Static task
static1
Behavioral task
behavioral1
Sample
dd1e03d73eb46d7777e347f9b229b9dab520e03dd061f58cf593aa5bddfe3e51.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
dd1e03d73eb46d7777e347f9b229b9dab520e03dd061f58cf593aa5bddfe3e51.exe
Resource
win10v2004-20240508-en
General
-
Target
dd1e03d73eb46d7777e347f9b229b9dab520e03dd061f58cf593aa5bddfe3e51
-
Size
2.6MB
-
MD5
e3ad9f80bad095bb071581ce2103f74f
-
SHA1
a4bc40a9f84f2479662aab8a955cdb686b5597f2
-
SHA256
dd1e03d73eb46d7777e347f9b229b9dab520e03dd061f58cf593aa5bddfe3e51
-
SHA512
eb73a04af7f5ccf3ca7679fda0bc6170b8bb14d1672ef9018d3a2ccc94e87aa3140b0d2ebf4f1347c5c977c57ce2f0819585aa65a9ea49ebade90a08a74a5bcb
-
SSDEEP
49152:V6JxADpluyFixkhAbvCf0V0SPIXhvaTFLtsC2Vi7/iIBd3y17EQ:V6jWp86AbqeIOF/WIq7h
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd1e03d73eb46d7777e347f9b229b9dab520e03dd061f58cf593aa5bddfe3e51
Files
-
dd1e03d73eb46d7777e347f9b229b9dab520e03dd061f58cf593aa5bddfe3e51.exe windows:5 windows x86 arch:x86
43ea2dc8d6a5414851d90908eb83efd4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
oleacc
AccessibleObjectFromPoint
GetRoleTextA
AccessibleObjectFromWindow
GetStateTextA
winmm
timeGetTime
wininet
HttpQueryInfoA
InternetCloseHandle
InternetConnectA
InternetSetOptionA
InternetOpenA
HttpSendRequestA
InternetCrackUrlA
InternetReadFile
HttpOpenRequestA
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
FindCloseUrlCache
FindFirstUrlCacheEntryA
mh32
setMyHook
getSharedString
clearMyHook
mfc100
ord6969
ord6970
ord5175
ord7206
ord1012
ord3744
ord8228
ord5302
ord5858
ord1480
ord2119
ord3406
ord2138
ord2137
ord1009
ord2918
ord2773
ord5855
ord4440
ord8453
ord12865
ord1224
ord2932
ord2819
ord6060
ord3390
ord1939
ord342
ord3871
ord306
ord918
ord6671
ord9281
ord6293
ord6634
ord6641
ord1479
ord11461
ord3839
ord2020
ord11274
ord2056
ord311
ord307
ord3490
ord266
ord12716
ord2092
ord13310
ord7439
ord325
ord2514
ord909
ord6207
ord1025
ord480
ord3373
ord11744
ord1011
ord7322
ord804
ord5652
ord4762
ord3634
ord374
ord806
ord12473
ord12740
ord943
ord1222
ord12962
ord7889
ord8136
ord10006
ord5280
ord5786
ord11924
ord2183
ord5774
ord4498
ord1315
ord3251
ord2063
ord2067
ord423
ord4188
ord4207
ord7317
ord4939
ord11781
ord7487
ord2525
ord979
ord1294
ord7871
ord11627
ord915
ord3738
ord2742
ord8222
ord5777
ord1263
ord3755
ord2838
ord8231
ord6090
ord4790
ord1483
ord2406
ord968
ord5821
ord1437
ord10906
ord385
ord13125
ord12868
ord4144
ord5204
ord7832
ord1316
ord3977
ord4785
ord3970
ord13219
ord3254
ord11108
ord8330
ord948
ord13045
ord919
ord3429
ord2613
ord7861
ord3741
ord421
ord339
ord11277
ord5208
ord4078
ord12090
ord4212
ord7835
ord888
ord6112
ord5098
ord11787
ord11153
ord11184
ord9449
ord7355
ord11180
ord11172
ord5238
ord13481
ord13484
ord13482
ord13485
ord13480
ord13483
ord7144
ord11413
ord13181
ord10922
ord14075
ord1732
ord11439
ord2617
ord1865
ord5093
ord1864
ord5782
ord6836
ord6628
ord3500
ord298
ord2891
ord2200
ord745
ord744
ord11447
ord5664
ord7265
ord286
ord13082
ord2616
ord995
ord3742
ord2916
ord2763
ord8226
ord5841
ord4341
ord2744
ord5534
ord12535
ord2417
ord8224
ord11154
ord5444
ord8304
ord5784
ord895
ord4344
ord5776
ord2611
ord5242
ord305
ord5207
ord2626
ord6316
ord300
ord1313
ord310
ord6678
ord12285
ord9475
ord946
ord11067
ord8137
ord10007
ord10360
ord3620
ord2974
ord2973
ord2752
ord5532
ord12531
ord2881
ord2878
ord7349
ord2416
ord14059
ord14061
ord14060
ord3488
ord290
ord1446
ord900
ord1854
ord7178
ord7837
ord3404
ord301
ord14058
ord14062
ord14045
ord13972
ord13973
ord8235
ord11025
ord3395
ord10883
ord13294
ord8070
ord11107
ord6217
ord9994
ord8351
ord2847
ord12644
ord11190
ord11188
ord1496
ord1503
ord1509
ord1507
ord1514
ord4373
ord4410
ord4381
ord4393
ord4389
ord4385
ord4415
ord4406
ord4377
ord4419
ord4398
ord4364
ord4368
ord4401
ord3991
ord13980
ord3984
ord2661
ord11941
ord12790
ord12128
ord3486
ord4340
ord2156
ord3253
ord2913
ord2745
ord5785
ord6259
ord7581
ord2505
ord2769
ord457
ord4143
ord13306
ord13304
ord11882
ord7933
ord920
ord8465
ord7478
ord5157
ord788
ord1210
ord10030
ord5177
ord1004
ord1242
ord6073
ord4343
ord7216
ord1280
ord5437
ord6106
ord2409
ord2872
ord1292
ord265
ord6835
ord9399
ord1288
ord916
ord977
ord2524
ord4267
ord3409
ord13312
ord13302
ord7074
ord13300
ord6128
ord10672
ord12482
ord5253
ord2338
ord11060
ord3484
ord2945
ord2944
ord2846
ord11103
ord4622
ord4903
ord5095
ord8439
ord4881
ord5123
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord7357
ord9286
ord8305
ord381
ord4345
ord2184
ord5830
ord3439
ord316
ord4283
ord1448
ord1982
ord901
ord5837
ord1929
ord6314
ord1296
ord13280
ord3431
ord2614
ord7862
ord3743
ord2776
ord8227
ord5857
ord1900
ord422
ord3621
ord5627
ord978
ord5803
ord2061
ord1952
ord1890
ord7876
ord7584
ord7510
ord11726
ord13767
ord4724
ord2163
ord11420
ord11421
ord13301
ord7073
ord13299
ord8486
ord3676
ord3618
ord11806
ord6680
ord7091
ord2088
msvcr100
_itoa
_mkdir
_ltoa
_strnicmp
_setmbcp
strrchr
exit
strcpy_s
fopen
fputs
fclose
??0exception@std@@QAE@ABQBD@Z
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
system
sprintf_s
atof
fseek
ftell
wcscpy_s
wcscat_s
_chmod
printf
_vsnprintf
_set_errno
wcstombs_s
mbstowcs_s
_stat64i32
strstr
_mbsstr
_vswprintf
_resetstkoflw
rename
_localtime64
memchr
remove
strftime
_localtime64_s
_time64
_purecall
floor
ceil
_mbscmp
_ismbcalpha
strcat_s
_mbsnbcpy
feof
fgets
fprintf
malloc
rand
fsetpos
_fseeki64
fgetpos
memcpy_s
fwrite
atoi
setvbuf
fflush
_unlock_file
_lock_file
ungetc
fputc
fgetc
_recalloc
calloc
free
??0exception@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
_CxxThrowException
??0bad_cast@std@@QAE@PBD@Z
memset
memmove
memcpy
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
__CxxFrameHandler3
kernel32
GetFullPathNameW
HeapFree
GlobalMemoryStatusEx
FileTimeToSystemTime
CreatePipe
SetHandleInformation
CreateProcessA
GetExitCodeProcess
FormatMessageA
LocalSize
LocalFree
GetModuleFileNameW
ExpandEnvironmentStringsA
GetVersionExA
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
RemoveDirectoryA
FindNextFileW
FindClose
FindFirstFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
ReadFile
SetFilePointer
FreeLibrary
lstrlenW
LocalAlloc
GlobalAlloc
WriteFile
GlobalFree
MoveFileA
GetExitCodeThread
CreateMutexW
GetComputerNameA
GetComputerNameExA
SetEvent
GetCurrentDirectoryA
WaitForMultipleObjects
TerminateThread
CreateThread
InterlockedExchangeAdd
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CopyFileA
lstrcmpA
FindFirstFileA
HeapAlloc
FindNextFileA
OpenProcess
ActivateActCtx
DeactivateActCtx
SetLastError
GetProcAddress
LoadLibraryA
SetFileAttributesA
CreateFileA
GetFileSize
CloseHandle
lstrcpynW
WideCharToMultiByte
InterlockedDecrement
GetModuleHandleA
GetTickCount
FindResourceA
LoadResource
LockResource
SizeofResource
GetModuleFileNameA
GetTempPathA
InitializeCriticalSectionAndSpinCount
GetFileAttributesA
CreateDirectoryA
lstrlenA
MultiByteToWideChar
GetLastError
DeleteFileA
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
UnmapViewOfFile
GetProcessHeap
Sleep
user32
DefWindowProcA
SetWindowLongA
GetWindowLongA
ReleaseDC
GetDC
SetRect
GetMessageExtraInfo
GetDesktopWindow
InvalidateRect
GetSystemMetrics
SendInput
GetCursorPos
GetParent
KillTimer
SetTimer
DestroyWindow
ShowWindow
FillRect
RegisterClassA
DrawTextA
SetWindowPos
GetWindowRect
FindWindowA
PostMessageA
EnableMenuItem
GetForegroundWindow
SetForegroundWindow
IsWindowVisible
IsWindowEnabled
CopyRect
GetClientRect
IsWindow
GetClassNameA
DisableProcessWindowsGhosting
GetSystemMenu
DeleteMenu
RegisterWindowMessageA
EnableWindow
GetWindow
SendMessageA
CreateWindowExA
LoadImageA
SetWindowTextA
SetWindowRgn
PostQuitMessage
GetWindowThreadProcessId
GetClassNameW
EnumWindows
LoadBitmapW
SendMessageTimeoutA
IntersectRect
SetRectEmpty
IsRectEmpty
FlashWindowEx
IsZoomed
BringWindowToTop
SetCursor
LoadCursorA
RegisterClassExA
SendNotifyMessageA
EnumChildWindows
GetKeyState
GetWindowTextA
wsprintfA
MessageBoxA
LoadIconW
WindowFromPoint
GetFocus
IsIconic
AppendMenuA
DrawIcon
gdi32
CreateCompatibleBitmap
GetPixel
CreateRectRgn
CombineRgn
GetTextExtentPoint32A
SetTextColor
MoveToEx
LineTo
SetBkColor
DeleteDC
CreatePen
GetStockObject
RoundRect
CreateSolidBrush
EndDoc
AbortDoc
EndPage
StartPage
StartDocA
StretchBlt
GetMapMode
BitBlt
RectInRegion
CreateCompatibleDC
CreateBitmap
GetObjectA
GetDeviceCaps
SelectObject
DeleteObject
CreateFontA
winspool.drv
DocumentPropertiesA
GetPrinterA
OpenPrinterA
EnumPrintersA
ord201
SetPrinterA
ClosePrinter
ord202
advapi32
RegRenameKey
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatusEx
RegDeleteKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
InitiateSystemShutdownExA
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
GetTokenInformation
LookupAccountSidA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegQueryValueExA
GetUserNameA
RegQueryInfoKeyA
RegEnumValueA
CryptDecrypt
CryptEncrypt
CryptHashData
CryptDeriveKey
CryptDestroyHash
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
RegQueryValueExW
RegCloseKey
RegGetValueA
shell32
SHQueryRecycleBinA
SHGetKnownFolderPath
SHEmptyRecycleBinA
SHGetFolderPathA
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
ShellExecuteA
shlwapi
PathRemoveFileSpecA
PathFindFileNameA
SHDeleteKeyA
PathFileExistsA
PathFindExtensionW
PathFindExtensionA
StrCmpW
ole32
CoCreateInstance
CoInitialize
CreateBindCtx
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoTaskMemFree
oleaut32
VarBstrCmp
SysStringLen
SysAllocStringLen
SysFreeString
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
SysAllocString
urlmon
URLDownloadToFileA
ObtainUserAgentString
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
msvcp100
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?id@?$codecvt@DDH@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_BADOFF@std@@3_JB
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??1_Container_base12@std@@QAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??Bios_base@std@@QBEPAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
crypt32
CertGetNameStringA
wintrust
WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
ws2_32
inet_ntoa
gethostbyname
WSACleanup
WSAStartup
gethostname
Sections
.text Size: 683KB - Virtual size: 683KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 219KB - Virtual size: 219KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ