Static task
static1
Behavioral task
behavioral1
Sample
956203c6abd30d0bb3a58c9d04f9a9ed10c365d8d841872c2001cce4b8f5a352.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
956203c6abd30d0bb3a58c9d04f9a9ed10c365d8d841872c2001cce4b8f5a352.exe
Resource
win10v2004-20240802-en
General
-
Target
956203c6abd30d0bb3a58c9d04f9a9ed10c365d8d841872c2001cce4b8f5a352
-
Size
552KB
-
MD5
7c4c2bd133f8e9d8957996b5c72f16e9
-
SHA1
f09ee9da624ef71c5c87603b1ee5348b1f477a0d
-
SHA256
956203c6abd30d0bb3a58c9d04f9a9ed10c365d8d841872c2001cce4b8f5a352
-
SHA512
5cd5f35225202e2fdcc7b89086b9c8192cf80a0a0e37ee13656de437fd6f8287d58803c3033bff98dec3ec6b022e099e809d6815bbc3c26f593cbff36b54e947
-
SSDEEP
12288:UxUi5Cr2ZxiDGuX6G5r1a6TE18Md1gzfDBd:UxUiUr2iDvz2d1gzD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 956203c6abd30d0bb3a58c9d04f9a9ed10c365d8d841872c2001cce4b8f5a352
Files
-
956203c6abd30d0bb3a58c9d04f9a9ed10c365d8d841872c2001cce4b8f5a352.exe windows:6 windows x64 arch:x64
cf70514e79cf12e21714aac05efdcc54
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
shutdown
getsockname
bind
listen
ntohs
htonl
ntohl
htons
WSASend
setsockopt
ioctlsocket
closesocket
WSASetLastError
WSAGetLastError
WSAStartup
getpeername
getsockopt
inet_pton
socket
__WSAFDIsSet
select
recv
send
connect
WSAIoctl
getaddrinfo
freeaddrinfo
recvfrom
sendto
accept
gethostname
WSACleanup
neutrino_1_1
?getSharedInstance@NxMain@NX_1_1@@SAAEAV12@XZ
?init@NxMain@NX_1_1@@QEAA_NHQEAPEADPEAU_s_app_context@12@@Z
?processMessages@NxMain@NX_1_1@@QEAAXXZ
?getJobManager@NxMain@NX_1_1@@SAPEAXXZ
?EnableHiDPI@NxViewNativeUtils@NX_1_1@@SA_NXZ
??1NxServer@NX_1_1@@UEAA@XZ
??0NxServer@NX_1_1@@QEAA@GGPEBD@Z
msvcp110
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??_7?$codecvt@_WDH@std@@6B@
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ
?in@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDH@std@@QEBAHAEAHPEAD1AEAPEAD@Z
?out@?$codecvt@DDH@std@@QEBAHAEAHPEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?classic@locale@std@@SAAEBV12@XZ
?id@?$codecvt@_WDH@std@@2V0locale@2@A
?id@?$numpunct@D@std@@2V0locale@2@A
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??_7facet@locale@std@@6B@
??1facet@locale@std@@MEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??_7_Facet_base@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UEAAXXZ
?endl@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@1@AEAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_BADOFF@std@@3_JB
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z
?out@?$codecvt@_WDH@std@@QEBAHAEAHPEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
??0?$codecvt@_WDH@std@@QEAA@_K@Z
?_Getcat@?$codecvt@_WDH@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??_7codecvt_base@std@@6B@
msvcr110
__crtSetUnhandledExceptionFilter
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
_commode
_fmode
__initenv
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__C_specific_handler
?terminate@@YAXXZ
memset
memcmp
strerror
memcpy
__CxxFrameHandler3
_CxxThrowException
__iob_func
_gmtime64
_beginthreadex
strtoul
atoi
tolower
free
??0exception@std@@QEAA@XZ
fclose
_lock_file
_unlock_file
fgetc
ungetc
memcpy_s
fsetpos
_fseeki64
fgetpos
setvbuf
fwrite
fputc
fflush
??0bad_cast@std@@QEAA@PEBD@Z
??1bad_cast@std@@UEAA@XZ
??0bad_cast@std@@QEAA@AEBV01@@Z
??8type_info@@QEBA_NAEBV0@@Z
memchr
isspace
exit
_time64
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
_purecall
??_V@YAXPEAX@Z
memmove
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBQEBDH@Z
??0exception@std@@QEAA@AEBQEBD@Z
??1exception@std@@UEAA@XZ
isupper
_fstat64
_lseeki64
getenv
_mbspbrk
__sys_nerr
_strtoi64
sprintf
strtol
strpbrk
strncpy
strstr
ftell
_mbsnbcpy
_mbschr
_stat64
fseek
fread
_errno
qsort
strrchr
strncmp
strchr
sscanf
fopen
realloc
calloc
_stricmp
_strdup
?what@exception@std@@UEBAPEBDXZ
_access
_read
_write
_close
_open
malloc
kernel32
SleepEx
TlsSetValue
SetLastError
SetWaitableTimer
GetQueuedCompletionStatus
WaitForMultipleObjects
WaitForSingleObject
TlsGetValue
InitializeCriticalSectionEx
HeapAlloc
GetCurrentThread
GetThreadId
HeapFree
GetProcessHeap
DeleteCriticalSection
InitializeCriticalSection
TlsFree
CloseHandle
TlsAlloc
PostQueuedCompletionStatus
GetLastError
LeaveCriticalSection
SetEvent
CreateEventA
ReadFile
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleA
GetSystemTimeAsFileTime
OpenEventA
ReleaseSemaphore
GetCurrentProcessId
GetCurrentThreadId
ResetEvent
LocalFree
FormatMessageA
FreeLibrary
LoadLibraryA
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
PeekNamedPipe
GetFileType
GetStdHandle
ExpandEnvironmentStringsA
VerifyVersionInfoA
GetSystemDirectoryA
VerSetConditionMask
WaitForSingleObjectEx
GetTickCount64
AreFileApisANSI
CopyFileW
RemoveDirectoryW
GetFileAttributesW
GetProcAddress
DeviceIoControl
Sleep
CreateFileW
GetFileAttributesExW
DeleteFileW
CreateDirectoryW
EnterCriticalSection
user32
DefWindowProcW
GetMessageW
PostQuitMessage
SetProcessDPIAware
LoadCursorW
GetWindowLongPtrW
TranslateMessage
RegisterClassExW
CreateWindowExW
SetTimer
TranslateAcceleratorW
DispatchMessageW
SetWindowLongPtrW
RegisterWindowMessageW
advapi32
CryptCreateHash
CryptAcquireContextA
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptGenRandom
CryptGetHashParam
wldap32
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord143
crypt32
CertFreeCertificateContext
Sections
.text Size: 358KB - Virtual size: 357KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 146KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ