Behavioral task
behavioral1
Sample
Windows.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Windows.exe
Resource
win10v2004-20240802-en
General
-
Target
Windows.exe
-
Size
10.6MB
-
MD5
5f51111673afa3a3746d389d37176748
-
SHA1
3fdb88e3cfdfbbdf74367b835de849724f444cf6
-
SHA256
f0c73ede190a44722ba0dc69bdcff1198a09f9fd12f44208e69757b0a2a2b26f
-
SHA512
601ee2921ea8b587613cf3df6d685d834f0462383bcdbf0d4f9af5610457f9d22dec39ea5013903d67c810305dc844c252827d77367a66f6b1feb5230aed4503
-
SSDEEP
196608:fVXKmDJel6RWXf7Mfb0tg5dwyszCGLssNgku7D8suGm:dVsxXf75MdwEGLsVfi
Malware Config
Signatures
-
resource yara_rule sample themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Windows.exe
Files
-
Windows.exe.exe windows:6 windows x64 arch:x64
7194b54009adbb905675602a89843174
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
CryptDestroyKey
RegCloseKey
RegOpenKeyExA
OpenProcessToken
RegSetValueExA
RegQueryValueExA
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptEncrypt
CryptImportKey
RegCreateKeyA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
GetUserNameA
IsValidSid
GetTokenInformation
GetLengthSid
crypt32
CryptDecodeObjectEx
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
PFXImportCertStore
CryptStringToBinaryA
d3dcompiler_47
D3DCompile
imm32
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmGetContext
ImmReleaseContext
kernel32
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileSizeEx
OutputDebugStringW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
AreFileApisANSI
GetFileInformationByHandleEx
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
FormatMessageA
SetLastError
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetModuleFileNameA
GetLastError
Process32Next
CreateToolhelp32Snapshot
Process32First
Beep
Sleep
CreateFileA
GetCurrentProcess
GetTempPathW
SetUnhandledExceptionFilter
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
CreateFileW
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetLocaleInfoEx
MultiByteToWideChar
VerifyVersionInfoA
SleepConditionVariableSRW
GlobalAlloc
GlobalFree
GlobalLock
WakeAllConditionVariable
InitializeSListHead
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_alloc@std@@YAXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Winerror_map@std@@YAHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??4?$_Iosb@H@std@@QEAAAEAV01@$$QEAV01@@Z
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MEBAHXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
_Mtx_lock
_Mtx_unlock
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Query_perf_frequency
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Query_perf_counter
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
_Xtime_get_ticks
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV?$basic_ios@DU?$char_traits@D@std@@@1@AEAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exceptions@std@@YAHXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
normaliz
IdnToAscii
rpcrt4
UuidToStringA
RpcStringFreeA
UuidCreate
shell32
SHGetKnownFolderPath
ShellExecuteA
user32
ClientToScreen
GetCapture
GetCursorPos
OpenClipboard
CloseClipboard
EmptyClipboard
ScreenToClient
MonitorFromWindow
LoadCursorA
GetMessageExtraInfo
GetKeyState
TrackMouseEvent
SendInput
GetClipboardData
RegisterClassExA
PostQuitMessage
UnregisterClassA
PeekMessageA
TranslateMessage
GetClientRect
CreateWindowExA
DefWindowProcA
EnumWindows
GetForegroundWindow
ReleaseCapture
IsWindowUnicode
SetCursor
FindWindowA
SetCursorPos
SetClipboardData
MessageBoxA
GetWindowThreadProcessId
DispatchMessageA
GetWindowRect
SetWindowLongA
GetWindowTextA
GetWindowLongA
SetWindowDisplayAffinity
GetMonitorInfoA
MoveWindow
GetAsyncKeyState
SetLayeredWindowAttributes
SetCapture
userenv
UnloadUserProfile
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
strstr
memcmp
__C_specific_handler
_CxxThrowException
memchr
strchr
memcpy
memmove
__current_exception_context
__current_exception
strrchr
memset
vcruntime140_1
__CxxFrameHandler4
wininet
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
wldap32
ldap_unbind_s
ber_free
ldap_memfreeA
ldap_get_dnA
ldap_value_freeW
ldap_simple_bind_sA
ldap_next_attributeA
ldap_first_attributeA
ldap_next_entry
ldap_first_entry
ldap_sslinitA
ldap_initA
ldap_bind_sA
ldap_set_optionA
ldap_search_sA
ldap_msgfree
ldap_err2stringA
ldap_get_values_lenA
ws2_32
closesocket
recv
send
htonl
gethostname
sendto
recvfrom
FreeAddrInfoW
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
WSAGetLastError
setsockopt
htons
htons
getsockopt
getsockname
getpeername
connect
bind
socket
ucrtbase
strtoul
strtod
strtol
atof
atoi
_strtoui64
_strtoi64
wcstombs
getenv
_access
_fstat64
_stat64
_lock_file
_unlock_file
_unlink
_callnewh
calloc
_set_new_mode
realloc
free
malloc
_configthreadlocale
___lc_codepage_func
localeconv
powf
round
roundf
sinf
__setusermatherr
sqrtf
fmodf
cosf
ceilf
atan2f
acosf
strerror
_resetstkoflw
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
__sys_nerr
_beginthreadex
terminate
exit
system
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_Exit
_initterm_e
_getpid
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
abort
_cexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
fgets
fseek
fwrite
_wfopen
_pclose
_lseeki64
_set_fmode
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
__p__commode
fclose
_read
_write
fflush
fgetc
_close
_open
fgetpos
ftell
setvbuf
_popen
fputc
feof
fputs
__acrt_iob_func
ungetc
fopen
_get_stream_buffer_pointers
_fseeki64
fsetpos
__stdio_common_vfprintf
strncpy
isupper
strspn
tolower
_mbsdup
strcspn
strcpy_s
strncmp
strcmp
strpbrk
clock
_localtime64
_time64
_gmtime64
rand
srand
qsort
d3d11
D3D11CreateDeviceAndSwapChain
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtRaiseHardError
RtlAnsiStringToUnicodeString
RtlAdjustPrivilege
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlInitAnsiString
ole32
CoInitialize
CoUninitialize
CoCreateInstance
Sections
.text Size: 980KB - Virtual size: 980KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 216KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 169KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 35KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
.SCY Size: 15KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE