Static task
static1
Behavioral task
behavioral1
Sample
d91077c9c89053ece4304feb9f7ab77c57dce275a15be0458ab034a930249443.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d91077c9c89053ece4304feb9f7ab77c57dce275a15be0458ab034a930249443.exe
Resource
win10v2004-20241007-en
General
-
Target
d91077c9c89053ece4304feb9f7ab77c57dce275a15be0458ab034a930249443
-
Size
740KB
-
MD5
283058414a24e02744ecf515ae0d325b
-
SHA1
17739f1e11c12e081dbcc1fc5db60735ce1cc15d
-
SHA256
d91077c9c89053ece4304feb9f7ab77c57dce275a15be0458ab034a930249443
-
SHA512
a3a0edd294a92e698d29544142f6718187d6b7c28f06155f989179450ea7927e86fc1f46b513303d8561c04d8acf457b9ca70ec5a19941fb5825d5dbf029aa9f
-
SSDEEP
6144:GjNAO8a1FIZrjWNHzF7O1GeqRmKOsG3xCh33+CtgNhlEON:GjmO8hhoNePKs0B3+ZZEON
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d91077c9c89053ece4304feb9f7ab77c57dce275a15be0458ab034a930249443
Files
-
d91077c9c89053ece4304feb9f7ab77c57dce275a15be0458ab034a930249443.exe windows:5 windows x86 arch:x86
ef4f56a06c56496602c328daeb8be9fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
hlb
??4CQuadB@@UAEXABV0@@Z
?SetEmpty@CQuadB@@UAEXXZ
??1CDot@@UAE@XZ
??0CDot@@QAE@ABV0@@Z
??0CDot@@QAE@XZ
??1CChainB@@UAE@XZ
??0CChainB@@QAE@XZ
?GetClipBox@XDC@@QAEHPAUtagRECT@@@Z
??1CMySerialize@@UAE@XZ
??5CMySerialize@@QAEHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??6CMySerialize@@QAEHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
??0CMySerialize@@QAE@PAU_iobuf@@@Z
?SetMainSelect@CTreeB@@QAEXH@Z
?Add@CStrokeB@@QAEXVCDot@@@Z
??0CDot@@QAE@NN@Z
??0CQuadB@@QAE@ABV0@@Z
??1CCommand@@UAE@XZ
??0CCommand@@QAE@HABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?Redo@CCommand@@UAEHXZ
?CanUndo@CCommand@@UAEHXZ
?GetName@CCommand@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ
??4CDot@@QAEXABV0@@Z
?Rotate@CDot@@QAEXV1@N@Z
?Move@CDot@@QAEXNN@Z
?Scale@CDot@@QAEXV1@NN@Z
?Move@CStrokeB@@QAEXNN@Z
?LineTo@XDC@@QAEXNN@Z
?MoveTo@XDC@@QAEXNN@Z
?Ellipse@XDC@@QAEXAAVCQuadB@@@Z
?SelectObject@XDC@@QAEPAVCPen@@PAV2@@Z
?SelectObject@XDC@@QAEPAXPAX@Z
?ExportPlt@CStrokeB@@QAEXAAVCStdioFile@@HH@Z
?Rotate@CStrokeB@@QAEXVCDot@@N@Z
?Effect@CStrokeB@@QAEXNNHHVCQuadB@@@Z
??_7CQuadB@@6B@
?Scale@CStrokeB@@QAEXVCDot@@NN@Z
?GetAt@CStrokeB@@QAE?AVCDot@@H@Z
??0CDot@@QAE@AAVCPoint@@@Z
??8CDot@@QAEHABV0@@Z
?GetType@CNodeB@@QAEHXZ
?PhysicToLogic@CZoomViewB@@QAEXAAN0@Z
??1CCommandProcessor@@UAE@XZ
??0CCommandProcessor@@QAE@H@Z
?GetObjID@CNodeB@@QAEHXZ
?ZoomIn@CZoomViewB@@QAEXXZ
?ZoomOut@CZoomViewB@@QAEXXZ
?DoZoomIn@CZoomViewB@@QAEXNNNN@Z
?GetZoomMode@CZoomViewB@@QAEIXZ
?SetZoomMode@CZoomViewB@@QAEXI@Z
?ReplaceDot@XTrackerB@@QAEXXZ
?ClearDot@XTrackerB@@QAEXXZ
?LogicToPhysic@CZoomViewB@@QAEXAAN0@Z
??1CMeasureLine@@UAE@XZ
??_7CMeasureLine@@6B@
?ViewDPtoLP@CZoomViewB@@QAEXPAUtagPOINT@@H@Z
?PhysicToLogic@CZoomViewB@@QAEXAAUQUAD@@@Z
?ListEmpty@XTrackerB@@QAEHXZ
?GetSize@CStrokeB@@QAEHXZ
?DrawMeasureLine@CZoomViewB@@QAEXPAVCDC@@@Z
?LogicToPhysic@CZoomViewB@@QAEXAAUQUAD@@@Z
?Track@XTrackerB@@QAEHAAVCPoint@@PAVCWnd@@@Z
??1XControlBar@@UAE@XZ
??0XControlBar@@QAE@XZ
??1CNodeB@@UAE@XZ
??0CNodeB@@QAE@XZ
?SetSelect@CNodeB@@UAEXH@Z
?InvertSelect@CNodeB@@UAEXXZ
?IsSelect@CNodeB@@UAEHXZ
?GetBaseType@CNodeB@@UAEHXZ
?DrawExtern@CNodeB@@UAEXPAVXDC@@@Z
?LockLayer@CNodeB@@UAEXH@Z
?UnLockLayer@CNodeB@@UAEXH@Z
?GetNodeFirstDot@CNodeB@@UAEHAAVCDot@@@Z
?GetNodeLastDot@CNodeB@@UAEHAAVCDot@@@Z
?Adjust@CNodeB@@UAEXAAUtagMSG@@ABVCPoint@@@Z
?Move@CNodeB@@UAEHNN@Z
?SetLayColor@CNodeB@@UAEXHKHK@Z
?GetLayColor@CNodeB@@UAEXAAH0@Z
?Empty@CQuadB@@UAEHXZ
?Scan@CNodeB@@UAEXPAV?$CTypedPtrList@VCObList@@PAVCStrokeB@@@@@Z
?Scale_B@CNodeB@@UAEXAAVCDot@@NN@Z
?Rotate_B@CNodeB@@UAEXAAVCDot@@N@Z
?HasDot@CStrokeB@@QAEHAAVCQuadB@@@Z
?SetParent@CStrokeB@@QAEXPAPAX@Z
??5CMySerialize@@QAEHAAN@Z
??6CMySerialize@@QAEHN@Z
??6CMySerialize@@QAEHH@Z
?SetLayColor@CStrokeB@@QAEXHK@Z
?LogToTrue@CDot@@QAEXXZ
?ActualLen@CZoomViewB@@QAEXAAN@Z
??5CMySerialize@@QAEHAAH@Z
?TrueToLog@CDot@@QAEXXZ
?IsInDots@CStrokeB@@QAEJXZ
?GetOptLayer@CStrokeB@@QAEJXZ
??0CQuadB@@QAE@XZ
??1CQuadB@@UAE@XZ
?GetBaseDot@CQuadB@@QAE?AVCDot@@H@Z
??1CStrokeB@@UAE@XZ
??0CStrokeB@@QAE@XZ
?Serialize@CStrokeB@@UAEXPAU_iobuf@@H@Z
?Reverse@CStrokeB@@QAEXXZ
?SetPixel@XDC@@QAEKHHK@Z
??5CMySerialize@@QAEHAAI@Z
??6CMySerialize@@QAEHI@Z
??1CTreeB@@UAE@XZ
??0CTreeB@@QAE@XZ
?FilterPoint@CNodeB@@QAEXNN@Z
?SetStyle@CStrokeB@@QAEXH@Z
?SetOffset@CDot@@QAEXNN@Z
?HitSelectDotB@XTrackerB@@QAEHAAVCDot@@N@Z
?AddDotToHead@XTrackerB@@QAEXPAVCStrokeB@@AAVCDot@@N@Z
?MoveDot@CStrokeB@@QAEXHNN@Z
??1XTrackerB@@UAE@XZ
?FillSolidQuad@XDC@@QAEXAAVCQuadB@@K@Z
?Distance@XTrackerB@@QAENAAVCDot@@0@Z
?DataEXChange@XTrackerB@@QAEXXZ
?AddStrokeToEditList@XTrackerB@@QAEXPAVCStrokeB@@@Z
?DotIsInStroke@CStrokeB@@QAEHAAVCDot@@@Z
?FindSelListFirstPt@XTrackerB@@QAEHAAVCDot@@@Z
?FilterPoint@CStrokeB@@QAEXNN@Z
?SetStrokeReverse@CStrokeB@@QAEXAAVCDot@@@Z
??0XTrackerB@@QAE@XZ
?AlignMeasureLine@CZoomViewB@@QAEXHAAVCPoint@@V2@VCQuadB@@@Z
??BCDot@@QAE?AVCPoint@@XZ
?AddDotHeadB@XTrackerB@@QAEXPAVCStrokeB@@AAVCQuadB@@@Z
?SetFlag@CStrokeB@@QAEXH@Z
?DotInQuad@CStrokeB@@QAEHAAVCQuadB@@@Z
?GetDot@CStrokeB@@QAE?AVCDot@@AAV2@0N@Z
?HeadOrTail@XTrackerB@@QAEHPAVDotHead@1@@Z
?IsFillStyle@XTrackerB@@QAEHPAVCStrokeB@@@Z
?IsDiffStroke@XTrackerB@@QAEHXZ
?Distance@CStrokeB@@QAENAAVCDot@@0@Z
?KillAngle@CStrokeB@@QAEHHN@Z
?DotListSub@XTrackerB@@QAEHPAPAVDotHead@1@AAH@Z
?RemoveDot@CStrokeB@@QAEXH@Z
?GetThisClass@CZoomViewB@@SGPAUCRuntimeClass@@XZ
??1CZoomViewB@@MAE@XZ
??0CZoomViewB@@IAE@XZ
?DoMeasureLine@CZoomViewB@@QAEXXZ
?MoveMeasureLine@CZoomViewB@@QAEXVCPoint@@@Z
?SetScale@XDC@@QAEXN@Z
?LogicToPhysic@XDC@@QAEXAAN0@Z
?FlashCurPos@CZoomViewB@@QAEXUtagPOINT@@@Z
?SetViewRect@XDC@@QAEXNN@Z
?DrawRuler@CZoomViewB@@QAEXPAVCDC@@@Z
?GetThisMessageMap@CZoomViewB@@KGPBUAFX_MSGMAP@@XZ
?IsNull@CQuadB@@UAEHXZ
?IsEmpty@CQuadB@@UAEHXZ
?Normal@CQuadB@@UAEXXZ
?Width@CQuadB@@UAENXZ
?Height@CQuadB@@UAENXZ
?Include@CQuadB@@UAEHAAVCDot@@@Z
?Include@CQuadB@@UAEHV1@@Z
?Inflate@CQuadB@@UAEXNN@Z
?DotIn@CQuadB@@UAEHVCDot@@@Z
?Click@CQuadB@@UAEHVCDot@@N@Z
?Initial@CQuadB@@UAEXXZ
?GetLen@CQuadB@@UAENXZ
?GetWid@CQuadB@@UAENXZ
?Scale@CQuadB@@UAEXAAVCDot@@AAN1@Z
?SetOffset@CQuadB@@UAEXNN@Z
?Move@CQuadB@@UAEXAAN0@Z
?TrueToLog@CQuadB@@UAEXXZ
?ExportPlt@CNodeB@@UAEXAAVCStdioFile@@HH@Z
?LogToTrue@CQuadB@@UAEXXZ
mfc90
ord6584
ord4977
ord1183
ord3856
ord1069
ord2523
ord1247
ord910
ord2458
ord2539
ord2106
ord3534
ord3612
ord525
ord1611
ord3178
ord305
ord3213
ord6613
ord1137
ord4507
ord663
ord1555
ord5753
ord6062
ord5520
ord404
ord1003
ord5866
ord1607
ord2691
ord3528
ord1358
ord1357
ord4527
ord2097
ord899
ord6170
ord6525
ord6079
ord636
ord367
ord945
ord817
ord4760
ord2057
ord2651
ord665
ord3017
ord2501
ord2490
ord406
ord4506
ord5963
ord300
ord4311
ord2327
ord941
ord4502
ord589
ord3659
ord4890
ord3110
ord6001
ord5646
ord5663
ord4981
ord4333
ord5659
ord5657
ord5309
ord2087
ord4199
ord5813
ord6721
ord5533
ord1046
ord4165
ord6018
ord2206
ord2251
ord4733
ord6781
ord4159
ord6783
ord4409
ord4434
ord793
ord2447
ord4029
ord4875
ord4878
ord4882
ord780
ord617
ord5658
ord5552
ord341
ord994
ord570
ord579
ord4427
ord6462
ord1098
ord3792
ord6735
ord1144
ord1568
ord6815
ord5528
ord3390
ord2470
ord6078
ord5156
ord5750
ord6791
ord3718
ord5761
ord6802
ord3991
ord650
ord388
ord4670
ord4891
ord6533
ord6419
ord3030
ord3331
ord4627
ord2090
ord5122
ord4663
ord5928
ord3004
ord5844
ord1466
ord6027
ord5589
ord2239
ord2204
ord6742
ord2862
ord2854
ord4979
ord5607
ord2232
ord5482
ord4585
ord3477
ord1108
ord4396
ord3568
ord2282
ord4498
ord2130
ord2591
ord1361
ord2587
ord2592
ord2069
ord4679
ord1445
ord3670
ord5584
ord4364
ord5279
ord5282
ord4786
ord4791
ord4788
ord4806
ord4808
ord4793
ord5195
ord4576
ord5209
ord4851
ord5005
ord2372
ord1387
ord4481
ord3007
ord6811
ord3414
ord6291
ord6646
ord6464
ord784
ord4880
ord4881
ord3808
ord670
ord778
ord787
ord4671
ord3217
ord6355
ord4683
ord1384
ord2369
ord5638
ord5581
ord4330
ord1684
ord6456
ord2645
ord2646
ord3278
ord5786
ord978
ord6361
ord3222
ord6359
ord5615
ord5323
ord3224
ord4539
ord4716
ord5435
ord5432
ord2855
ord2079
ord2445
ord5339
ord4970
ord5598
ord6406
ord1587
ord6575
ord4656
ord4437
ord585
ord576
ord415
ord2189
ord6164
ord2341
ord2340
ord6559
ord6404
ord3372
ord6318
ord4706
ord3994
ord5890
ord1268
ord1180
ord942
ord2672
ord6495
ord6155
ord5835
ord6681
ord2481
ord3650
ord3269
ord4649
ord1723
ord1786
ord2286
ord6257
ord6557
ord6494
ord6153
ord781
ord580
ord5924
ord654
ord2904
ord3553
ord4643
ord1698
ord2279
ord4497
ord1605
ord2105
ord6771
ord1492
ord692
ord3895
ord753
ord5137
ord5644
ord5153
ord4618
ord4594
ord5262
ord5286
ord5032
ord5216
ord5493
ord5496
ord5494
ord5495
ord539
ord4013
ord3489
ord3228
ord3010
ord2813
ord2210
ord411
ord3519
ord2046
ord5776
ord5403
ord5199
ord4608
ord4850
ord2208
ord1810
ord1809
ord1678
ord3344
ord6388
ord1496
ord4650
ord5636
ord4668
ord3506
ord374
ord820
ord639
ord615
ord2103
ord1604
ord4496
ord2277
ord1670
ord3346
ord6391
ord1755
ord1752
ord4331
ord1497
ord4640
ord5585
ord2074
ord5497
ord6780
ord4589
ord5647
ord3732
ord5139
ord4688
ord1729
ord6446
ord5668
ord5666
ord958
ord963
ord967
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord3277
ord4066
ord4067
ord4057
ord2886
ord4334
ord772
ord1782
ord1717
ord3638
ord775
ord1783
ord1718
ord3641
ord2050
ord4873
ord3351
ord2209
ord3981
ord664
ord5394
ord4903
ord4872
ord4997
ord5040
ord5329
ord4616
ord5151
ord5136
ord3117
ord405
ord3801
ord3987
ord4993
ord3175
ord5152
ord1938
ord2038
ord1935
ord2045
ord4415
ord1937
ord4895
ord4667
ord3487
ord595
ord6740
ord2899
ord2360
ord3579
ord4431
ord1182
ord587
ord791
ord316
ord310
ord4392
ord601
ord5875
ord798
ord266
ord3221
ord4617
ord265
ord6114
ord3580
ord464
ord4244
ord1037
ord1603
ord712
ord1254
ord1252
ord800
ord3209
ord1276
msvcr90
_read
_lseek
_close
_strnicmp
_open
_controlfp_s
_invoke_watson
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
_fcvt
_time64
_localtime64_s
strftime
_CIpow
strncpy
memmove_s
sprintf
atof
_CIasin
_CIacos
fread
fopen
fwrite
fclose
strrchr
_getch
_CIsin
_CIcos
atoi
_CIsqrt
_CIatan2
_CIfmod
memset
memcpy_s
__CxxFrameHandler3
_setmbcp
kernel32
GetStartupInfoA
MulDiv
GetModuleFileNameA
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryA
CloseHandle
CreateMutexA
OpenMutexA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDBCSLeadByte
InterlockedCompareExchange
InterlockedExchange
WritePrivateProfileStringA
GetPrivateProfileStringA
Beep
Sleep
user32
DrawIcon
KillTimer
SetTimer
IsCharAlphaA
DispatchMessageA
GetCapture
LoadIconA
GetWindowRect
OffsetRect
GetMessageA
ReleaseCapture
DestroyCursor
LoadCursorA
SetCapture
ReleaseDC
GetDC
ClientToScreen
GetClientRect
PostMessageA
LoadMenuA
GetSubMenu
LoadBitmapA
PtInRect
SetCursor
UpdateWindow
InvalidateRect
SendMessageA
EnableWindow
GetKeyState
InflateRect
GetWindowDC
gdi32
EndPath
GetPath
CreatePen
BeginPath
GetTextAlign
GetTextExtentPoint32A
TextOutA
GetCurrentPositionEx
GetMapMode
CreateCompatibleDC
GetObjectA
CreateFontIndirectA
GetStockObject
DeleteObject
FlattenPath
Sections
.text Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 448KB - Virtual size: 448KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE