Static task
static1
Behavioral task
behavioral1
Sample
3a65dcc5a558c23c95f2e122f279681fd268985a9702d4073f1bfdb0cac9a7bf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3a65dcc5a558c23c95f2e122f279681fd268985a9702d4073f1bfdb0cac9a7bf.exe
Resource
win10v2004-20240802-en
General
-
Target
3a65dcc5a558c23c95f2e122f279681fd268985a9702d4073f1bfdb0cac9a7bf
-
Size
610KB
-
MD5
c4237643f027849982b41864c382228c
-
SHA1
9ec3e37b4147e2d98214987ca6573cf5074ad1d2
-
SHA256
3a65dcc5a558c23c95f2e122f279681fd268985a9702d4073f1bfdb0cac9a7bf
-
SHA512
6d457f8acedb2770594dafbf7b7a11f978c59aa06653fbb52994780a9e90ec7caad4462666616037c4d14046c9fe1746798acc794972c573c950d643c8f4f50f
-
SSDEEP
12288:c3vfAaQwBDqGOR5idqzwcajo6Fan12eG2mjuy1xsBDo:GHhBGGG5ecajDQ12eG2mjuy1xsG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a65dcc5a558c23c95f2e122f279681fd268985a9702d4073f1bfdb0cac9a7bf
Files
-
3a65dcc5a558c23c95f2e122f279681fd268985a9702d4073f1bfdb0cac9a7bf.exe windows:6 windows x64 arch:x64
0e30c4394bb735f36dd1015343ece2ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAGetLastError
WSAStartup
ntohs
setsockopt
WSACleanup
getsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
ioctlsocket
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
connect
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSASetLastError
gethostname
wldap32
ord143
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord45
ord60
ord211
ord46
ord217
crypt32
CryptDecodeObjectEx
PFXImportCertStore
CertAddCertificateContextToStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CryptStringToBinaryA
CertFreeCertificateContext
normaliz
IdnToAscii
IdnToUnicode
kernel32
Sleep
WideCharToMultiByte
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
CreateEventA
WaitForSingleObject
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetTickCount
QueryPerformanceCounter
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
RtlCaptureContext
InitializeSListHead
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
GetCurrentThreadId
MoveFileExA
GetSystemTimeAsFileTime
SetEvent
FormatMessageW
MultiByteToWideChar
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetLastError
CopyFileW
SetLastError
GetFileSizeEx
advapi32
CryptAcquireContextA
CryptReleaseContext
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xlength_error@std@@YAXPEBD@Z
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
shlwapi
PathFindFileNameW
bcrypt
BCryptGenRandom
vcruntime140
__current_exception
strstr
memchr
strrchr
__current_exception_context
__C_specific_handler
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memmove
memset
memcpy
memcmp
strchr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-time-l1-1-0
_localtime64_s
_gmtime64
_time64
strftime
api-ms-win-crt-heap-l1-1-0
calloc
free
_set_new_mode
malloc
realloc
_callnewh
api-ms-win-crt-string-l1-1-0
strlen
strncpy
_strdup
strcspn
strcmp
strncmp
wcscmp
strpbrk
strspn
api-ms-win-crt-stdio-l1-1-0
_fseeki64
_lseeki64
_ftelli64
fgets
_open
fopen
fwrite
__stdio_common_vsscanf
_wfopen_s
_set_fmode
ftell
__stdio_common_vswprintf
fclose
fputs
__acrt_iob_func
fflush
__p__commode
_close
__stdio_common_vsprintf
_read
_write
fputc
_fileno
fread
feof
fseek
api-ms-win-crt-filesystem-l1-1-0
_wstat64
_stat64
_fstat64
_unlink
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
_errno
_exit
__p___argv
_initterm_e
_initterm
_get_initial_narrow_environment
_c_exit
__p___argc
_register_thread_local_exe_atexit_callback
_invalid_parameter_noinfo_noreturn
_set_app_type
_seh_filter_exe
exit
_beginthreadex
_cexit
_crt_atexit
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
__sys_errlist
api-ms-win-crt-convert-l1-1-0
strtoul
wcstombs
strtol
atoi
strtoll
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
__setusermatherr
_fdopen
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 470KB - Virtual size: 469KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ