Static task
static1
Behavioral task
behavioral1
Sample
bc87b9bfb3d46f1f4080a6caed2685a0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bc87b9bfb3d46f1f4080a6caed2685a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
bc87b9bfb3d46f1f4080a6caed2685a0N
-
Size
2.5MB
-
MD5
bc87b9bfb3d46f1f4080a6caed2685a0
-
SHA1
c1e14b2d49b90671286235ded94cd889cf95ba01
-
SHA256
9af2f4790ff395f053bc13161b6823d76f6634ea1420e53cff1b0b912499d2c0
-
SHA512
2f82dfb9dc4d162910a3da85bc2f88cb8cbf16d231389c773bc626564a257ab10868d21a4db96160e3ce7ad10724fed0a62d7f93ae6ebb7991ba6cca081ab58a
-
SSDEEP
49152:XIdh+7EygKSnPVh/qNwffAj3g/bTqSk6hLrXySGkdwGJf:ah+/Y/lgQ/6SzrXyI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc87b9bfb3d46f1f4080a6caed2685a0N
Files
-
bc87b9bfb3d46f1f4080a6caed2685a0N.exe windows:6 windows x64 arch:x64
9a4dafb5bccadd5ea91d6ac032e63d26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAGetLastError
WSAStartup
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
send
recv
closesocket
advapi32
CryptImportKey
CryptDestroyKey
CryptEncrypt
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
dwmapi
DwmExtendFrameIntoClientArea
kernel32
Process32Next
CloseHandle
LoadLibraryW
CreateThread
Beep
GetProcAddress
DeleteCriticalSection
ExitProcess
GetModuleHandleW
WideCharToMultiByte
GetConsoleWindow
CreateProcessA
IsDebuggerPresent
CreateToolhelp32Snapshot
SleepEx
GetSystemDirectoryA
FreeLibrary
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
FormatMessageA
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
K32GetDeviceDriverBaseNameW
CreatePipe
ReadFile
CreateFileA
GetModuleHandleA
GetVolumeInformationA
InitializeCriticalSectionEx
TerminateProcess
VirtualAlloc
WriteFile
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
GetLastError
Sleep
SetLastError
MultiByteToWideChar
VirtualFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
Process32First
K32EnumDeviceDrivers
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
user32
DispatchMessageA
DestroyWindow
SetWindowPos
keybd_event
ShowWindow
GetAsyncKeyState
SetWindowLongA
GetWindow
MessageBoxA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
mouse_event
PeekMessageA
GetWindowThreadProcessId
SetClipboardData
UnregisterClassA
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ScreenToClient
ReleaseCapture
GetClientRect
SetCursor
SetCapture
ClientToScreen
GetCapture
PostQuitMessage
FindWindowA
RegisterClassExA
UpdateWindow
GetKeyState
LoadCursorA
GetActiveWindow
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bid@locale@std@@QEAA_KXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
winhttp
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
d3d9
Direct3DCreate9Ex
crypt32
CertEnumCertificatesInStore
CertCloseStore
CryptBinaryToStringA
CertGetCertificateContextProperty
CertGetNameStringA
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CryptDecodeObject
wininet
InternetOpenA
InternetCloseHandle
InternetSetOptionA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception_context
__current_exception
memchr
memcmp
strrchr
memset
memcpy
wcsstr
__std_exception_copy
__std_exception_destroy
strchr
strstr
__std_terminate
__C_specific_handler
memmove
api-ms-win-crt-stdio-l1-1-0
fputs
feof
_set_fmode
__p__commode
_read
fputc
_write
fgets
_close
_open
ftell
__acrt_iob_func
fflush
fclose
_lseeki64
__stdio_common_vswprintf
fseek
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
fwrite
__stdio_common_vsprintf_s
_wfopen
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
fopen
api-ms-win-crt-string-l1-1-0
isblank
_wcsicmp
tolower
_strdup
strpbrk
wcsncmp
strspn
_wcsnicmp
isprint
strncmp
_wcslwr_s
strcmp
iswdigit
strncpy
wcscpy_s
isupper
strcspn
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-heap-l1-1-0
calloc
malloc
_callnewh
realloc
free
_set_new_mode
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
atof
strtol
wcstol
_wtoi
strtoll
api-ms-win-crt-runtime-l1-1-0
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_beginthreadex
_set_app_type
_invalid_parameter_noinfo
__sys_nerr
system
terminate
_getpid
exit
_errno
_configure_narrow_argv
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
strerror
_exit
_initterm_e
_initterm
_get_initial_narrow_environment
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
clock
api-ms-win-crt-filesystem-l1-1-0
remove
_access
_unlink
_fstat64
_stat64
api-ms-win-crt-math-l1-1-0
ceilf
cosf
atan2f
fmodf
pow
powf
floorf
sinf
__setusermatherr
sqrtf
api-ms-win-crt-conio-l1-1-0
_getch
__conio_common_vcprintf
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ntdll
NtQuerySystemInformation
RtlCaptureContext
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
wldap32
ord217
ord46
ord211
ord60
ord45
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord143
normaliz
IdnToAscii
Sections
.text Size: 603KB - Virtual size: 602KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ