Static task
static1
Behavioral task
behavioral1
Sample
9960a621b241f32286060a7600d5686081dc164368dbfcc7793e88f6816080e1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9960a621b241f32286060a7600d5686081dc164368dbfcc7793e88f6816080e1.exe
Resource
win10v2004-20240802-en
General
-
Target
9960a621b241f32286060a7600d5686081dc164368dbfcc7793e88f6816080e1
-
Size
230KB
-
MD5
4c393b4a74fe2a6e4bee1d16d1ac8370
-
SHA1
e44fdc371cc9b06d7df4a098b012d3f7cdfffc7f
-
SHA256
9960a621b241f32286060a7600d5686081dc164368dbfcc7793e88f6816080e1
-
SHA512
8f964f26c8e66ea56b573b5f66117005009eb7257c26b8c57d4ba2219a8ba8801bf2f86976989a4df50d5f322862a920da6f97f33a9fb0562d2cf5fdd3e47ff1
-
SSDEEP
6144:NTWQpr7ro/tij4nFT9NzCucIiltMojGmu9zR0O:Nd7c9NzNitMz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9960a621b241f32286060a7600d5686081dc164368dbfcc7793e88f6816080e1
Files
-
9960a621b241f32286060a7600d5686081dc164368dbfcc7793e88f6816080e1.exe .ps1 windows:6 windows x64 arch:x64 polyglot
2b80aac076cf07e682c8a563d2be907e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
accept
listen
shutdown
closesocket
inet_pton
WSAStartup
inet_addr
send
socket
connect
recv
setsockopt
bind
WSAGetLastError
WSACleanup
htons
mfc140u
ord9979
ord9975
ord9977
ord9978
ord9976
ord14360
ord2698
ord7913
ord9946
ord3209
ord3212
ord13401
ord6002
ord5916
ord6287
ord450
ord11855
ord8926
ord7235
ord5451
ord1033
ord296
ord6320
ord3756
ord8900
ord9941
ord7922
ord5227
ord7450
ord7461
ord7460
ord5062
ord5229
ord5083
ord5555
ord5339
ord9041
ord5552
ord5363
ord5080
ord3728
ord11414
ord2270
ord6250
ord7054
ord1053
ord2178
ord2697
ord4656
ord940
ord3951
ord1089
ord6614
ord983
ord13545
ord6122
ord14289
ord6123
ord14290
ord7551
ord14288
ord7719
ord12212
ord14088
ord11665
ord11415
ord11625
ord7668
ord12625
ord3949
ord4011
ord9089
ord14216
ord7650
ord14210
ord12223
ord12222
ord2439
ord10070
ord5183
ord8023
ord7716
ord4445
ord12544
ord12606
ord10124
ord11929
ord8084
ord1450
ord7393
ord8167
ord13109
ord11901
ord11933
ord7920
ord11921
ord5706
ord3731
ord13767
ord8901
ord8731
ord10704
ord1667
ord286
ord280
ord961
ord14299
ord12111
ord1427
ord11654
ord2815
ord4725
ord6251
ord3056
ord4078
ord8817
ord878
ord1369
ord3071
ord3307
ord3308
ord10163
ord5240
ord2629
ord8830
ord14209
ord11771
ord11806
ord8656
ord3812
ord11902
ord6729
ord3718
ord10691
ord8947
ord11664
ord3173
ord13513
ord11944
ord11940
ord1700
ord3279
ord1722
ord1748
ord1734
ord1755
ord4776
ord4843
ord3278
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4814
ord4752
ord3172
ord11850
ord4767
ord990
ord4828
ord4360
ord5582
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord6631
ord10727
ord11813
ord6000
ord3713
ord11406
ord13354
ord2011
ord5723
ord6121
ord13397
ord2212
ord2370
ord1091
ord11085
kernel32
InitializeCriticalSectionEx
Sleep
GetLastError
DeleteCriticalSection
GetModuleFileNameA
GetStdHandle
WriteFile
TerminateProcess
CreateMutexW
WaitForSingleObject
CreateFileW
ReleaseMutex
OpenProcess
SetFileAttributesW
GetExitCodeThread
CreateFileA
TerminateThread
DeleteFileA
CloseHandle
CreateThread
ExitProcess
GetCurrentProcessId
CreateProcessA
OpenThread
WinExec
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
IsBadReadPtr
FreeLibrary
GetProcessHeap
GetProcAddress
HeapAlloc
GetNativeSystemInfo
LoadLibraryA
VirtualAlloc
VirtualFree
SetLastError
OutputDebugStringW
HeapFree
SetConsoleTextAttribute
WideCharToMultiByte
VirtualProtect
user32
SendMessageW
GetSystemMenu
FindWindowW
MessageBoxA
EnableWindow
IsIconic
GetClientRect
DrawIcon
GetSystemMetrics
advapi32
OpenServiceA
RegSetValueExA
StartServiceA
ControlService
DeleteService
RegCreateKeyExA
OpenSCManagerA
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
RegCloseKey
CreateServiceA
comctl32
InitCommonControlsEx
msvcp140
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
_Xtime_get_ticks
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
iphlpapi
GetAdaptersInfo
winhttp
WinHttpSendRequest
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpConnect
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
memcpy
__std_exception_copy
strstr
strrchr
__C_specific_handler
__current_exception
__current_exception_context
memset
_CxxThrowException
memmove
__std_exception_destroy
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
realloc
free
malloc
api-ms-win-crt-utility-l1-1-0
srand
bsearch
qsort
rand
api-ms-win-crt-string-l1-1-0
isdigit
isprint
api-ms-win-crt-runtime-l1-1-0
_initterm
_errno
exit
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
system
_exit
_initterm_e
_seh_filter_exe
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
putc
_set_fmode
__stdio_common_vsprintf
__p__commode
__stdio_common_vfprintf
putchar
api-ms-win-crt-time-l1-1-0
_localtime64
_time64
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 141KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 820B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ