Static task
static1
Behavioral task
behavioral1
Sample
242d8004040640f2c95a9d9e6cbfce16ac6bac15e8864d51b3eac10c2452f6a6.exe
Resource
win10v2004-20230220-en
General
-
Target
242d8004040640f2c95a9d9e6cbfce16ac6bac15e8864d51b3eac10c2452f6a6
-
Size
33.4MB
-
MD5
69590a3641077263599f0165d89dcbd1
-
SHA1
e79aef81dfd90bd86629624a9baad258c795a8c9
-
SHA256
242d8004040640f2c95a9d9e6cbfce16ac6bac15e8864d51b3eac10c2452f6a6
-
SHA512
743b387d77b921f7eab38590e0fbffe85229a7a5f84d6d73f3cc000d80895d0efb40734e8d8a02f01d61bb6ad38ed3236227f2c88d6acb972c0da6fd5343ce43
-
SSDEEP
24576:CRNOhpwBqz89wWuDaeIue8H1oSgcRaCG2wfMd:U2pw8XKHS1HgaaL2wfs
Malware Config
Signatures
Files
-
242d8004040640f2c95a9d9e6cbfce16ac6bac15e8864d51b3eac10c2452f6a6.exe windows x64
b339a0fbff5933e31a26fa8c6d997b02
Code Sign
09:6c:63:e4:4f:62:f4:8a:4d:27:92:d8:3b:e3:77:5eCertificate
IssuerCN=FortuneSmileWorkTeam,L=Scottsdale,ST=Arizona,C=USNot Before09-03-2023 00:00Not After09-03-2024 23:59SubjectCN=FortuneSmileWorkTeam,L=Scottsdale,ST=Arizona,C=USSigner
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionEx
DecodePointer
HeapReAlloc
MultiByteToWideChar
CreateFileW
HeapSize
HeapDestroy
SetThreadIdealProcessor
SetProcessPriorityBoost
WideCharToMultiByte
SetStdHandle
SetProcessAffinityMask
SetFileInformationByHandle
OpenFileMappingW
NeedCurrentDirectoryForExePathA
LockFile
GetTapeStatus
GetSystemDefaultLangID
GetFileBandwidthReservation
CreateProcessW
CreatePipe
CreateHardLinkTransactedA
GetModuleHandleA
DeleteCriticalSection
GetProcAddress
WriteConsoleW
CreateThread
OutputDebugStringA
GetProcessHeap
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
FormatMessageA
EncodePointer
EnterCriticalSection
LeaveCriticalSection
LCMapStringEx
LocalFree
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
RaiseException
GetLastError
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetCurrentThread
HeapFree
HeapAlloc
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
ReadConsoleW
SetFilePointerEx
SetConsoleCtrlHandler
GetTimeZoneInformation
FindClose
FindFirstFileExA
FindFirstFileExW
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
RtlUnwind
gdi32
SetICMProfileA
GetRegionData
GetClipRgn
EndPage
CreateHatchBrush
GetLogColorSpaceA
advapi32
SetTokenInformation
RegOpenKeyExA
RegLoadAppKeyA
PrivilegedServiceAuditAlarmA
OpenBackupEventLogA
LookupPrivilegeValueW
LogonUserExA
ImpersonateLoggedOnUser
GetTrusteeFormW
GetSecurityDescriptorSacl
GetPrivateObjectSecurity
AbortSystemShutdownA
shlwapi
PathIsFileSpecA
PathFileExistsW
PathCreateFromUrlW
ChrCmpIW
PathIsRelativeW
SHReleaseThreadRef
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 155KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 32.2MB - Virtual size: 32.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ