Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
53d606ea6cea8fba9ca4fdd1af411c1212ad20678cd22a43697c4b8e9b371f62.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
53d606ea6cea8fba9ca4fdd1af411c1212ad20678cd22a43697c4b8e9b371f62.exe
Resource
win10v2004-en-20220113
General
-
Target
53d606ea6cea8fba9ca4fdd1af411c1212ad20678cd22a43697c4b8e9b371f62.exe
-
Size
129KB
-
MD5
ed2fd6050340ecc464621137c7add3ad
-
SHA1
07adc67a3c72e76127ced9c0d72cea32b40d5c55
-
SHA256
53d606ea6cea8fba9ca4fdd1af411c1212ad20678cd22a43697c4b8e9b371f62
-
SHA512
b8aff1b7953baf328f3b076afe81318c940925d71bbfec70987b5c9cc660baba747166506e453b88aa8212a887229cfa4e01c85d157d0b1a051c8e3ad0813e44
-
SSDEEP
3072:Avu5qui5yfZKSfkZupMLWxjhcoQOlSv9E5V/O8h9:Auqt54KJZuuLWxqoQOm9U/Oi
Malware Config
Signatures
-
TargetCompany Payload 1 IoCs
resource yara_rule sample family_targetcompany -
Targetcompany family
Files
-
53d606ea6cea8fba9ca4fdd1af411c1212ad20678cd22a43697c4b8e9b371f62.exe.exe windows x86
23aaf53347d1ff573792bd5165932149
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
GetUserDefaultLangID
InitializeCriticalSection
OpenProcess
WideCharToMultiByte
Sleep
LeaveCriticalSection
TerminateProcess
ReadFile
GetModuleFileNameW
CreateFileW
lstrcatA
lstrcmpW
MultiByteToWideChar
GetFileSizeEx
GetLastError
GetProcAddress
MoveFileW
EnterCriticalSection
FindClose
PostQueuedCompletionStatus
DeviceIoControl
GetSystemInfo
WaitForMultipleObjects
Process32NextW
lstrcmpiW
CreateIoCompletionPort
GetModuleHandleA
lstrcatW
FindNextFileW
CreateToolhelp32Snapshot
DeleteCriticalSection
GetCurrentThread
GetDiskFreeSpaceExW
CloseHandle
GetWindowsDirectoryW
GetCurrentProcessId
LocalFree
lstrcpyW
CreateThread
FindVolumeClose
SetEvent
TerminateThread
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
GetFileType
CreateEventW
QueryDosDeviceW
DuplicateHandle
FindFirstVolumeW
GetTickCount
GetModuleHandleW
FindFirstFileExW
GetLogicalDrives
WaitForSingleObject
QueryPerformanceCounter
SetFilePointerEx
GetCurrentProcess
GetQueuedCompletionStatus
InterlockedIncrement
SetErrorMode
GetDriveTypeW
lstrlenA
GetComputerNameA
GetCommandLineW
ExitProcess
CreateFileA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetCurrentThreadId
lstrlenW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
SetEndOfFile
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
HeapSize
RaiseException
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoA
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
LoadLibraryA
SetFilePointer
GetConsoleCP
GetConsoleMode
advapi32
LsaClose
LsaFreeMemory
AdjustTokenPrivileges
FreeSid
SetEntriesInAclW
AllocateAndInitializeSid
CryptGenRandom
OpenProcessToken
LookupPrivilegeValueW
SetNamedSecurityInfoW
CryptReleaseContext
LsaOpenPolicy
OpenThreadToken
LsaQueryInformationPolicy
CryptAcquireContextW
shell32
CommandLineToArgvW
ShellExecuteW
netapi32
NetApiBufferFree
NetShareEnum
shlwapi
wnsprintfW
wvnsprintfW
StrStrIW
SHDeleteKeyW
StrCmpNIW
StrCmpNW
wnsprintfA
iphlpapi
GetIpNetTable
ws2_32
inet_ntoa
wininet
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetQueryOptionW
InternetQueryDataAvailable
InternetCrackUrlW
InternetConnectW
HttpSendRequestW
InternetSetOptionW
HttpOpenRequestW
Sections
.text Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ