
SetFileAttributesA
HeapDestroy
GetProcAddress
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
GetComputerNameA
AreFileApisANSI
ReadFile
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
LoadLibraryA
GetVersionExA
DeleteFileW
GetSystemInfo
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
InitializeSListHead
user32
GetClipboardData
OpenClipboard
CloseClipboard
keybd_event
gdi32
DeleteObject
GetObjectA
advapi32
RegSetValueExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegOpenKeyExA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
SHGetKnownFolderPath
ole32
CoUninitialize
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
CoInitialize
oleaut32
VariantClear
SysAllocString
VariantInit
msvcp140
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
shlwapi
ord214
ord184
ord213
gdiplus
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncoders
GdiplusShutdown
GdiplusStartup
GdipGetImageEncodersSize
GdipSaveImageToStream
GdipCreateBitmapFromScan0
vcruntime140
memmove
__std_exception_destroy
__std_exception_copy
_purecall
memchr
strstr
__vcrt_InitializeCriticalSectionEx
_CxxThrowException
_except_handler4_common
__CxxFrameHandler3
__std_terminate
memset
memcpy
strrchr
strchr
api-ms-win-crt-runtime-l1-1-0
_get_initial_narrow_environment
_initterm
_set_app_type
_initterm_e
_seh_filter_exe
_cexit
exit
_crt_atexit
_invalid_parameter_noinfo_noreturn
_errno
_exit
_register_onexit_function
__p___argc
__p___argv
_initialize_onexit_table
_c_exit
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_getpid
_beginthreadex
_invalid_parameter_noinfo
terminate
_controlfp_s
_resetstkoflw
__sys_nerr
__sys_errlist
api-ms-win-crt-stdio-l1-1-0
fclose
_open
__p__commode
fgets
fputc
ftell
_lseeki64
feof
_close
fopen
__stdio_common_vsprintf_s
fgetc
__stdio_common_vsscanf
fseek
fread
__acrt_iob_func
_set_fmode
_write
_get_stream_buffer_pointers
_fseeki64
fsetpos
fwrite
ungetc
_read
__stdio_common_vsprintf
setvbuf
fputs
fgetpos
fflush
api-ms-win-crt-math-l1-1-0
_dtest
_dsign
_except1
__setusermatherr
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-convert-l1-1-0
strtol
strtoul
wcstombs
atoi
strtoull
strtoll
strtod
api-ms-win-crt-time-l1-1-0
strftime
_gmtime64
_localtime64
_localtime64_s
_time64
api-ms-win-crt-filesystem-l1-1-0
_unlink
_access
_mkdir
_lock_file
_fstat64
_stat64
_unlock_file
api-ms-win-crt-string-l1-1-0
strnlen
strncmp
isalnum
isupper
strspn
_strdup
strcspn
strncpy
tolower
strpbrk
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
localeconv
api-ms-win-crt-heap-l1-1-0
_callnewh
calloc
_msize
realloc
_set_new_mode
malloc
free
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 875KB - Virtual size: 874KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ