atoll
Static task
static1
Behavioral task
behavioral1
Sample
6aeda4f4996ea4517bc6f3a705f40dd3229b21c5286318944f6f2371b5b3b21d.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6aeda4f4996ea4517bc6f3a705f40dd3229b21c5286318944f6f2371b5b3b21d.exe
Resource
win10v2004-20241007-en
General
-
Target
6aeda4f4996ea4517bc6f3a705f40dd3229b21c5286318944f6f2371b5b3b21d
-
Size
1.0MB
-
MD5
a7530d38d511b6a222e6fecf5661658f
-
SHA1
40b3671de53a874a6096195095003fc7de11dd82
-
SHA256
6aeda4f4996ea4517bc6f3a705f40dd3229b21c5286318944f6f2371b5b3b21d
-
SHA512
ed4b85d3e4d647877a68c2dd79e79ee4d37f4bd248682d89414f9ff1709db67e4f2b1abfc52bb2de479090ac0c3fe8bcea1c374848ce20465251ae8a3a7ef2e8
-
SSDEEP
24576:GWczc2QWdUeJI6xoD08eCKf+6QovcjZfAifJ2QBO:F2vIEoD0WKWFovcjZfAifJ2Q
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6aeda4f4996ea4517bc6f3a705f40dd3229b21c5286318944f6f2371b5b3b21d
Files
-
6aeda4f4996ea4517bc6f3a705f40dd3229b21c5286318944f6f2371b5b3b21d.exe windows:6 windows x64 arch:x64
3aaa6105ad9f9c5d86b151bc0bdd02b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileA
wtsapi32
WTSQuerySessionInformationA
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
WTSFreeMemory
mfc120
ord13991
ord8930
ord3959
ord3898
ord12441
ord7521
ord1962
ord11489
ord11488
ord13866
ord12030
ord7572
ord14065
ord6002
ord14067
ord6004
ord14066
ord6003
ord13328
ord978
ord6487
ord2140
ord3680
ord5589
ord11743
ord7770
ord11755
ord11723
ord5442
ord9779
ord1081
ord438
ord3774
ord2429
ord6128
ord12111
ord1939
ord1384
ord914
ord9907
ord5071
ord6437
ord13380
ord1042
ord345
ord11929
ord1115
ord11468
ord488
ord320
ord2313
ord8010
ord3676
ord7907
ord1666
ord2222
ord7503
ord1416
ord4043
ord3115
ord6465
ord5798
ord7871
ord5884
ord13190
ord3163
ord3160
ord9784
ord7763
ord2654
ord9814
ord9816
ord9815
ord9813
ord9817
ord5339
ord11239
ord11240
ord11593
ord3667
ord3662
ord11449
ord13986
ord8499
ord11724
ord6599
ord10524
ord8790
ord3124
ord13297
ord11763
ord11761
ord1684
ord1696
ord1704
ord1700
ord1709
ord4707
ord13377
ord4715
ord4727
ord4723
ord4719
ord4756
ord4744
ord4711
ord14073
ord4733
ord4695
ord4702
ord4737
ord4307
ord5468
ord13993
ord12040
ord12041
ord8669
ord2395
ord1482
ord9224
ord4299
ord2920
ord13994
ord7504
ord13992
ord6503
ord11231
ord13143
ord5606
ord7402
ord13548
ord2585
ord11628
ord4392
ord12360
ord12422
ord9960
ord11751
ord7932
ord1441
ord7251
ord8013
ord1587
ord2322
ord2131
ord12732
ord556
ord3780
ord1167
ord2759
ord5563
ord2748
ord13376
ord7252
ord13382
ord3761
ord3228
ord3229
ord3123
ord11672
ord985
ord8317
ord8314
ord4971
ord5251
ord5439
ord8882
ord5227
ord4974
ord5117
ord4957
ord7316
ord7317
ord7307
ord5115
ord7772
ord8743
ord12772
ord6194
ord3705
ord2431
ord6201
ord11497
ord11817
ord12602
ord1915
ord5387
ord533
ord2250
ord4642
ord3095
ord1421
ord4516
ord1938
ord960
ord14055
ord11905
ord14002
ord11848
ord13731
ord6383
ord2296
ord4524
ord4507
ord2755
ord7738
ord5547
ord5273
ord5270
ord1117
ord491
ord8256
ord12261
ord4847
ord4846
ord1420
ord12738
ord959
ord265
ord266
ord1634
ord310
ord1029
ord4604
ord956
ord14076
ord12768
ord12562
ord4748
ord2754
ord8263
ord4459
ord2857
ord13851
ord939
ord6143
ord1114
ord480
ord1422
ord961
ord2100
ord1383
ord12736
ord13379
ord913
ord6436
ord2203
ord11925
ord12737
ord4760
ord1665
ord306
ord3677
ord2306
ord2300
ord2302
ord1623
ord2165
ord12417
ord12380
ord5593
ord1669
ord1499
ord305
ord2875
ord12059
ord7744
ord4853
ord4812
ord2863
ord1480
ord1044
ord12605
ord3008
ord350
ord8300
ord1502
ord300
ord316
ord5558
ord2768
ord1419
ord2326
msvcr120
strncpy
sscanf
atof
_mktime64
isdigit
isspace
wcslen
mbstowcs
_mbscmp
_mbslen
__iob_func
_fdopen
setvbuf
_open_osfhandle
strrchr
wcscmp
wcscpy
_mbschr
feof
fgets
_pclose
_popen
_vswprintf
system
_localtime64_s
_time64
__argc
__argv
fread
calloc
strchr
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
?terminate@@YAXXZ
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
toupper
memcmp
memset
strcmp
printf
_vsnprintf
sprintf
_setmbcp
strpbrk
?what@exception@std@@UEBAPEBDXZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@AEBQEBD@Z
sprintf_s
_wcsnicmp
_wcsicmp
_strlwr
_strnicmp
free
malloc
_makepath
_splitpath
__CxxFrameHandler3
memcpy
strcpy
strlen
atoi
strtol
strcat
_stricmp
_purecall
memmove
_CxxThrowException
strstr
_strupr
memchr
strncmp
fclose
fopen
__C_specific_handler
_mbstok
_mbsrchr
_strdup
_access
_beginthreadex
qsort
vsprintf_s
realloc
fwrite
kernel32
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
GetSystemTimeAsFileTime
ResumeThread
SuspendThread
SetThreadPriority
OpenThread
GetCurrentThread
CreateThread
GetCurrentProcessId
CreateEventA
SetEvent
SetLastError
GetCurrentDirectoryA
Thread32First
LocalFree
GetCurrentProcess
GetFileAttributesA
GetDriveTypeA
FindNextFileA
Thread32Next
GetFileInformationByHandle
GetFileSize
GetModuleHandleA
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
FindFirstFileA
FindClose
ExpandEnvironmentStringsA
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
QueryDosDeviceA
GetLocalTime
WriteFile
SetFilePointer
ReadFile
FlushFileBuffers
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WritePrivateProfileStringA
GetPrivateProfileIntA
Sleep
GetVolumeInformationA
lstrcatA
GetModuleFileNameA
GetThreadPriority
ReadDirectoryChangesW
DefineDosDeviceA
SetVolumeMountPointA
lstrcpyA
GetPrivateProfileStringA
CopyFileA
GetTickCount
GetWindowsDirectoryA
ResetEvent
DeleteVolumeMountPointA
GetVolumeNameForVolumeMountPointA
GetDiskFreeSpaceExA
GetFileAttributesExA
SetFileAttributesA
ReleaseSemaphore
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
WaitForMultipleObjects
OpenFile
_lread
_lwrite
_lclose
CreateSemaphoreA
CreateFileMappingA
FindCloseChangeNotification
FindFirstChangeNotificationA
FindNextChangeNotification
GetFileTime
CreateDirectoryA
FileTimeToLocalFileTime
RemoveDirectoryA
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
GetSystemInfo
SetProcessAffinityMask
OutputDebugStringW
GetPrivateProfileSectionA
WritePrivateProfileSectionA
GetPrivateProfileSectionNamesA
TerminateThread
GetExitCodeThread
CreateNamedPipeA
SetFilePointerEx
GetStdHandle
FormatMessageA
AllocConsole
SetConsoleCtrlHandler
GlobalMemoryStatusEx
CreateFileW
FindFirstFileW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
SetFileAttributesW
SetFileTime
GetCompressedFileSizeA
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
GetCurrentThreadId
LocalAlloc
BackupRead
BackupWrite
GetLogicalDriveStringsA
GetFirmwareEnvironmentVariableA
CreateDirectoryExA
CreateDirectoryExW
CopyFileW
MoveFileA
CreateHardLinkA
FindFirstFileNameW
SetCurrentDirectoryA
lstrlenA
CreateProcessA
TerminateProcess
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionEx
DeviceIoControl
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetLastError
CloseHandle
DecodePointer
OutputDebugStringA
GetLogicalDrives
DeleteFileA
CreateFileA
GetComputerNameA
GetEnvironmentVariableA
GetExitCodeProcess
GetVersion
IsBadReadPtr
IsBadWritePtr
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
FindNextFileNameW
user32
GetWindowRect
ReleaseDC
GetSystemMetrics
GetDesktopWindow
GetProcessWindowStation
SetProcessWindowStation
CloseWindowStation
OpenWindowStationA
LoadBitmapW
LoadCursorA
ExitWindowsEx
GetThreadDesktop
CloseDesktop
SetThreadDesktop
OpenDesktopA
GetSysColor
SetCursor
RedrawWindow
InvalidateRect
UpdateWindow
EnableWindow
MessageBeep
MsgWaitForMultipleObjects
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassA
DefWindowProcA
PostThreadMessageA
PostMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
KillTimer
SetTimer
GetWindowDC
wsprintfA
gdi32
CreateBitmap
TextOutA
SetTextColor
SetBkMode
SelectObject
GetTextExtentPoint32A
DeleteDC
CreateFontA
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetObjectA
DeleteObject
CreateSolidBrush
GetStockObject
CreateFontIndirectA
winspool.drv
EnumPrintersA
advapi32
RegOpenKeyExA
RegisterServiceCtrlHandlerA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
RegDeleteTreeA
GetNamedSecurityInfoW
RegNotifyChangeKeyValue
CreateProcessAsUserA
DuplicateTokenEx
StartServiceA
StartServiceCtrlDispatcherA
OpenProcessToken
GetTokenInformation
LookupAccountSidA
AdjustTokenPrivileges
GetAce
GetAclInformation
GetSecurityDescriptorControl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorSacl
SetFileSecurityA
LookupPrivilegeValueA
RegCloseKey
RegCreateKeyA
RegDeleteKeyA
RegEnumKeyExA
RegEnumValueA
RegGetKeySecurity
RegLoadKeyA
RegOpenKeyA
CloseServiceHandle
RegQueryInfoKeyA
RegQueryValueExA
RegSetKeySecurity
RegSetValueExA
RegUnLoadKeyA
InitiateSystemShutdownA
GetNamedSecurityInfoA
ImpersonateLoggedOnUser
RevertToSelf
RegCreateKeyExA
RegCopyTreeA
CopySid
GetLengthSid
IsValidSid
LookupAccountNameA
GetUserNameA
RegDeleteValueA
ChangeServiceConfig2A
SetServiceStatus
shell32
SHCreateDirectoryExA
ShellExecuteA
ShellExecuteExA
SHFileOperationA
SHGetFileInfoA
shlwapi
StrToIntA
ole32
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
oleaut32
SafeArrayGetUBound
SysStringLen
SysFreeString
SysAllocStringLen
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantClear
VarBstrCat
SafeArrayGetDim
SafeArrayGetVartype
SysAllocString
ws2_32
recvfrom
ntohs
WSAIoctl
WSAGetLastError
gethostname
ntohl
listen
htons
bind
WSAEnumNetworkEvents
WSAStartup
gethostbyname
socket
setsockopt
sendto
inet_ntoa
inet_addr
htonl
closesocket
WSAEventSelect
WSACleanup
commandmodel64
COMMANDMODELAPI_SetCommandIP
COMMANDMODELAPI_CreateCommandSocket
COMMANDMODELAPI_SetCommandCALLBACK
COMMANDMODELAPI_CloseCommandSocket
COMMANDMODELAPI_SetCommandBindPort
COMMANDMODELAPI_SendCommandCallBack
COMMANDMODELAPI_SetCommandConPort
msvcp120
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??_7ios_base@std@@6B@
?_Orphan_all@_Container_base12@std@@QEAAXXZ
??1_Container_base12@std@@QEAA@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exception@std@@YA_NXZ
?_Swap_all@_Container_base0@std@@QEAAXAEAU12@@Z
?_Orphan_all@_Container_base0@std@@QEAAXXZ
?_Winerror_map@std@@YAPEBDH@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?_Syserror_map@std@@YAPEBDH@Z
??0id@locale@std@@QEAA@_K@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_BADOFF@std@@3_JB
tcpsim64
CleanTcpSimSocket
TcpSimCltCreateInstance
StartTcpSimSocket
iphlpapi
GetAdaptersInfo
GetIfTable
GetPerAdapterInfo
GetInterfaceInfo
netapi32
NetUserAdd
NetLocalGroupAddMembers
NetApiBufferFree
NetGetJoinInformation
mtftp64
CloseClient
StartClient
InitClient
gettemp0x64
ord7
ord21
ord12
ord11
ord98
p2pmain64
P2PSeedCreateInstance
ReleaseP2PSeedInstance
pdh
PdhRemoveCounter
PdhCollectQueryData
PdhCloseQuery
PdhGetFormattedCounterValue
PdhEnumObjectItemsA
PdhOpenQueryA
PdhAddCounterA
winmm
timeSetEvent
waveOutGetDevCapsA
timeKillEvent
setupapi
SetupDiClassNameFromGuidA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
SetupDiGetDeviceInstanceIdA
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupDiGetDeviceRegistryPropertyA
CM_Get_DevNode_Status
mprapi
MprConfigServerConnect
MprConfigGetFriendlyName
rpcrt4
UuidFromStringA
psapi
GetModuleFileNameExA
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Exports
Exports
Sections
.text Size: 759KB - Virtual size: 758KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 246KB - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ