Static task
static1
Behavioral task
behavioral1
Sample
ExeFile (94).exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ExeFile (94).exe
Resource
win10v2004-20240802-en
General
-
Target
ExeFile (94).exe
-
Size
4.2MB
-
MD5
d38a31ffbda8734d7299ade259b54bd4
-
SHA1
f921c6b60f11adae030308525217f273f1088c62
-
SHA256
c6a32c4d0abf7f8ef806b0db222f55612d5ee5c09b0d6ceb2b6b7ec3c277c557
-
SHA512
5112ca2a000c67d75b53e86bc9bcfe89ee7843cae0607f1d25ca810c5fd5ead62abc499a8acbd8304c71b0096515a72977753d9ad626383829898ac8cdb624e8
-
SSDEEP
98304:mI2rBnQDWvrbqwjI0rawEmt82s2qzUGu1G+bbpuNTiBC7pu:/4QDWa2BPmB8C7g
Malware Config
Signatures
Files
-
ExeFile (94).exe.exe windows:4 windows x64 arch:x64
20080dc603dbebf7b115011cdcffe4f9
Code Sign
01Certificate
IssuerCN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-winNot Before31/08/2018, 12:18Not After30/08/2021, 12:18SubjectCN=curl-for-win Code Signing Authority,OU=curl-for-win Code Signing Authority,O=curl-for-winaf:42:e4:09:5d:94:1d:14Certificate
IssuerCN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-winNot Before31/08/2018, 12:18Not After31/08/2023, 12:18SubjectCN=curl-for-win Root CA,OU=curl-for-win Root CA,O=curl-for-winKey Usages
KeyUsageCertSign
KeyUsageCRLSign
01:89:91:4d:48:c9:76:e3:35:ae:4a:8e:c0:fd:1d:3f:5e:2b:56:a3:07:b8:c4:f1:e3:e8:09:71:fc:f8:b9:72Signer
Actual PE Digest01:89:91:4d:48:c9:76:e3:35:ae:4a:8e:c0:fd:1d:3f:5e:2b:56:a3:07:b8:c4:f1:e3:e8:09:71:fc:f8:b9:72Digest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
DeregisterEventSource
RegisterEventSourceW
ReportEventW
crypt32
CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetNameStringW
CertOpenStore
CertOpenSystemStoreW
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryW
PFXImportCertStore
kernel32
CloseHandle
CompareFileTime
ConvertFiberToThread
ConvertThreadToFiber
CreateFiber
CreateFileMappingA
CreateFileW
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileSizeEx
GetFileTime
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
GetVersion
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleA
ReadConsoleW
ReadFile
RtlVirtualUnwind
SearchPathW
SetConsoleMode
SetEndOfFile
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepEx
SwitchToFiber
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__lconv_init
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_access
_amsg_exit
_beginthreadex
_cexit
_chmod
_commode
_difftime64
_errno
_exit
_fileno
_fmode
_fstat64
_get_osfhandle
_getpid
_gmtime64
_initterm
_localtime64
_lock
_lseeki64
_onexit
_setmode
_stat64
_strdup
_stricmp
_strnicmp
_strtoi64
_sys_nerr
_time64
_unlock
_vsnprintf
_vsnwprintf
_waccess
_wcmdln
_wcsdup
_wfopen
_wstat64
abort
atoi
calloc
clearerr
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getc
getenv
islower
isprint
isspace
isupper
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putchar
puts
qsort
raise
realloc
rewind
setbuf
setlocale
setvbuf
signal
strcat
strchr
strcmp
strcpy
strcspn
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tolower
ungetc
vfprintf
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsstr
wcstombs
_write
_unlink
_strdup
_setmode
_read
_open
_mkdir
_isatty
_getch
_fileno
_fdopen
_close
normaliz
IdnToAscii
IdnToUnicode
user32
FindWindowA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
SendMessageA
wldap32
ber_free
ldap_bind_sW
ldap_err2stringA
ldap_first_attributeW
ldap_first_entry
ldap_get_dnW
ldap_get_values_lenW
ldap_initW
ldap_memfreeW
ldap_msgfree
ldap_next_attributeW
ldap_next_entry
ldap_search_sW
ldap_set_optionW
ldap_simple_bind_sW
ldap_sslinitW
ldap_unbind_s
ldap_value_free_len
ws2_32
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 888KB - Virtual size: 887KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 20KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 49B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ