Static task
static1
Behavioral task
behavioral1
Sample
986249b263c38179100ace88d81c541408d68ac50681052f9609917b9608684d.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
986249b263c38179100ace88d81c541408d68ac50681052f9609917b9608684d.exe
Resource
win10v2004-20240802-en
General
-
Target
986249b263c38179100ace88d81c541408d68ac50681052f9609917b9608684d
-
Size
125KB
-
MD5
8f5ea350d4671378d75a5d7be8ed10a2
-
SHA1
d192e3c1972f83fd0d59fdbaf370880cff4f009e
-
SHA256
986249b263c38179100ace88d81c541408d68ac50681052f9609917b9608684d
-
SHA512
427dafee91562571c4b31843dae9b331f12ca081a1f2dbfbe44502c81e843249e38a16b30dc0d1f28ad7af9e97ecfbd1710dda2fcbb8dde5637a251e42d06af2
-
SSDEEP
1536:Rqi1b2XFWRoCT7IEyEGEvEzKMk7YhmfHw5zE26DZi7kBQCx5XAVsL8BdlN9Pg30H:vbJoCT7IPLK2KGmPi7kB75XAWaF9PGC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 986249b263c38179100ace88d81c541408d68ac50681052f9609917b9608684d
Files
-
986249b263c38179100ace88d81c541408d68ac50681052f9609917b9608684d.exe windows:1 windows x86 arch:x86
0488971f53c50adfb3a293e2f37e8c52
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
clarun
Cla$ADDqueue
Cla$ALERT
Cla$CLEAR
Cla$clearstr
Cla$code
Cla$COMMAND
Cla$comparestr
Cla$DecDistinct
Cla$DISPLAY
Cla$DPopLong
Cla$DPushLong
Cla$ERRORCODE
Cla$EVENT
Cla$FILE_NEXT
Cla$FILE_SETkk
Cla$FREEqueue
Cla$FREEqueuea
Cla$freestr
Cla$freewindow
Cla$GETqueueptr
Cla$init
Cla$MessageBox
Cla$PopCString
Cla$PopString
Cla$PopTemp
Cla$POST
Cla$PushCString
Cla$PushLong
Cla$PushString
Cla$pwopen
Cla$RECORDSqueue
Cla$RemoveFile
Cla$SetPropS
Cla$SHORTPATH
Cla$Stack2DStack
Cla$StackCLIP
Cla$StackCompareN
Cla$StackConcat
Cla$StackConcatR
Cla$StackRotate
Cla$storecstr
Cla$storestr
THR$GetInstance
_exit
_free
_malloc
__a_chkstk
__e_stack
__sysinit
__sysstart
common
DBPUTINI@FsbsbsbsbOUc
QUERYCSTRINGSQL@Fsb
QUERYLONGSQL@Fsb
SETGLOSQLOWNER@FOsbOsb
STPARAMS@F12STRINGTHEORYsbsbOsb
tngroot
$GLOBALREQUEST
$GLOBALRESPONSE
$GNT:APPDATAFOLDER
$GNT:ORIGINALDATAPATH
$GNT:STATIONID
$GNT:TEMPFOLDER
$GNT:USERID
$MAILFILE
$RELATE:DBINI
$RELATE:MAILFILE
$RELATE:QUERYCSTRING
$RELATE:QUERYLONG
$VCRREQUEST
$WE::CantCloseNow
$WE::MustClose
ADDITEM@F13WINDOWMANAGER12TOOLBARCLASS
ASK@F13WINDOWMANAGER
CALLMETHOD@F6OIBASEsb12CSPWDISPATCH
CALLMETHOD@F6OIBASEsb12CSPWDISPATCH9OIVARIANT
CALLMETHOD@F6OIBASEsb12CSPWDISPATCHRlPll
CALLMETHOD@F6OIBASEsb12CSPWDISPATCHRsb
CENTIMETERSTOPOINTS@F8OIOFFICEd
CHANGEACTION@F13WINDOWMANAGER
CONSTRUCT@F10ERRORCLASS
CONSTRUCT@F10FUZZYCLASS
CONSTRUCT@F12STRINGTHEORY
CONSTRUCT@F16ERRORSTATUSCLASS
CONSTRUCT@F8INICLASS
CONSTRUCT@F9OIOUTLOOK
COUNTITEMS@F9OIOUTLOOK
CREATECONTACTGROUP@F9OIOUTLOOKsbsb
CREATEOBJECTS@F9OIOUTLOOK
DEBUG@F9OIOUTLOOKsbl
DELETEACTION@F13WINDOWMANAGER
DELETEALLITEMS@F9OIOUTLOOK
DELETEAPPOINTMENT@F9OIOUTLOOKsb
DELETECONTACT@F9OIOUTLOOKsb
DELETETASK@F9OIOUTLOOKsb
DESTROYOBJECTS@F9OIOUTLOOK
DESTRUCT@F12STRINGTHEORY
DESTRUCT@F16ERRORSTATUSCLASS
DESTRUCT@F9OIOUTLOOK
DISPLAYAPPOINTMENT@F9OIOUTLOOKsb
DISPLAYCONTACT@F9OIOUTLOOKsb
DISPLAYTASK@F9OIOUTLOOKsb
ds_CreateDirectory
ds_GetFolderPath
ds_SetEndSessionHandler
ds_SetOkToEndSessionHandler
ds_VisibleOnDesktop
ERRORTRAP@F6OICOREsbsb
ERRORTRAP@F8OIOFFICEsbsbl
EVENTITEMSEND@F9OIOUTLOOK
EVENTNEWMAIL@F9OIOUTLOOK
EVENTOPTIONSPAGESADD@F9OIOUTLOOK
EVENTQUIT@F9OIOUTLOOK
EVENTREMINDER@F9OIOUTLOOK
EVENTSTARTUP@F9OIOUTLOOK
FINDCHILDFOLDER@F9OIOUTLOOK8OIOBJECT8OIOBJECTsb
FINDITEM@F9OIOUTLOOKsb
FINDNEXT@F9OIOUTLOOK
FIRSTITEM@F9OIOUTLOOK
GETAPPOINTMENT@F9OIOUTLOOKsb
GETAPPOINTMENTSQ@F9OIOUTLOOK17OIOCALENDARQTYPE1Osb
GETCONTACT@F9OIOUTLOOKsb
GETCONTACTPROPERTYNAME@F9OIOUTLOOKl
GETCONTACTSQ@F9OIOUTLOOK17OIOCONTACTSQTYPE1Osb
GETDEFAULTFOLDER@F9OIOUTLOOK
GETEMAILBODY@F9OIOUTLOOKsbRsbl
GETEMAILBODY@F9OIOUTLOOKsbUc
GETITEM@F9OIOUTLOOKl
GETITEM@F9OIOUTLOOKl8OIOBJECT
GETITEMBYID@F9OIOUTLOOKsb8OIOBJECT
GETITEMBYVALUE@F9OIOUTLOOKsb8OIOBJECT
GETITEMS@F9OIOUTLOOKl
GETMAILATTACHMENTSQ@F9OIOUTLOOK15OIOATTACHMENTSQsb
GETMAILFOLDERSQ@F9OIOUTLOOK19OIOFOLDERNAMESQTYPEl
GETMAILITEMSQ@F9OIOUTLOOK19OIOFOLDERITEMSQTYPEOsb
GETMAILRECIPIENTSQ@F9OIOUTLOOK14OIORECIPIENTSQsb
GETNAMESPACE@F9OIOUTLOOK
GETOFFICEVERSION@F8OIOFFICE
GETTASK@F9OIOUTLOOKsb
GETTASKSQ@F9OIOUTLOOK14OIOTASKSQTYPE1Osb
GETTYPE@F6OIBASEsb12CSPWDISPATCH
GETTYPENAME@F6OIBASEl
GETVERSIONFROMREGISTRY@F8OIOFFICE
INCHESTOPOINTS@F8OIOFFICEd
INIT@F10ERRORCLASS16ERRORSTATUSCLASS
INIT@F10FUZZYCLASS
INIT@F13WINDOWMANAGER
INIT@F8INICLASSsbll
INIT@F9OIOUTLOOKUcUc
INSERTACTION@F13WINDOWMANAGER
INSERTAPPOINTMENT@F9OIOUTLOOK
INSERTCONTACT@F9OIOUTLOOK
INSERTTASK@F9OIOUTLOOK
KILL@F10FUZZYCLASS
KILL@F13WINDOWMANAGER
KILL@F8INICLASS
KILL@F9OIOUTLOOKUc
LASTITEM@F9OIOUTLOOK
LAUNCHHELPERPROCESS@F8OIOFFICEUc
LINESTOPOINTS@F8OIOFFICEl
LOG@F6OICOREsb
MAILFILE$MF:GUIDKEY
MAILFILE$MF:RECORD
MAILFILE$TYPE$MF:RECORD
MILLIMETERSTOPOINTS@F8OIOFFICEd
MOVEITEM@F9OIOUTLOOK8OIOBJECT8OIOBJECT
MOVEITEM@F9OIOUTLOOKsb8OIOBJECT
MOVEITEMS@F9OIOUTLOOKsbOsb
NEWOBJECT@F6OIBASEsb12CSPWDISPATCH12CSPWDISPATCHOlOsb
NEXTITEM@F9OIOUTLOOK
OIGETPROPERTY@F6OIBASEsb12CSPWDISPATCH12CSPWTVARIANTOl
OIGETPROPERTY@F6OIBASEsb12CSPWDISPATCHRd
OIGETPROPERTY@F6OIBASEsb12CSPWDISPATCHRl
OIGETPROPERTY@F6OIBASEsb12CSPWDISPATCHRlRl
OIGETPROPERTY@F6OIBASEsb12CSPWDISPATCHRs
OIGETPROPERTY@F6OIBASEsb12CSPWDISPATCHRsbOl
OISETPROPERTY@F6OIBASEsb12CSPWDISPATCHll
OISETPROPERTY@F6OIBASEsb12CSPWDISPATCHRd
OISETPROPERTY@F6OIBASEsb12CSPWDISPATCHRll
OISETPROPERTY@F6OIBASEsb12CSPWDISPATCHRs
OISETPROPERTY@F6OIBASEsb12CSPWDISPATCHRsb
OPEN@F13WINDOWMANAGER
OPEN@F13WINDOWMANAGERBwBw
PICASTOPOINTS@F8OIOFFICEl
PIXELSTOPOINTS@F8OIOFFICEl
POINTSTOCENTIMETERS@F8OIOFFICEl
POINTSTOINCHES@F8OIOFFICEl
POINTSTOLINES@F8OIOFFICEl
POINTSTOMILLIMETERS@F8OIOFFICEl
POINTSTOPICAS@F8OIOFFICEl
POINTSTOPIXELS@F8OIOFFICEl
PREVIOUSITEM@F9OIOUTLOOK
PRIMEFIELDS@F13WINDOWMANAGER
PRIMEUPDATE@F13WINDOWMANAGER
REMOVEITEM@F9OIOUTLOOKl
RESET@F13WINDOWMANAGERUc
RESETCOLUMNS@F9OIOUTLOOK
RESTOREFIELD@F13WINDOWMANAGERl
RESTRICT@F9OIOUTLOOKsb
RUN@F13WINDOWMANAGER
RUN@F13WINDOWMANAGERUsUc
SAVEAS@F9OIOUTLOOKsbsbl
SAVEATTACHMENT@F9OIOUTLOOKsblsbsb
SAVEONCHANGEACTION@F13WINDOWMANAGER
SAVEONINSERTACTION@F13WINDOWMANAGER
SENDEMAIL@F9OIOUTLOOKsbsbsbsbsbsbUcUc
SETALERTS@F13WINDOWMANAGER
SETCOLUMNS@F9OIOUTLOOKsb
SETOPTION@F10FUZZYCLASSUcUc
SETPROCEDURENAME@F10ERRORCLASSOsb
SETRESPONSE@F13WINDOWMANAGERUc
SETSORT@F9OIOUTLOOKsbl
SHOWMESSAGE@F8OIOFFICEsbsbsbl
TAKEACCEPTED@F13WINDOWMANAGER
TAKECLOSEEVENT@F13WINDOWMANAGER
TAKECOMPLETED@F13WINDOWMANAGER
TAKEDISABLEBUTTON@F13WINDOWMANAGERlUc
TAKEEVENT@F13WINDOWMANAGER
TAKEFIELDEVENT@F13WINDOWMANAGER
TAKENEWSELECTION@F13WINDOWMANAGER
TAKENOTIFY@F13WINDOWMANAGERlll
TAKEREJECTED@F13WINDOWMANAGER
TAKESELECTED@F13WINDOWMANAGER
TAKEWINDOWEVENT@F13WINDOWMANAGER
TOCSTRING@F6OICORERsb
TRACE@F6OICOREsb
TYPE$STRINGTHEORY
TYPE$TOOLBARCLASS
UNRESTRICT@F9OIOUTLOOK
UPDATE@F13WINDOWMANAGER
UPDATEAPPOINTMENT@F9OIOUTLOOKsb
UPDATEAPPOINTMENT@F9OIOUTLOOKsblsb
UPDATECONTACT@F9OIOUTLOOKsb
UPDATECONTACT@F9OIOUTLOOKsblsb
UPDATETASK@F9OIOUTLOOKsb
UPDATETASK@F9OIOUTLOOKsblsb
VMT$ERRORCLASS
VMT$ERRORSTATUSCLASS
VMT$FUZZYCLASS
VMT$INICLASS
VMT$STRINGTHEORY
VMT$TOOLBARCLASS
WinAlert
WinAlertMouseZoom
WITHFOLDER@F9OIOUTLOOKsb
_CLEANUP@F9OIOUTLOOK
_DELETEGENERICITEM@F9OIOUTLOOKsb
_DISPLAYGENERICITEM@F9OIOUTLOOKsb
_GETCHILDFOLDERS@F9OIOUTLOOK19OIOFOLDERNAMESQTYPE12CSPWDISPATCHsbl
_GETNEXTENDOFWORDFROMSENTENCE@F8OIOFFICERsbll
_GETNEXTSTARTOFWORDFROMSENTENCE@F8OIOFFICERsbll
_INIT@F8OIOFFICEUc
_INITITEM@F9OIOUTLOOK
_INIT_LB@F8OIOFFICEUcsb
_KILL_LB@F8OIOFFICEUc
_LOADCOM@F8OIOFFICE
_SETDEBUGLEVEL@F8OIOFFICE
_SETFOREGROUNDWINDOW@F8OIOFFICERsb
_UNLOADCOM@F8OIOFFICEUc
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cwtls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.cwdebug Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ