Static task
static1
Behavioral task
behavioral1
Sample
30ec21504555e6c0c605d88c651ccc6b14b71c60f7eced4cfa80615d6e650c0a.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
30ec21504555e6c0c605d88c651ccc6b14b71c60f7eced4cfa80615d6e650c0a.dll
Resource
win10v2004-20240704-en
General
-
Target
30ec21504555e6c0c605d88c651ccc6b14b71c60f7eced4cfa80615d6e650c0a.exe
-
Size
171KB
-
MD5
99cbf98324c8bd9a2c9bb9267aa74560
-
SHA1
025e7eab79d283f5bb368686e6b97efdb15efcd1
-
SHA256
30ec21504555e6c0c605d88c651ccc6b14b71c60f7eced4cfa80615d6e650c0a
-
SHA512
f6e9ea9cd273e235e5e3dbd0d20ccebdba94a74f6b243373f82f3f46e0a434ef2339f825ce92fd8bbc3077cf4254e0aa44505fd6c7cbdec36229f6cb9be1e823
-
SSDEEP
3072:xfeqwhCuMEAmBLBYBDi6MVbZ12Plhi4ZT0tIgH8StluZfuqW/tPEmRznQ3TF6o:e/HyB/MFZchRT0Z8StluZGqW/VEmRzng
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30ec21504555e6c0c605d88c651ccc6b14b71c60f7eced4cfa80615d6e650c0a.exe
Files
-
30ec21504555e6c0c605d88c651ccc6b14b71c60f7eced4cfa80615d6e650c0a.exe.dll windows:4 windows x64 arch:x64
aef902b2fb5277b37673943cc2d1d1e0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB Paths
Imports
msys-2.0
__assert_func
__cxa_atexit
__errno
__getreent
__locale_ctype_ptr
__locale_mb_cur_max
_impure_ptr
abort
calloc
cfsetispeed
cfsetospeed
close
closedir
cygwin_internal
dll_dllcrt0
endpwent
execlp
exit
fchmod
fclose
fcntl
fdopen
fflush
fileno
fopen
fork
fprintf
fputc
fputs
fread
free
fseeko
ftell
ftello
ftruncate
fwrite
getc
getenv
getline
getpwent
getpwnam_r
getpwuid
getpwuid_r
getuid
ioctl
isatty
iswalnum
iswalpha
iswcntrl
iswdigit
iswgraph
iswlower
iswprint
iswspace
iswupper
kill
longjmp
lseek
malloc
mbrtowc
mbsrtowcs
mbstowcs
memcpy
memmove
memset
mkstemp
msys_detach_dll
opendir
posix_memalign
qsort
read
readdir
realloc
regcomp
regexec
regfree
secure_getenv
setjmp
setpwent
sigaction
sigaddset
sigemptyset
sigprocmask
snprintf
stat
strcasecmp
strchr
strcmp
strcoll
strcpy
strdup
strlcpy
strlen
strncmp
strrchr
strstr
strtol
tcgetattr
tcsetattr
tolower
towlower
towupper
unlink
vsnprintf
waitpid
wcrtomb
wcschr
wcscmp
wcscspn
wcslen
wcsncmp
wcsncpy
wcsstr
wcstol
wcstombs
wctob
wctomb
wcwidth
wmemcpy
write
msys-ncursesw6
tgetent
tgetflag
tgetnum
tgetstr
tgoto
tputs
kernel32
GetModuleHandleA
Exports
Exports
__gcc_deregister_frame
__gcc_register_frame
_el_fn_complete
_el_fn_sh_complete
_rl_abort_internal
_rl_complete_mark_directories
_rl_completion_prefix_display_length
_rl_echoing_p
_rl_erase_entire_line
_rl_print_completions_horizontally
_rl_qsort_string_compare
add_history
append_history
c__next_word
c__prev_word
c_delafter
c_delafter1
c_delbefore
c_delbefore1
c_gets
c_hmatch
c_hpos
c_insert
c_setpat
ce__isword
ce_inc_search
ce_search_line
ch_aliasfun
ch_end
ch_enlargebufs
ch_init
ch_reset
ch_resizefun
clear_history
completion_matches
ct_chr_class
ct_decode_argv
ct_decode_string
ct_enc_width
ct_encode_char
ct_encode_string
ct_visual_char
ct_visual_string
ct_visual_width
current_history
cv__endword
cv__isWord
cv__isword
cv_csearch
cv_delfini
cv_next_word
cv_prev_word
cv_repeat_srch
cv_search
cv_undo
cv_yank
ed_argument_digit
ed_clear_screen
ed_command
ed_delete_next_char
ed_delete_prev_char
ed_delete_prev_word
ed_digit
ed_end_of_file
ed_ignore
ed_insert
ed_kill_line
ed_move_to_beg
ed_move_to_end
ed_newline
ed_next_char
ed_next_history
ed_next_line
ed_prev_char
ed_prev_history
ed_prev_line
ed_prev_word
ed_quoted_insert
ed_redisplay
ed_search_next_history
ed_search_prev_history
ed_sequence_lead_in
ed_start_over
ed_transpose_chars
ed_unassigned
el_beep
el_cursor
el_deletestr
el_deletestr1
el_editmode
el_end
el_get
el_getc
el_gets
el_init
el_init_fd
el_init_internal
el_insertstr
el_line
el_match
el_parse
el_push
el_read_getfn
el_read_setfn
el_replacestr
el_reset
el_resize
el_set
el_source
el_wget
el_wgetc
el_wgets
el_winsertstr
el_wline
el_wparse
el_wpush
el_wreplacestr
el_wset
em_capitol_case
em_copy_prev_word
em_copy_region
em_delete_next_word
em_delete_or_list
em_delete_prev_char
em_exchange_mark
em_gosmacs_transpose
em_inc_search_next
em_inc_search_prev
em_kill_line
em_kill_region
em_lower_case
em_meta_next
em_next_word
em_set_mark
em_toggle_overwrite
em_universal_argument
em_upper_case
em_yank
emacs_ctlx_keymap
emacs_meta_keymap
emacs_standard_keymap
filename_completion_function
fn_complete
fn_complete2
fn_display_match_list
fn_filename_completion_function
fn_tilde_expand
free_history_entry
get_history_event
hist_command
hist_convert
hist_end
hist_enlargebuf
hist_get
hist_init
hist_set
history
history_arg_extract
history_base
history_end
history_expand
history_expansion_char
history_get
history_get_history_state
history_inhibit_expansion_function
history_init
history_is_stifled
history_length
history_list
history_max_entries
history_no_expand_chars
history_offset
history_search
history_search_pos
history_search_prefix
history_set_pos
history_subst_char
history_tokenize
history_total_bytes
history_truncate_file
history_w
history_wend
history_winit
keymacro__decode_str
keymacro_add
keymacro_clear
keymacro_delete
keymacro_end
keymacro_get
keymacro_init
keymacro_kprint
keymacro_map_cmd
keymacro_map_str
keymacro_print
keymacro_reset
literal_add
literal_clear
literal_end
literal_get
literal_init
map_addfunc
map_bind
map_end
map_get_editor
map_init
map_init_emacs
map_init_vi
map_set_editor
max_input_history
next_history
nvis
parse__escape
parse__string
parse_cmd
parse_line
previous_history
prompt_end
prompt_get
prompt_init
prompt_print
prompt_set
re_clear_display
re_clear_lines
re_fastaddc
re_goto_bottom
re_putc
re_putliteral
re_refresh
re_refresh_cursor
read_end
read_finish
read_history
read_init
read_prepare
readline
readline_echoing_p
reallocarr
remove_history
replace_history_entry
rl_abort
rl_add_defun
rl_already_prompted
rl_attempted_completion_function
rl_attempted_completion_over
rl_basic_quote_characters
rl_basic_word_break_characters
rl_bind_key
rl_bind_key_in_map
rl_callback_handler_install
rl_callback_handler_remove
rl_callback_read_char
rl_catch_signals
rl_catch_sigwinch
rl_cleanup_after_signal
rl_complete
rl_completer_quote_characters
rl_completer_word_break_characters
rl_completion_append_character
rl_completion_display_matches_hook
rl_completion_entry_function
rl_completion_matches
rl_completion_query_items
rl_completion_suppress_append
rl_completion_type
rl_completion_word_break_hook
rl_copy_text
rl_crlf
rl_delete_text
rl_deprep_term_function
rl_deprep_terminal
rl_ding
rl_directory_completion_hook
rl_display_match_list
rl_display_prompt
rl_done
rl_echo_signal_char
rl_end
rl_erase_empty_line
rl_event_hook
rl_filename_completion_desired
rl_filename_completion_function
rl_forced_update_display
rl_free_line_state
rl_generic_bind
rl_get_keymap
rl_get_previous_history
rl_get_screen_size
rl_getc_function
rl_ignore_completion_duplicates
rl_inhibit_completion
rl_initialize
rl_insert
rl_insert_text
rl_instream
rl_kill_text
rl_library_version
rl_line_buffer
rl_linefunc
rl_make_bare_keymap
rl_message
rl_newline
rl_on_new_line
rl_outstream
rl_parse_and_bind
rl_point
rl_pre_input_hook
rl_prep_term_function
rl_prep_terminal
rl_prompt
rl_prompt_saved
rl_read_init_file
rl_read_key
rl_readline_name
rl_readline_state
rl_readline_version
rl_redisplay
rl_redisplay_function
rl_replace_line
rl_reset_after_signal
rl_reset_terminal
rl_resize_terminal
rl_restore_prompt
rl_save_prompt
rl_set_key
rl_set_keyboard_input_timeout
rl_set_keymap
rl_set_keymap_name
rl_set_prompt
rl_set_screen_size
rl_sort_completion_matches
rl_special_prefixes
rl_startup1_hook
rl_startup_hook
rl_stuff_char
rl_terminal_name
rl_variable_bind
search_end
search_init
sig_clr
sig_end
sig_init
sig_set
snvis
stifle_history
stravis
strenvisx
strnunvis
strnunvisx
strnvis
strnvisx
strsenvisx
strsnvis
strsnvisx
strsvis
strsvisx
strunvis
strunvisx
strvis
strvisx
svis
terminal__flush
terminal__putc
terminal_beep
terminal_bind_arrow
terminal_change_size
terminal_clear_EOL
terminal_clear_arrow
terminal_clear_screen
terminal_deletechars
terminal_echotc
terminal_end
terminal_get
terminal_get_size
terminal_gettc
terminal_init
terminal_insertwrite
terminal_move_to_char
terminal_move_to_line
terminal_overwrite
terminal_print_arrow
terminal_set
terminal_set_arrow
terminal_settc
terminal_telltc
terminal_writec
tilde_expand
tok_end
tok_init
tok_line
tok_reset
tok_str
tok_wend
tok_winit
tok_wline
tok_wreset
tok_wstr
tty_bind_char
tty_cookedmode
tty_end
tty_get_signal_character
tty_init
tty_noquotemode
tty_quotemode
tty_rawmode
tty_stty
unstifle_history
unvis
username_completion_function
using_history
vi_add
vi_add_at_eol
vi_alias
vi_change_case
vi_change_meta
vi_change_to_eol
vi_command_mode
vi_comment_out
vi_delete_meta
vi_delete_prev_char
vi_end_big_word
vi_end_word
vi_histedit
vi_history_word
vi_insert
vi_insert_at_bol
vi_kill_line_prev
vi_list_or_eof
vi_match
vi_next_big_word
vi_next_char
vi_next_word
vi_paste_next
vi_paste_prev
vi_prev_big_word
vi_prev_char
vi_prev_word
vi_redo
vi_repeat_next_char
vi_repeat_prev_char
vi_repeat_search_next
vi_repeat_search_prev
vi_replace_char
vi_replace_mode
vi_search_next
vi_search_prev
vi_substitute_char
vi_substitute_line
vi_to_column
vi_to_history_line
vi_to_next_char
vi_to_prev_char
vi_undo
vi_undo_line
vi_yank
vi_yank_end
vi_zero
vis
wcsdup
where_history
write_history
Sections
.text Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.buildid Size: 512B - Virtual size: 53B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 15KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ