Static task
static1
Behavioral task
behavioral1
Sample
6be5c1aed750344b96de8412e7df1bf326b742f8f42da04ce4f725f3b49c99d1.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
6be5c1aed750344b96de8412e7df1bf326b742f8f42da04ce4f725f3b49c99d1.exe
Resource
win10v2004-20240802-en
General
-
Target
6be5c1aed750344b96de8412e7df1bf326b742f8f42da04ce4f725f3b49c99d1
-
Size
566KB
-
MD5
ce05c1b6c0b9e04e70015fc1ee5be9c6
-
SHA1
5400e808b47c19843ce9992e6c93d0efd0c1652f
-
SHA256
6be5c1aed750344b96de8412e7df1bf326b742f8f42da04ce4f725f3b49c99d1
-
SHA512
1a85598bc76cecf3223a074f0b5ad0ab7143ea379437ed8d9a476ff1f330cfde7d7d6b247c696844359f35761b2ced57270c94231800e0715d537e97eb508e00
-
SSDEEP
6144:OKmFodfMUTZVohElkcGr4empEWCxbJbhoKhsTId/dMQsTTP6r0f53DswOw+2UEpq:YFo9MQoy2frq4GT4/dc4o3DDONVE1O
Malware Config
Signatures
Files
-
6be5c1aed750344b96de8412e7df1bf326b742f8f42da04ce4f725f3b49c99d1.exe windows:6 windows x86 arch:x86
92b33f8f98849ad66a617e190c73355a
Code Sign
49:18:a1:8a:cb:95:75:b7:48:12:20:49:50:5b:40:61Certificate
IssuerCN=gat4by,ST=Sichuan,C=China,1.2.840.113549.1.9.1=#0c0e676174346279403136332e636f6dNot Before08/08/2024, 01:52Not After31/12/2039, 23:59SubjectCN=gat4by,ST=Sichuan,C=China,1.2.840.113549.1.9.1=#0c0e676174346279403136332e636f6dd7:6c:4b:bc:5e:6f:58:73:82:e4:95:37:b8:82:fa:56:37:30:cc:7cSigner
Actual PE Digestd7:6c:4b:bc:5e:6f:58:73:82:e4:95:37:b8:82:fa:56:37:30:cc:7cDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
libcrypto-3
BIO_set_flags
SHA256
EVP_aes_256_cbc
BIO_f_base64
EVP_CIPHER_CTX_free
EVP_CIPHER_CTX_new
EVP_DecryptFinal_ex
EVP_DecryptUpdate
EVP_DecryptInit_ex
BIO_new_mem_buf
BIO_free_all
BIO_push
BIO_read
BIO_new
kernel32
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
K32GetModuleInformation
FindResourceW
SizeofResource
CreateFileA
CloseHandle
GetLastError
AddVectoredExceptionHandler
ResetEvent
CreateEventW
VirtualProtect
VirtualFree
VirtualQuery
CreateFileMappingW
MapViewOfFile
FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
msvcp140
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xinvalid_argument@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?setf@ios_base@std@@QAEHHH@Z
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
vcruntime140
__current_exception_context
_except_handler4_common
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy
memset
__current_exception
api-ms-win-crt-runtime-l1-1-0
terminate
_seh_filter_exe
_set_app_type
_errno
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_controlfp_s
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_crt_atexit
_initialize_onexit_table
_register_onexit_function
api-ms-win-crt-string-l1-1-0
isxdigit
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
malloc
free
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__acrt_iob_func
__stdio_common_vfprintf
__p__commode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 542KB - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ