Static task
static1
Behavioral task
behavioral1
Sample
2f181eb969c7f55ebcee240bdd11ede15d3032e27a5e0e51549f47662a2cae68.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2f181eb969c7f55ebcee240bdd11ede15d3032e27a5e0e51549f47662a2cae68.exe
Resource
win10v2004-20240226-en
General
-
Target
2f181eb969c7f55ebcee240bdd11ede15d3032e27a5e0e51549f47662a2cae68
-
Size
200KB
-
MD5
c3e9653873f65823f9c6b6ea18a161e2
-
SHA1
bfe719077e802981e34734fad254ea3e88162081
-
SHA256
2f181eb969c7f55ebcee240bdd11ede15d3032e27a5e0e51549f47662a2cae68
-
SHA512
3c6f439be63ec85c07c7dd647b873b418628d456f96ca10471a9882bde5cdc7e07eb685fb83ab44a9b1cdc27a358aa32da836554b647caaf07d4e2b51fb23e63
-
SSDEEP
3072:7fwBsehDes0mGDb3gfZMGGSeGrjipbH2/50qLK6iCDebutxuXHJiB:Dxehy9yG4GbH2Bu6iCDequC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2f181eb969c7f55ebcee240bdd11ede15d3032e27a5e0e51549f47662a2cae68
Files
-
2f181eb969c7f55ebcee240bdd11ede15d3032e27a5e0e51549f47662a2cae68.exe windows:4 windows x86 arch:x86
ecf6a9824f30921039b12be4b086df51
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetFilePointer
IsValidCodePage
GetOEMCP
GetCPInfo
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateThread
HeapSize
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
GetStartupInfoW
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualQuery
GetSystemInfo
GetModuleHandleA
VirtualProtect
GetSystemTimeAsFileTime
HeapReAlloc
RtlUnwind
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetTickCount
lstrcmpiW
FreeEnvironmentStringsA
GetModuleFileNameA
Sleep
GetLocalTime
lstrlenA
CreateEventW
SetEvent
CloseHandle
WaitForSingleObject
LoadLibraryW
GetModuleFileNameW
MultiByteToWideChar
GetLastError
RaiseException
FindFirstFileW
FindClose
lstrlenW
SetLastError
GetProcAddress
GetCurrentProcess
FlushInstructionCache
GetVersionExW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetEnvironmentStrings
EnterCriticalSection
user32
PeekMessageW
GetClassInfoExW
LoadCursorW
RegisterClassExW
SetWindowLongW
GetWindowLongW
SendMessageW
MoveWindow
PostMessageW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetMenu
SetWindowPos
GetClientRect
GetWindowPlacement
SetWindowPlacement
TrackPopupMenuEx
MessageBeep
LoadStringA
PostQuitMessage
SetFocus
MonitorFromPoint
GetMonitorInfoW
GetMenuItemInfoW
RemoveMenu
GetMenuItemCount
AppendMenuW
CreatePopupMenu
DestroyMenu
EndPaint
BeginPaint
InflateRect
ReleaseCapture
PtInRect
GetCapture
GetDlgCtrlID
SetCapture
IsWindowEnabled
UpdateWindow
DrawEdge
ClientToScreen
DrawFocusRect
CallWindowProcW
LoadMenuW
LoadAcceleratorsW
DestroyWindow
UnregisterClassA
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
PostThreadMessageW
CharNextW
LoadStringW
GetSystemMetrics
LoadImageW
DestroyIcon
GetActiveWindow
IsWindowVisible
ReleaseDC
GetWindowDC
CreateWindowExW
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
MapWindowPoints
IsWindow
AdjustWindowRectEx
MessageBoxW
KillTimer
SetTimer
ShowWindow
InvalidateRect
gdi32
GetDeviceCaps
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegDeleteKeyA
RegCloseKey
RegSetValueA
RegCreateKeyA
RegSetValueExA
ole32
CoTaskMemAlloc
CoTaskMemFree
ProgIDFromCLSID
CoFileTimeNow
CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoSuspendClassObjects
CoUninitialize
CoResumeClassObjects
CoInitializeSecurity
CoInitializeEx
CoInitialize
oleaut32
VariantCopy
VariantInit
VariantClear
SystemTimeToVariantTime
SysFreeString
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
tscommon
??0?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAE@PAUIAtlStringMgr@1@@Z
?GetManager@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QBEPAUIAtlStringMgr@2@XZ
?ReleaseBuffer@?$CSimpleStringT@_W$0A@@ATL@@QAEXH@Z
?GetBuffer@?$CSimpleStringT@_W$0A@@ATL@@QAEPA_WH@Z
?Clear@CFullUser@@QAEXXZ
??0?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAE@XZ
??1?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@QAE@XZ
?Write@XFile@@QAEHPBXI@Z
??0?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@QAE@PB_W@Z
??4?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAEAAV01@PB_W@Z
??1XFile@@QAE@XZ
?Trim@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAEAAV12@PB_W@Z
??4?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAEAAV01@PBD@Z
?Read@XFile@@QAEHPAXI@Z
?OpenW@XFile@@QAE_NPB_WH_N@Z
??0XFile@@QAE@XZ
??4?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAEAAV01@ABV01@@Z
?IsEmpty@?$CSimpleStringT@_W$0A@@ATL@@QBE_NXZ
??1TiXmlDocument@@UAE@XZ
?GetLocStr@@YAPB_WI@Z
?Attribute@TiXmlElement@@QBE_NPBDAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?Attribute@TiXmlElement@@QBEHPBDH@Z
?FirstChildElement@TiXmlNode@@QBEPBVTiXmlElement@@XZ
?StringLength@?$CSimpleStringT@_W$0A@@ATL@@SAHPB_W@Z
??0TiXmlDocument@@QAE@XZ
??1CFullUser@@QAE@XZ
?Truncate@?$CSimpleStringT@_W$0A@@ATL@@QAEXH@Z
??0?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAE@ABV01@@Z
??0CFullUser@@QAE@XZ
?ReverseFind@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QBEH_W@Z
?Find@?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@QBEHDH@Z
?MakeLower@?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@QAEAAV12@XZ
?Attribute@TiXmlElement@@QBE_NPBDAAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@Z
??0?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@QAE@XZ
?Append@?$CSimpleStringT@_W$0A@@ATL@@QAEXPB_W@Z
?Left@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QBE?AV12@H@Z
??1XVariant@@QAE@XZ
?SetTagValue@CTag@@QAE_NABVXVariant@@PBVCUser@@@Z
?InternalCopy@XVariant@@IAEXPBUtagVARIANT@@@Z
?ToFloat@XVariant@@QBEMXZ
?Compare@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QBEHPB_W@Z
?Empty@?$CSimpleStringT@_W$0A@@ATL@@QAEXXZ
?DispartDrvTagName@_SourceTag@@YAXABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAV23@1PAE@Z
?AllocSysString@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QBEPA_WXZ
?Next@TiXmlAttribute@@QBEPBV1@XZ
?Trim@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAEAAV12@XZ
?Tokenize@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QBE?AV12@PB_WAAH@Z
?Name@TiXmlAttribute@@QBEPBDXZ
?FirstAttribute@TiXmlElement@@QAEPAVTiXmlAttribute@@XZ
?GetElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
?Format@?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAAXPB_WZZ
??A?$CSimpleStringT@_W$0A@@ATL@@QBE_WH@Z
?GetLength@?$CSimpleStringT@_W$0A@@ATL@@QBEHXZ
?Concatenate@?$CSimpleStringT@_W$0A@@ATL@@KAXAAV12@PB_WH1H@Z
??0?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAE@PB_W@Z
??1?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@QAE@XZ
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
atl80
ord31
ord18
ord22
ord30
ord17
ord20
ord49
ord58
ord61
ord23
ord44
ord64
ord32
ord43
comctl32
ImageList_Create
ImageList_Destroy
ImageList_GetIconSize
InitCommonControlsEx
_TrackMouseEvent
ImageList_Draw
ImageList_ReplaceIcon
Sections
.text Size: 128KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ