Static task
static1
Behavioral task
behavioral1
Sample
htcacheclean.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
htcacheclean.exe
Resource
win10v2004-20230220-en
General
-
Target
htcacheclean.exe
-
Size
52KB
-
MD5
92ef2ecafc0049485f29fae6c977de9a
-
SHA1
90e6651d5b8a639e8184e4cb1a68c1087cb07d41
-
SHA256
0d99d13280d31aad77bc6f0c93e0fd18707fb27680e2f484caea56fbd3fb39ee
-
SHA512
1063d61ae77f8d840178cf610ceeb576ae83a3f10b014a69d59cef696adffa9c887fcbcc8d26e1c7a4aab4bc73b85082e3f77fb5d77377663ac7d0599143f61c
-
SSDEEP
1536:bIPw6pKck1D/FMtcT+7K3sfG8c6V6Zqzr:MI6puBdYKwJc6Mer
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource htcacheclean.exe
Files
-
htcacheclean.exe.exe windows x86
2433e0b6ca4f06943e83d05516a8f9a0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
toupper
atoi
_ftol
modf
realloc
__p__environ
__p__wenviron
strncmp
fprintf
_iob
_errno
memchr
wcslen
wcscpy
wcschr
__mb_cur_max
_isctype
_pctype
wcsncmp
free
malloc
strrchr
strchr
exit
signal
_strnicmp
_stricmp
kernel32
UnlockFileEx
UnlockFile
LockFileEx
LockFile
LoadLibraryA
GetProcAddress
GetVersionExA
TerminateProcess
LeaveCriticalSection
SetEvent
ReleaseMutex
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateMutexA
RemoveDirectoryW
RemoveDirectoryA
FindNextFileW
FindNextFileA
TlsFree
TlsAlloc
LocalFree
GetFileType
GetLastError
GetFileInformationByHandle
FindFirstFileA
GetDriveTypeA
GetFullPathNameW
FindClose
FindFirstFileW
GetSystemTimeAsFileTime
Sleep
CloseHandle
GetExitCodeProcess
WaitForSingleObject
SetStdHandle
GetStdHandle
SetFilePointer
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
SetLastError
GetCommandLineW
GetDriveTypeW
GetFullPathNameA
GetCurrentDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryA
SetCurrentDirectoryW
CreateEventA
GetOverlappedResult
ReadFile
PeekNamedPipe
WriteFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GlobalFree
advapi32
FreeSid
AllocateAndInitializeSid
wsock32
WSAStartup
WSACleanup
ntohl
Sections
.text Size: 36KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ