Static task
static1
Behavioral task
behavioral1
Sample
182182dc556b72c9f06704f7ccc695e01538ab5dd84bf8baf991524adb3f7b80.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
182182dc556b72c9f06704f7ccc695e01538ab5dd84bf8baf991524adb3f7b80.exe
Resource
win10v2004-20230221-en
General
-
Target
182182dc556b72c9f06704f7ccc695e01538ab5dd84bf8baf991524adb3f7b80
-
Size
1.3MB
-
MD5
26dd1a28334f495cc0859a2a049da26a
-
SHA1
b8a13af857c64899f1450b9e667e78f169e30ce9
-
SHA256
182182dc556b72c9f06704f7ccc695e01538ab5dd84bf8baf991524adb3f7b80
-
SHA512
8f5b01053bbf34ed3e5f7d493c48b1fb85745c8f2e3e52c3858df7f211d4e260f407730ca6f53a57b523a5c91463af898a1147e5de152eb2b7e01570fb409c86
-
SSDEEP
24576:V5ynb+uCRYZlP9Tnc8/iY24XVPdKuMMrRvBXDvA6E5WiHsnES46tObRznaLkdq:7IKeVTcM7PFKuMMtxDIF9H6LtObZnaLF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 182182dc556b72c9f06704f7ccc695e01538ab5dd84bf8baf991524adb3f7b80
Files
-
182182dc556b72c9f06704f7ccc695e01538ab5dd84bf8baf991524adb3f7b80.exe windows x86
02f7ba53d1589df7dd4fdac901c0f6f7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetLocalTime
SystemTimeToFileTime
GetTempPathA
GetDiskFreeSpaceA
GetACP
GetThreadLocale
IsBadReadPtr
GetComputerNameA
IsValidLocale
GetSystemDirectoryA
GetWindowsDirectoryA
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
SetStdHandle
GetConsoleCP
HeapSize
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
HeapReAlloc
VirtualAlloc
LCMapStringW
GetSystemInfo
SetLastError
GetExitCodeThread
DuplicateHandle
GetProcessHeap
HeapAlloc
TerminateProcess
HeapFree
GetModuleHandleA
GetModuleFileNameA
VirtualQuery
GetCurrentThreadId
SetConsoleCtrlHandler
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleW
VirtualFree
HeapDestroy
HeapCreate
RaiseException
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
LockFile
UnlockFile
IsBadStringPtrW
IsBadStringPtrA
VirtualProtect
FlushInstructionCache
GetLogicalDrives
GetDriveTypeA
DeviceIoControl
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
GetFileTime
GetFileSize
SetEndOfFile
FlushFileBuffers
SetFilePointer
ReadFile
WriteFile
GetSystemTimeAsFileTime
CreateDirectoryA
GetCurrentDirectoryA
GetTickCount
GetVersion
GetVersionExA
GetCurrentProcess
CreateFileA
SetFileTime
GetCommandLineA
LCMapStringA
GetCurrentProcessId
WaitForMultipleObjects
SetEvent
MultiByteToWideChar
WideCharToMultiByte
TlsSetValue
LocalAlloc
LocalFree
TlsGetValue
TlsFree
ExitProcess
TlsAlloc
GetFileAttributesA
GetFullPathNameA
SetCurrentDirectoryA
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemTime
CloseHandle
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
Sleep
WaitForSingleObject
GetCurrentThread
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetLastError
GetPrivateProfileSectionA
WritePrivateProfileSectionA
AreFileApisANSI
LoadLibraryA
GetEnvironmentVariableA
FreeLibrary
GetProcAddress
OpenProcess
GetExitCodeProcess
GetProfileStringA
DeleteFileA
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetConsoleMode
IsBadWritePtr
OpenEventA
CreateEventA
user32
GetSystemMenu
CharLowerBuffA
AppendMenuA
GetSystemMetrics
MessageBoxA
PeekMessageA
CallMsgFilterA
TranslateMessage
DispatchMessageA
DrawMenuBar
CharUpperBuffA
wsprintfA
LoadStringA
advapi32
RegOpenKeyExA
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegDeleteValueA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegCloseKey
SetSecurityDescriptorDacl
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegFlushKey
InitializeSecurityDescriptor
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
shell32
ShellExecuteExA
wsock32
accept
WSAStartup
WSACleanup
getpeername
__WSAFDIsSet
gethostname
gethostbyaddr
htons
inet_addr
gethostbyname
WSAGetLastError
ioctlsocket
select
connect
inet_ntoa
setsockopt
socket
closesocket
send
getsockopt
recv
bind
recvfrom
sendto
shutdown
Sections
__wibu00 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
__wibu01 Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu02 Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu03 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE