Static task
static1
Behavioral task
behavioral1
Sample
04931de448baf2f4f4b1f38f137864a4c9778cb057089d77aa0398872c2fa6d9.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
04931de448baf2f4f4b1f38f137864a4c9778cb057089d77aa0398872c2fa6d9.exe
Resource
win10v2004-20240611-en
General
-
Target
04931de448baf2f4f4b1f38f137864a4c9778cb057089d77aa0398872c2fa6d9
-
Size
196KB
-
MD5
51aafd0bd6eacc98d3773610c804ae34
-
SHA1
f15ba03b0d298dd6f82798c431c81d83ab4e06a9
-
SHA256
04931de448baf2f4f4b1f38f137864a4c9778cb057089d77aa0398872c2fa6d9
-
SHA512
ad972d7f577a10e55b97ce1731933d1abf7c0714299dec17cd3b4d0564d842bfb842d8eabaa17c4aa02d5728e30c6bec7b00ee381ddeba4b6b273ee850215642
-
SSDEEP
3072:O1RXXVoxTAhPm0q03+JmnLCJsh+VkcgkzGrdTC77xLMy2sc1ZS:oXCxTAhPnq03ym+Oy2syZS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04931de448baf2f4f4b1f38f137864a4c9778cb057089d77aa0398872c2fa6d9
Files
-
04931de448baf2f4f4b1f38f137864a4c9778cb057089d77aa0398872c2fa6d9.exe windows:4 windows x86 arch:x86
93989dee74e2c4efb4d4920f2dc44a4a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetLocalTime
LoadLibraryA
Sleep
SetUnhandledExceptionFilter
lstrcmpiA
GetCommandLineA
InterlockedIncrement
GetCurrentThreadId
GlobalUnlock
GlobalLock
GlobalAlloc
FlushInstructionCache
HeapAlloc
CreateThread
LocalFree
GetStartupInfoA
GetModuleHandleA
GetLastError
VirtualQuery
GetModuleFileNameA
WaitForSingleObject
GetDiskFreeSpaceExA
InterlockedDecrement
HeapFree
SetEvent
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
OpenProcess
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
GetCurrentProcessId
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
LoadLibraryExA
GetProcAddress
FreeLibrary
GlobalFree
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
GetProcessHeap
lstrlenA
user32
DispatchMessageA
PostMessageA
SendMessageA
SetWindowLongA
GetWindowThreadProcessId
GetParent
CallWindowProcA
CreateWindowExA
ShowWindow
SetFocus
IntersectRect
EqualRect
OffsetRect
DestroyWindow
SetWindowPos
UnionRect
PtInRect
GetKeyState
BeginPaint
GetClientRect
EndPaint
InvalidateRect
IsWindow
GetFocus
IsChild
GetMessageA
SetWindowRgn
wsprintfA
CharNextA
PostThreadMessageA
GetWindowLongA
DefWindowProcA
gdi32
SetWindowExtEx
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
TextOutA
SetTextAlign
Rectangle
RestoreDC
DeleteDC
CreateMetaFileA
SetViewportOrgEx
comdlg32
GetOpenFileNameA
GetSaveFileNameA
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
ole32
OleRegGetMiscStatus
CoTaskMemAlloc
CreateOleAdviseHolder
OleRegGetUserType
CreateDataAdviseHolder
OleRegEnumVerbs
CoTaskMemFree
CoInitialize
CoUninitialize
oleaut32
SysFreeString
GetErrorInfo
SetErrorInfo
SysAllocStringLen
SysAllocString
VariantInit
CreateErrorInfo
VariantChangeType
OleCreatePropertyFrame
VariantClear
SysStringLen
LoadRegTypeLi
videowindow
CreateVideoWindow
ReleaseVideoWindow
surveillance
CleanupApp
ReleaseTransImp
GetTransModuleImp
InitApp
atl
ord21
ord43
ord44
ord51
ord50
ord46
ord27
ord26
ord31
ord30
ord58
ord32
ord20
ord17
ord57
ord23
ord16
ord18
msvcp60
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??1_Lockit@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0_Lockit@std@@QAE@XZ
msvcrt
strncpy
memset
__CxxFrameHandler
??1type_info@@UAE@XZ
_snprintf
strlen
malloc
memcpy
sprintf
_ftol
??2@YAPAXI@Z
free
strcmp
abs
strstr
_access
strcpy
_mbsrchr
_purecall
memcmp
realloc
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
wcslen
_CxxThrowException
strcat
winmm
PlaySoundA
timeBeginPeriod
timeSetEvent
timeKillEvent
shlwapi
PathAppendA
PathRemoveFileSpecA
PathAddBackslashA
Sections
.text Size: 120KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 394KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ