Static task
static1
Behavioral task
behavioral1
Sample
433e68ed7667423a9cacabcb18a35309bbbc4e5cd9bb23b42c845a12b513fb1a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
433e68ed7667423a9cacabcb18a35309bbbc4e5cd9bb23b42c845a12b513fb1a.exe
Resource
win10v2004-20230220-en
General
-
Target
433e68ed7667423a9cacabcb18a35309bbbc4e5cd9bb23b42c845a12b513fb1a
-
Size
150KB
-
MD5
18c5e5b6b6841e8eebeff50ce4cf0f82
-
SHA1
6c440bcacb70dfba264618f32239d7fb3a374983
-
SHA256
433e68ed7667423a9cacabcb18a35309bbbc4e5cd9bb23b42c845a12b513fb1a
-
SHA512
30fd5986f9b0da9d444cbe7f50d0714bc746f1bc485b0eb6944111e4485b74b0e1e5692b62c1ef5aa042d553b86d94d214440a0ec47aaab580861cfbf1c5c58c
-
SSDEEP
3072:EbejckEEqX7A4mCOvqqdSC3yMLDDEPv9wSBmsRLMqqDLy/zVRFB1bXR:E8sDX7A4mCOS0SeyML3ywInqqqDLuRRP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 433e68ed7667423a9cacabcb18a35309bbbc4e5cd9bb23b42c845a12b513fb1a
Files
-
433e68ed7667423a9cacabcb18a35309bbbc4e5cd9bb23b42c845a12b513fb1a.exe windows x86
1ad4a43496958e4d628325a8a4a6dd22
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcessHeap
SetEndOfFile
WriteConsoleW
ReadFile
LoadLibraryW
HeapReAlloc
FlushFileBuffers
SetStdHandle
FindFirstFileA
GetConsoleCP
SetFilePointer
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapCreate
GetProcAddress
LoadLibraryA
CreateThread
WaitForSingleObject
GetTickCount
GlobalFree
CreateFileA
GlobalAlloc
FindNextFileA
FindClose
CreateMutexA
GetLastError
GetPrivateProfileIntA
Sleep
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameW
WriteFile
ExitProcess
CloseHandle
GetLocalTime
GetModuleFileNameA
GetConsoleMode
GetFileAttributesA
RaiseException
RtlUnwind
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
HeapAlloc
HeapSize
CreateFileW
user32
MessageBoxA
DestroyWindow
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetIconInfo
GetDesktopWindow
GetDC
FindWindowA
SetForegroundWindow
SetCursorPos
SendMessageA
LoadAcceleratorsA
LoadIconA
LoadCursorA
RegisterClassExA
DefWindowProcA
GetWindowRect
UnregisterHotKey
PostQuitMessage
SetWindowPos
GetSystemMetrics
CreateWindowExA
ShowWindow
UpdateWindow
gdi32
BitBlt
GetDIBits
DeleteObject
DeleteDC
GetDeviceCaps
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
advapi32
RegOpenKeyA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
shell32
ShellExecuteA
d3d9
Direct3DCreate9
d3dx9_33
D3DXCreateTextureFromFileExA
blendingsysset
?ef_ResetDevice@@YAJJ@Z
?ef_Init@@YAJPAPAPAUIDirect3DDevice9@@PAPAEPAH22PAPAX_N@Z
?ef_EdgeMessage@@YAJUtagRECT@@IIJ@Z
?ef_Release@@YAJXZ
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ