Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
635KB
-
MD5
a06ec6c0adfcc5034586fbf877e35b54
-
SHA1
4278f26913b85bfdc4cbf0a5909e2d810ac583f7
-
SHA256
9d4bf2fa222c2fa818ed73796f639d7138d2065616ee126c38b8145723164a94
-
SHA512
6ff09d1cee6862e6b6995462b8283047f841736a2591edfe052c1900ad46b59d2eba942d065aa1ca8c6d4ee9a6a49f4b9b15fd4e378c72745996eaa5755dbfc7
-
SSDEEP
12288:3quFnYzy3VGiBX5fYwarPZpBqxVyfndmLB:3qOn0ziCPzBqDem9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows x64
3c8dcaebe69607cf65907d4c035ab4d4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
EventWrite
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryValueExW
InitiateShutdownW
EventUnregister
EventRegister
RegQueryInfoKeyW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
InitializeSecurityDescriptor
CreateWellKnownSid
SetEntriesInAclW
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
RegDeleteKeyW
RegGetValueW
RegEnumValueW
RegDeleteTreeW
OpenProcessToken
LookupPrivilegeValueW
PrivilegeCheck
AdjustTokenPrivileges
kernel32
GetProcessHeap
OpenProcess
QueryFullProcessImageNameW
GetExitCodeProcess
Sleep
GetModuleHandleW
WaitForMultipleObjectsEx
WaitForSingleObjectEx
CreateEventW
SetEvent
CreateMutexW
ReleaseMutex
CreateThread
GetLocaleInfoEx
GetVersionExW
CreateFileW
WriteFile
GetLocalTime
HeapSetInformation
GetCurrentThreadId
ExpandEnvironmentStringsW
FreeLibrary
ExitProcess
FormatMessageW
LoadLibraryW
RaiseException
GetCommandLineW
WaitForSingleObject
GetModuleFileNameW
GetProcAddress
HeapFree
GetFileAttributesW
GetFileAttributesExW
GetTickCount64
GetSystemTimeAsFileTime
GetNativeSystemInfo
GetLocaleInfoW
GetSystemDefaultUILanguage
GetProductInfo
GetCurrentDirectoryW
SearchPathW
GetSystemDirectoryW
GetFileMUIPath
LocaleNameToLCID
EnumUILanguagesW
GetUserPreferredUILanguages
SetProcessPreferredUILanguages
NotifyUILanguageChange
GetExitCodeThread
GetDiskFreeSpaceExW
HeapAlloc
GetTempPathW
CreateProcessW
CreateDirectoryW
FindFirstFileW
DeleteFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetSystemPreferredUILanguages
GetThreadPreferredUILanguages
GetCurrentProcess
GetUILanguageInfo
K32EnumProcesses
LocalAlloc
LocalFree
CloseHandle
GetWindowsDirectoryW
QueryPerformanceCounter
SetUnhandledExceptionFilter
OutputDebugStringA
GetStartupInfoW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
TerminateProcess
UnhandledExceptionFilter
VirtualQuery
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualProtect
TerminateThread
SetLastError
GetLastError
LeaveCriticalSection
EnterCriticalSection
MulDiv
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetTickCount
gdi32
SetTextColor
SetBkMode
CreateRectRgn
SelectObject
user32
GetWindowLongPtrW
DestroyIcon
LoadImageW
SetActiveWindow
GetSystemMetrics
EndPaint
CreateWindowExW
MapWindowPoints
DestroyWindow
DrawTextW
BeginPaint
InvalidateRect
GetWindowRect
SetWindowPos
GetClientRect
SetWindowRgn
GetSysColor
SendMessageW
GetParent
LoadStringW
FindWindowW
CharUpperW
SetDlgItemTextW
DefWindowProcW
SetForegroundWindow
PostMessageW
LoadCursorW
SetCursor
GetDlgItemTextW
UnregisterClassA
EnableWindow
GetDlgItem
SendDlgItemMessageW
GetDlgCtrlID
SetWindowLongW
SendNotifyMessageW
RegisterWindowMessageW
SetTimer
KillTimer
SystemParametersInfoW
PostThreadMessageW
LoadIconW
DispatchMessageW
GetFocus
GetWindowLongW
ShowWindow
GetAncestor
TranslateMessage
GetMessageW
CharNextW
UnregisterClassW
AllowSetForegroundWindow
RegisterClassExW
MessageBoxW
ExitWindowsEx
SetWindowLongPtrW
msvcrt
_isctype
_onexit
_lock
__dllonexit
toupper
iswctype
_unlock
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_amsg_exit
towupper
_wcmdln
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
abort
__crtGetStringTypeW
__crtLCMapStringW
memcpy
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
__mb_cur_max
_errno
__pctype_func
setlocale
_initterm
iswspace
__uncaught_exception
__CxxFrameHandler3
_callnewh
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
__C_specific_handler
memset
towlower
tolower
memmove
_wgetenv
_ltow_s
wcsncmp
malloc
wcscat_s
wcscpy_s
wcsncpy_s
_wgetcwd
_wsetlocale
free
strcspn
memchr
localeconv
sprintf_s
_wcsicoll
fclose
_wcsnicmp
fgetws
_wfopen
_vsnwprintf
wcstoul
??0exception@@QEAA@XZ
_wcsicmp
wcschr
iswalpha
wcsstr
memmove_s
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
memcpy_s
_purecall
wcstol
ceil
ntdll
RtlGetUILanguageInfo
RtlNtStatusToDosError
WinSqmAddToStream
RtlGetNtProductType
NtGetMUIRegistryInfo
NtIsUILanguageComitted
RtlpSetPreferredUILanguages
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmIsOptedIn
shell32
ShellExecuteExW
ord28
SHCreateItemInKnownFolder
SHGetIDListFromObject
SHBrowseForFolderW
SHGetPathFromIDListW
ord51
SHGetDataFromIDListW
SHBindToFolderIDListParent
ole32
CoGetObject
StringFromGUID2
CoInitialize
CoUninitialize
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoRegisterClassObject
CoResumeClassObjects
CoRevokeClassObject
CoSuspendClassObjects
CoInitializeSecurity
CoGetCallContext
CoWaitForMultipleHandles
CoTaskMemFree
slc
SLGetWindowsInformationDWORD
SLGetWindowsInformation
dpx
DpxNewJob
shlwapi
PathFileExistsW
StrCmpIW
StrStrIW
ord158
StrStrNW
PathFindExtensionW
StrRetToStrW
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsDirectoryW
PathMatchSpecExW
ord219
Sections
.text Size: 492KB - Virtual size: 491KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 109KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ