Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
1.8MB
-
MD5
e34ad9a826aa56c04ce0f10c800b789f
-
SHA1
2f54efb23d78e570a7b29195520ccf346d181ad2
-
SHA256
4aa12984de37ac1fb650f1196e88fb5a64707e571382d641e1c70ce82e89cf0a
-
SHA512
951650d5d7ea77360efd1b81e8e1dd8ff06dc1e085053c019997ab7941aacfd15a1a07070c8d2428fca6304f3aceb91625b387d42a474931891e600caab8bcba
-
SSDEEP
49152:4m764jXzDNyW+Raj6uegFMSmigqz/V3I0b0jZo1/IrDanQOgHpYbftTJ0TCoGvRi:4m764jXzDNyW+Raj6uegFMSfz/Fb0lo8
Malware Config
Signatures
-
Privateloader family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource file.exe
Files
-
file.exe.exe windows x86
292aade11672b3abdd24722742cf6115
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeResource
CreateToolhelp32Snapshot
CreateEventW
MultiByteToWideChar
Sleep
GetTempPathA
GetModuleHandleExA
GetTimeZoneInformation
CopyFileA
GetLastError
GetFileAttributesA
TzSpecificLocalTimeToSystemTime
CreateFileA
SetEvent
LoadLibraryA
GetVersionExA
LockResource
DeleteFileA
Process32Next
CloseHandle
GetSystemInfo
CreateThread
GetWindowsDirectoryA
LoadResource
SetFileAttributesA
GetLocalTime
GetProcAddress
LocalFree
RemoveDirectoryA
ExitProcess
GetCurrentProcessId
GlobalMemoryStatusEx
FreeLibrary
WideCharToMultiByte
CreateDirectoryA
GetSystemTime
CreateFileMappingW
MapViewOfFile
GetPrivateProfileStringA
IsWow64Process
GetComputerNameA
SetUnhandledExceptionFilter
lstrcatA
lstrcpyA
HeapFree
HeapAlloc
lstrcpynA
GetProcessHeap
ReadFile
SetFilePointer
CreateFileW
GetLocaleInfoA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
FindClose
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileW
HeapReAlloc
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
GetFileSize
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTimeAsFileTime
FormatMessageA
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
GetModuleHandleA
GetCurrentThreadId
LocalAlloc
WaitForSingleObject
GetVolumeInformationA
lstrlenA
FindResourceA
FindNextFileA
GetUserDefaultLocaleName
TerminateProcess
WriteFile
GetCurrentProcess
FindFirstFileA
Process32First
EnumSystemLocalesW
GetModuleFileNameA
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetStdHandle
GetModuleFileNameW
GetPrivateProfileSectionNamesA
SizeofResource
EnterCriticalSection
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
GetFileType
SetFilePointerEx
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
RaiseException
RtlUnwind
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFinalPathNameByHandleW
GetModuleHandleW
GetFileInformationByHandleEx
GetLocaleInfoEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
LCMapStringEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
InitializeCriticalSectionAndSpinCount
ResetEvent
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
user32
ReleaseDC
GetDesktopWindow
GetKeyboardLayoutList
wsprintfA
GetSystemMetrics
GetDC
GetWindowRect
EnumDisplayDevicesA
CharNextA
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteObject
BitBlt
advapi32
SystemFunction036
RegOpenKeyExA
GetUserNameA
CredFree
RegCloseKey
GetCurrentHwProfileA
RegQueryValueExA
CredEnumerateA
RegEnumKeyExA
shell32
ShellExecuteA
SHGetFolderPathA
ws2_32
closesocket
getaddrinfo
WSACleanup
send
socket
connect
WSAStartup
freeaddrinfo
setsockopt
WSAGetLastError
shutdown
recv
crypt32
CryptUnprotectData
CryptStringToBinaryA
gdiplus
GdiplusShutdown
GdiplusStartup
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipGetImageEncoders
setupapi
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ