Static task
static1
Behavioral task
behavioral1
Sample
af53db776579978725aa95d1fc5bed218763e339fc10f633e2168c190b1d6e46.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
af53db776579978725aa95d1fc5bed218763e339fc10f633e2168c190b1d6e46.exe
Resource
win10v2004-20230220-en
General
-
Target
af53db776579978725aa95d1fc5bed218763e339fc10f633e2168c190b1d6e46
-
Size
832KB
-
MD5
e02c4e8545bb4d6b2ea8af42e70eb91e
-
SHA1
1edea0ebe6e900993b65f68ceed110ca1b02c88f
-
SHA256
af53db776579978725aa95d1fc5bed218763e339fc10f633e2168c190b1d6e46
-
SHA512
88d26391d061d1592b849249e6f70dbc6cb4d66c818c33f0c6de05d7ce452afb7faf4793c4efd7dc1e6579947151abf980d7d54bc1be6516e5e2978eb43d8d5e
-
SSDEEP
12288:+pg2Qd1Vg7iGAOGLAjGarKYI7pqK6iOThwXq0AI8b+SuO7JA:+e2WgmGzGL246vTN1i5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource af53db776579978725aa95d1fc5bed218763e339fc10f633e2168c190b1d6e46
Files
-
af53db776579978725aa95d1fc5bed218763e339fc10f633e2168c190b1d6e46.exe windows x86
42183a04b48fe35513ef13bed86bb5c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
CreateFileA
LeaveCriticalSection
SetFilePointer
DeleteFileA
GetLocalTime
FormatMessageA
MultiByteToWideChar
WaitForSingleObject
GetCurrentProcessId
TerminateProcess
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoA
IsValidCodePage
FileTimeToLocalFileTime
FileTimeToSystemTime
GetVersionExW
lstrcmpiA
SetEvent
CreateEventW
OpenEventW
CreateThread
InterlockedDecrement
HeapFree
GetProcessHeap
HeapAlloc
FlushFileBuffers
VirtualFree
VirtualAlloc
GetFileSize
CreateDirectoryW
SetEndOfFile
ReadFile
GetFileSizeEx
WriteFile
GetModuleHandleW
CreateFileW
GetModuleFileNameW
Sleep
GetCurrentThreadId
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
GetFileInformationByHandle
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
SleepEx
VerSetConditionMask
VerifyVersionInfoA
SetEnvironmentVariableA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
HeapSize
GetTimeZoneInformation
GetStringTypeA
EnumSystemLocalesA
GetOEMCP
GetACP
HeapReAlloc
HeapCreate
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitThread
CompareStringW
CompareStringA
GetStringTypeW
GetCPInfo
LCMapStringW
LCMapStringA
CloseHandle
GetLastError
GetCurrentProcess
GetTickCount
FreeLibrary
GetProcAddress
RtlUnwind
RaiseException
GetStartupInfoW
ExitProcess
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryA
GetModuleHandleA
VirtualProtect
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
FindNextFileW
FindClose
FindFirstFileW
advapi32
CryptEncrypt
CryptImportKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegQueryValueExA
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
CryptDestroyKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
shell32
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ole32
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateGuid
oleaut32
SysFreeString
SysAllocString
VariantInit
VariantClear
shlwapi
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsA
ws2_32
inet_ntoa
gethostbyname
getaddrinfo
ntohl
htons
freeaddrinfo
ntohs
WSAStartup
WSACleanup
getsockname
getsockopt
getpeername
closesocket
sendto
recvfrom
WSAIoctl
setsockopt
inet_addr
bind
shutdown
send
recv
connect
WSASetLastError
__WSAFDIsSet
WSAGetLastError
htonl
accept
listen
select
ioctlsocket
socket
gethostname
wldap32
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46
ord22
Sections
.text Size: 722KB - Virtual size: 721KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 932B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ