Static task
static1
Behavioral task
behavioral1
Sample
526ae2885329f1aa7abce850cf55efa0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
526ae2885329f1aa7abce850cf55efa0N.exe
Resource
win10v2004-20240802-en
General
-
Target
526ae2885329f1aa7abce850cf55efa0N
-
Size
2.5MB
-
MD5
526ae2885329f1aa7abce850cf55efa0
-
SHA1
650edfd8e8ee3d663f7dd0452e302b2a5ca4c537
-
SHA256
ee99ca3b2d526e68c61b4bf1530dc7aced0703fbadee1d56e246cd7c2cbf20b6
-
SHA512
8b6f668e481796fb6a037b1665d72b60ed7b0aa9e0b059165739a6e39d852b58c1dace5f2c86af0a5e3ff795c5c643baa0b26b63e270f2f5d7b2674f2ee90368
-
SSDEEP
49152:xQvvpiC3kyfnvVh/qNwffAj3g/bTqSk6hLrXySGkdwGJ5:CvvcO/lgQ/6SzrXyI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 526ae2885329f1aa7abce850cf55efa0N
Files
-
526ae2885329f1aa7abce850cf55efa0N.exe windows:6 windows x64 arch:x64
b226c5f4e4712ffe8486907d8a5fd9c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
WSAGetLastError
WSAStartup
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
send
recv
closesocket
advapi32
CryptImportKey
CryptDestroyKey
CryptEncrypt
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
dwmapi
DwmExtendFrameIntoClientArea
kernel32
Process32Next
CloseHandle
LoadLibraryW
CreateThread
Beep
GetProcAddress
DeleteCriticalSection
ExitProcess
GetModuleHandleW
WideCharToMultiByte
GetConsoleWindow
CreateProcessA
IsDebuggerPresent
CreateToolhelp32Snapshot
SleepEx
GetSystemDirectoryA
FreeLibrary
VerifyVersionInfoA
GetTickCount
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
FormatMessageA
GetFileSizeEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
K32GetDeviceDriverBaseNameW
CreatePipe
ReadFile
CreateFileA
GetModuleHandleA
GetVolumeInformationA
InitializeCriticalSectionEx
TerminateProcess
VirtualAlloc
WriteFile
GetStdHandle
GetCurrentProcess
SetConsoleTitleA
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
GetLastError
Sleep
SetLastError
MultiByteToWideChar
VirtualFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
Process32First
K32EnumDeviceDrivers
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
user32
DispatchMessageA
DestroyWindow
SetWindowPos
keybd_event
ShowWindow
GetAsyncKeyState
SetWindowLongA
GetWindow
MessageBoxA
GetForegroundWindow
DefWindowProcA
CreateWindowExA
TranslateMessage
mouse_event
PeekMessageA
GetWindowThreadProcessId
UnregisterClassA
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
ScreenToClient
ReleaseCapture
GetClientRect
SetCursor
SetCapture
ClientToScreen
GetCapture
PostQuitMessage
FindWindowA
RegisterClassExA
UpdateWindow
GetKeyState
LoadCursorA
GetActiveWindow
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bid@locale@std@@QEAA_KXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?id@?$ctype@D@std@@2V0locale@2@A
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Query_perf_frequency
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
winhttp
WinHttpQueryDataAvailable
WinHttpCrackUrl
WinHttpConnect
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
d3d9
Direct3DCreate9Ex
crypt32
CertEnumCertificatesInStore
CertCloseStore
CryptBinaryToStringA
CertGetCertificateContextProperty
CertGetNameStringA
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
CryptDecodeObject
wininet
InternetOpenA
InternetCloseHandle
InternetSetOptionA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception_context
__current_exception
memchr
memcmp
strrchr
memset
memcpy
wcsstr
__std_exception_copy
__std_exception_destroy
__C_specific_handler
strstr
__std_terminate
strchr
memmove
api-ms-win-crt-stdio-l1-1-0
fopen
feof
_set_fmode
__p__commode
_read
fgets
fputc
_write
_close
_open
ftell
_lseeki64
__acrt_iob_func
fflush
fclose
fseek
__stdio_common_vswprintf
__stdio_common_vfprintf
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
fwrite
_wfopen
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fread
__stdio_common_vsscanf
fputs
api-ms-win-crt-string-l1-1-0
tolower
_wcsicmp
isblank
_strdup
strpbrk
wcsncmp
strspn
strcmp
isprint
strncmp
_wcslwr_s
_wcsnicmp
iswdigit
wcscpy_s
strncpy
isupper
strcspn
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-heap-l1-1-0
realloc
malloc
calloc
_set_new_mode
free
_callnewh
api-ms-win-crt-convert-l1-1-0
atof
atoi
strtoll
_wtoi
strtoul
strtol
wcstol
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_exe
system
__sys_nerr
terminate
_errno
_getpid
_beginthreadex
exit
_initterm
_invalid_parameter_noinfo_noreturn
_set_app_type
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
strerror
_initterm_e
_exit
_get_initial_narrow_environment
api-ms-win-crt-time-l1-1-0
_gmtime64
_time64
clock
api-ms-win-crt-filesystem-l1-1-0
remove
_stat64
_fstat64
_access
_unlink
api-ms-win-crt-math-l1-1-0
floorf
atan2f
pow
powf
cosf
ceilf
sinf
fmodf
__setusermatherr
sqrtf
api-ms-win-crt-conio-l1-1-0
_getch
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ntdll
NtQuerySystemInformation
RtlCaptureContext
VerSetConditionMask
RtlVirtualUnwind
RtlLookupFunctionEntry
wldap32
ord217
ord46
ord211
ord60
ord45
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord143
normaliz
IdnToAscii
Sections
.text Size: 603KB - Virtual size: 602KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ