Static task
static1
Behavioral task
behavioral1
Sample
57dd9eb9a1ca7d7ecd1bf9c3412f826c1115538b183aee7cf698380b26857cdb.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
57dd9eb9a1ca7d7ecd1bf9c3412f826c1115538b183aee7cf698380b26857cdb.exe
Resource
win10v2004-20230220-en
General
-
Target
57dd9eb9a1ca7d7ecd1bf9c3412f826c1115538b183aee7cf698380b26857cdb
-
Size
2.2MB
-
MD5
3fbe9d8556bb9e91ee001b47473e9980
-
SHA1
176207b4d24616d66ffcf70bcfdbdc3dbfab1555
-
SHA256
57dd9eb9a1ca7d7ecd1bf9c3412f826c1115538b183aee7cf698380b26857cdb
-
SHA512
50e20f403c35dfe46d0307a0daee43a5c82c85e1acbf80269b4cd9414826846c5a8b042114734df4b2d45a4deca350bfb7ddc0f82ddb8a3416b4cf3d92b1e26c
-
SSDEEP
49152:6BWin/JuMr4kThw18EqALL01cNRTNGazt9wMaXOsWf85PHnS:hin/JuMc8EqEL01czjw/S
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 57dd9eb9a1ca7d7ecd1bf9c3412f826c1115538b183aee7cf698380b26857cdb
Files
-
57dd9eb9a1ca7d7ecd1bf9c3412f826c1115538b183aee7cf698380b26857cdb.exe windows x86
9ca89b78a0f2b079ca6ab4ff32dfda9c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
LoadResource
FindResourceW
GetProcAddress
GetModuleHandleW
FreeLibrary
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
IsBadStringPtrW
WriteProcessMemory
WaitForSingleObject
OpenProcess
CreateEventW
SetEvent
LoadLibraryA
ResetEvent
VirtualAllocEx
CreateRemoteThread
VirtualFreeEx
OpenMutexW
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
WriteFile
CreateFileW
GetModuleHandleExW
CreateMutexW
ReleaseMutex
MultiByteToWideChar
HeapAlloc
LocalFree
GetProcessHeap
CreateDirectoryW
GetWindowsDirectoryW
ReadFile
SetFilePointer
SetEndOfFile
Sleep
DeleteFileW
GetFileSize
GetTickCount
InterlockedExchange
SetLastError
InterlockedExchangeAdd
lstrlenW
LoadLibraryW
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
GetVersionExW
GetCurrentProcess
GetFileAttributesW
SetStdHandle
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCurrentThreadId
LeaveCriticalSection
WaitForMultipleObjects
GetModuleFileNameW
InterlockedDecrement
EnterCriticalSection
SizeofResource
DeleteCriticalSection
DecodePointer
RaiseException
CloseHandle
GetLastError
SetErrorMode
InitializeCriticalSectionAndSpinCount
WriteConsoleW
GetCurrentProcessId
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
LockResource
GetSystemInfo
SearchPathW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
ResumeThread
OpenEventW
GetACP
WideCharToMultiByte
GetVolumeInformationW
GetDiskFreeSpaceW
GetDriveTypeW
FindFirstFileW
GetLongPathNameW
GetShortPathNameW
GetFileAttributesExW
TryEnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindClose
LocalFileTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
HeapFree
GetComputerNameExW
GlobalAlloc
GlobalFree
SetFileTime
GetFileTime
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
GetSystemDirectoryW
SetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileExW
CopyFileW
GetTempFileNameW
MoveFileW
DeviceIoControl
lstrcatW
lstrcpyW
GetFileSizeEx
CreateProcessW
GetExitCodeProcess
FormatMessageW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetLocalTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlCaptureContext
ReleaseSemaphore
GetProcessId
SuspendThread
TerminateThread
CreateThread
GetThreadContext
CreateSemaphoreW
OpenThread
VirtualQueryEx
SetNamedPipeHandleState
DuplicateHandle
TransactNamedPipe
WaitNamedPipeW
GetStdHandle
GetFileType
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameA
SetConsoleCtrlHandler
GetCurrentThread
HeapSize
HeapReAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
user32
UnregisterClassW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
PostThreadMessageW
GetMessageW
DispatchMessageW
PeekMessageW
CharNextW
TranslateMessage
advapi32
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
shell32
SHGetFolderPathW
ole32
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VarUI4FromStr
SysFreeString
shlwapi
PathFileExistsW
Sections
.text Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 304KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 74KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ