Static task
static1
Behavioral task
behavioral1
Sample
651acd2711a57e69b331bb4588e1bcb6da3808b1f384084b1cad0d74d9027fbf.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
651acd2711a57e69b331bb4588e1bcb6da3808b1f384084b1cad0d74d9027fbf.exe
Resource
win10v2004-20240802-en
General
-
Target
651acd2711a57e69b331bb4588e1bcb6da3808b1f384084b1cad0d74d9027fbf
-
Size
526KB
-
MD5
e53b841fc967e14f7ef60e8f96f3d65e
-
SHA1
a24d26ced4308cec4487564dd6a7874dc5ddf724
-
SHA256
651acd2711a57e69b331bb4588e1bcb6da3808b1f384084b1cad0d74d9027fbf
-
SHA512
6bc8c90729b586ec25bdbfd2e53f4e08d965f4f0023dbfc35e2738d4ec14168a881674d4b9c9461a956ff4359b360cba5e6843b1c03743d7de4c8cee38b20f52
-
SSDEEP
12288:8SGzvnuxQHJQcMfLCFf5bv0ua0WZDzS0oMonPmloOulXouxfgA4FTExMBs2PAdUc:8SGW75oPBOIXJgA4FTExMBs2PAdUV8aq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 651acd2711a57e69b331bb4588e1bcb6da3808b1f384084b1cad0d74d9027fbf
Files
-
651acd2711a57e69b331bb4588e1bcb6da3808b1f384084b1cad0d74d9027fbf.exe windows:6 windows x86 arch:x86
2645525c9c1ff353d3d9b5aaeb95f8c3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
powrprof
CallNtPowerInformation
user32
GetWindowLongW
DestroyWindow
CreateWindowExW
UnregisterClassW
SetWindowLongW
DefWindowProcW
PostMessageW
DispatchMessageW
TranslateMessage
GetMessageW
RegisterClassW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winhttp
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
advapi32
SystemFunction036
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
RevertToSelf
ImpersonateNamedPipeClient
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegCloseKey
kernel32
CreateProcessW
Sleep
SleepEx
AddVectoredExceptionHandler
GetFileAttributesW
CreateDirectoryW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
DeleteCriticalSection
FindFirstFileExW
FindNextFileW
GetFileTime
RemoveDirectoryW
InitializeCriticalSection
InitOnceBeginInitialize
DeleteFileW
InitOnceComplete
SetUnhandledExceptionFilter
SetProcessShutdownParameters
SetConsoleCtrlHandler
GetProcessTimes
SuspendThread
ResumeThread
GetProcessId
GetThreadContext
VerSetConditionMask
IsProcessorFeaturePresent
GetSystemInfo
VerifyVersionInfoW
GetTimeZoneInformation
GetThreadLocale
GetSystemDefaultLCID
GetUserDefaultLCID
GetModuleFileNameW
DuplicateHandle
GetLastError
ConnectNamedPipe
DisconnectNamedPipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcess
CreateThread
OpenProcess
UnregisterWaitEx
RegisterWaitForSingleObject
GetFileInformationByHandleEx
SetLastError
IsWow64Process
GetModuleHandleW
FormatMessageA
VirtualQueryEx
ReadProcessMemory
GetSystemTimeAsFileTime
GetProcAddress
LoadLibraryW
FindClose
CloseHandle
RemoveVectoredExceptionHandler
LocalFree
CreateFileW
SetNamedPipeHandleState
TransactNamedPipe
CreateNamedPipeW
WaitNamedPipeW
GetVersion
TerminateProcess
ReleaseSemaphore
CreateSemaphoreW
GetStdHandle
GetFileType
LockFileEx
ReadFile
SetEndOfFile
SetFilePointerEx
UnlockFileEx
WriteFile
OutputDebugStringW
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
msvcp140
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?_Xout_of_range@std@@YAXPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?_Xbad_alloc@std@@YAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
vcruntime140
__std_exception_destroy
_CxxThrowException
__std_exception_copy
_except_handler4_common
__current_exception_context
__current_exception
strchr
memchr
_purecall
memset
memmove
memcpy
__CxxFrameHandler3
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_crt_atexit
_controlfp_s
_cexit
_exit
signal
exit
_initterm_e
_c_exit
__p___wargv
_initterm
_invalid_parameter_noinfo_noreturn
_invoke_watson
__p___argc
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
terminate
_errno
_set_app_type
_seh_filter_exe
abort
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vsscanf
fflush
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf_p
api-ms-win-crt-string-l1-1-0
isspace
tolower
strnlen
isalnum
wcsnlen
_wcsicmp
wcsncmp
strncmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-heap-l1-1-0
_aligned_malloc
_callnewh
free
malloc
_aligned_free
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
strtoull
api-ms-win-crt-math-l1-1-0
__setusermatherr
_dclass
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_wstat64
Sections
.text Size: 380KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CPADinfo Size: 512B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ