Static task
static1
Behavioral task
behavioral1
Sample
2a8c8e54c3580500fc1b9472d1cd65ecd76ef33639de7762a88f408c63fabfc4.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2a8c8e54c3580500fc1b9472d1cd65ecd76ef33639de7762a88f408c63fabfc4.exe
Resource
win10v2004-20240226-en
General
-
Target
2a8c8e54c3580500fc1b9472d1cd65ecd76ef33639de7762a88f408c63fabfc4
-
Size
87KB
-
MD5
918f1acef0198daa41e15fbf53f35636
-
SHA1
da73ce9c965960c6a811d7952962476c5908b366
-
SHA256
2a8c8e54c3580500fc1b9472d1cd65ecd76ef33639de7762a88f408c63fabfc4
-
SHA512
35db4c5e27527b72348481092ef5351d0acd921f03558b17c622f1473c8d0e2f32f3dfa1852b86852e6af6cd00283ba82cc3b4028a42454bb780deafa8a01fa5
-
SSDEEP
1536:qkYo7o/O2sCxiY/NRyE7JyDDyJHxm79Rz7XKPTZUBidLNnFQqX3HT+Sn:qDEo/O2VxiYlR5ADyW9RXqmBgHXH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2a8c8e54c3580500fc1b9472d1cd65ecd76ef33639de7762a88f408c63fabfc4
Files
-
2a8c8e54c3580500fc1b9472d1cd65ecd76ef33639de7762a88f408c63fabfc4.exe windows:5 windows x86 arch:x86
b4f02cf3cc5de787d8bbe609e2176b11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtMakePermanentObject
RtlConvertLongToLargeInteger
labs
RtlInitializeAtomPackage
NtDeleteBootEntry
NtDeviceIoControlFile
NtMapUserPhysicalPages
RtlpNtQueryValueKey
NtQueryEvent
ZwSetInformationThread
_wcslwr
RtlIsNameLegalDOS8Dot3
NtFlushWriteBuffer
ZwReplyPort
RtlUnicodeStringToCountedOemString
RtlQueryHeapInformation
RtlEqualLuid
ZwWriteFile
query
?Done@CFwAsyncWorkItem@@QAEXXZ
?PropertyToPropId@CStandardPropMapper@@QAEKABVCFullPropSpec@@H@Z
?PidToRealPid@CPidMapper@@QAEKK@Z
CIRestrictionToFullTree
??0CWordRestriction@@QAE@ABVCKeyBuf@@KKKH@Z
?ReInit@CQueryUnknown@@QAEXKPAPAVCRowset@@@Z
??0CCatState@@QAE@XZ
?Marshall@CFullPropSpec@@QBEXAAVPSerStream@@@Z
?Clone@CRestriction@@QBEPAV1@XZ
?ReadProperty@CPropStoreManager@@QAEHAAVCCompositePropRecord@@KAAUtagPROPVARIANT@@PAEPAI@Z
?FormFullTree@CTextToTree@@QAEPAUtagDBCOMMANDTREE@@XZ
?Unmap@CRcovStrmTrans@@IAEXW4DataCopyNum@CRcovStorageHdr@@@Z
?LokNewWorkId@CPropertyStore@@AAEKKHH@Z
?URLEscapeW@@YGXPBGAAVCVirtualString@@KH@Z
?StrLen@CKeyBuf@@QBEIXZ
?AddCachedProperty@CCatalogAdmin@@QAEXABVCFullPropSpec@@KKKH@Z
??0CSvcQuery@@QAE@PBGPAUIDBProperties@@@Z
CollectCIISAPIPerformanceData
??0CPropertyValueParser@@QAE@AAVCQueryScanner@@GK@Z
??1CSynRestriction@@QAE@XZ
?GetDrive@CDriveInfo@@SGXPBGPAG@Z
?AcqLine@CQueryScanner@@QAEPAGH@Z
?Disconnect@CRequestClient@@QAEXXZ
?Recognize@CDFA@@QAEEPBG@Z
?SetScopePropertiesNoThrow@@YGJPAUICommand@@IPBQBGPBK11@Z
?GetTotalSizeInKB@CPropStoreManager@@QAEKXZ
CIBuildQueryNode
??3CDbPropSet@@SGXPAX@Z
?Marshall@CDbContentVector@@QBEXAAVPSerStream@@@Z
?ReadProperty@CPropStoreManager@@QAEHKKAAUtagPROPVARIANT@@@Z
msvcp60
??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@
??_7?$ctype@G@std@@6B@
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIABV12@II@Z
?find@?$char_traits@D@std@@SAPBDPBDIABD@Z
?_Init@?$ctype@D@std@@IAEXABV_Locinfo@2@@Z
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z
?cos@std@@YA?AV?$complex@N@1@ABV21@@Z
?_Index@ios_base@std@@0HA
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??4underflow_error@std@@QAEAAV01@ABV01@@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?_Getcat@?$collate@G@std@@SAIXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?do_thousands_sep@?$_Mpunct@D@std@@MBEDXZ
??_7?$basic_ofstream@GU?$char_traits@G@std@@@std@@6B@
?exceptions@ios_base@std@@QAEXH@Z
??_Fmessages_base@std@@QAEXXZ
??1runtime_error@std@@UAE@XZ
_Dscale
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?_Doraise@bad_cast@std@@MBEXXZ
??Hstd@@YA?AV?$complex@N@0@ABV10@@Z
??_7?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@
??_7?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBF@Z
??_D?$basic_ofstream@GU?$char_traits@G@std@@@std@@QAEXXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??4?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0overflow_error@std@@QAE@ABV01@@Z
??Kstd@@YA?AV?$complex@N@0@ABV10@ABN@Z
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?norm@std@@YAMABV?$complex@M@1@@Z
kernel32
GetProcAddress
ExpungeConsoleCommandHistoryA
GetPrivateProfileStringA
CreateTimerQueueTimer
DebugActiveProcess
GetVolumePathNameA
CloseHandle
QueryPerformanceCounter
ReplaceFileA
ReadConsoleOutputCharacterA
GetShortPathNameA
ShowConsoleCursor
PulseEvent
LoadLibraryA
DebugActiveProcessStop
DebugSetProcessKillOnExit
GetCurrentThreadId
UpdateResourceA
GetSystemTimeAsFileTime
GetCommState
GetCurrentProcessId
TryEnterCriticalSection
VirtualAlloc
GetModuleHandleW
lstrlenA
LZOpenFileA
Sections
.text Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ