Static task
static1
Behavioral task
behavioral1
Sample
NGVkZTM3.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
NGVkZTM3.exe
Resource
win10v2004-20230220-en
General
-
Target
NGVkZTM3.exe
-
Size
734KB
-
MD5
fe73a32f00c77fdb6b1f9b61e933b76b
-
SHA1
015a127407fc5092d52d6a91d51e4fbadc82612a
-
SHA256
b59dea96ef94e8d32ee1a1805174318643569bbdca0d7569ede19467ff09dcdc
-
SHA512
19f61da46c14d9c6738ef823d626ee8c5e9707742ae34a0728fa0d7e749a8e5d54384ee77cace273f73b80f1c7466cf0cfc107e6d4c738c099e9b1b21acd0b17
-
SSDEEP
12288:vxpWRVMDEHN7aiqoo3QtRcu8V0JNWWYgeWYg955/155/e7hzzoM3FYF1bop5apmh:kVqYcz4Ne7hfo8YF1cp5aUSaOUA4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NGVkZTM3.exe
Files
-
NGVkZTM3.exe.exe windows x64
3684d34cc50d2e42bf02f852302a1d06
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WaitForSingleObject
CreateEventW
SetEvent
LocalFree
WideCharToMultiByte
lstrcmpiW
ReadFile
SetHandleInformation
CreatePipe
MultiByteToWideChar
CloseHandle
CreateProcessW
CreateDirectoryW
WriteFile
SetFileTime
SetFilePointer
CreateFileW
GetFileAttributesW
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
UnmapViewOfFile
GetFileInformationByHandle
GetModuleFileNameW
GetLocalTime
GetFileSize
GetTickCount
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
GetCommandLineW
SetEndOfFile
WriteConsoleW
FlushFileBuffers
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
CreateThread
RaiseException
HeapReAlloc
GetLastError
Sleep
HeapSize
InitializeCriticalSectionEx
SetStdHandle
FindNextFileA
FindFirstFileExA
FindClose
GetCommandLineA
SetEnvironmentVariableA
FileTimeToSystemTime
HeapFree
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
IsDebuggerPresent
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
SignalObjectAndWait
SwitchToThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
RtlPcToFileHeader
RtlUnwindEx
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameA
GetACP
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetFileType
DeleteFileW
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
GetDesktopWindow
wsprintfW
advapi32
CloseServiceHandle
DeregisterEventSource
CreateServiceW
SystemFunction036
OpenSCManagerW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RegisterEventSourceW
shell32
CommandLineToArgvW
ws2_32
sendto
htons
recv
inet_addr
select
socket
WSAStartup
iphlpapi
GetNetworkParams
Sections
.text Size: 496KB - Virtual size: 495KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 184KB - Virtual size: 184KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ