Static task
static1
Behavioral task
behavioral1
Sample
autoconv.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
autoconv.exe
Resource
win10v2004-20230220-en
General
-
Target
autoconv.exe
-
Size
906KB
-
MD5
ffe7d06486170e74253b1dfc73b64d1d
-
SHA1
c13edee10aba151c0ed6ce6b583aa5d9880af91c
-
SHA256
514ab06ace1c6c7afd145f7cdf62d48e8c04139a3d3a076c43f8bf11785f0a34
-
SHA512
1304c9cdfb5924aba5a08de26abc1b7e7d097ae01991c9255dfba05b97346e8ddc831190db843282765987ba9007b119d9475177001df654e7980d943a804181
-
SSDEEP
12288:iJi6MN+4VfBmO2cs0l0EOp4GspssgqY9I+U57fUog:Qi6uhBp2KlBOplspssgqYm7fRg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource autoconv.exe
Files
-
autoconv.exe.exe windows x86
35e9c235114a8c632becb3f85b3ba29a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
_wcsicmp
_wcsupr
LdrSetMUICacheType
RtlInitUnicodeString
NtSetInformationFile
NtDelayExecution
NtClose
RtlAdjustPrivilege
_stricmp
NtOpenFile
NtLoadDriver
NtTerminateProcess
RtlCaptureContext
RtlUnhandledExceptionFilter
_aullshr
memmove
RtlFreeAnsiString
RtlAllocateHeap
RtlNormalizeProcessParams
RtlUnicodeStringToAnsiString
isspace
_vsnprintf
_vsnwprintf
RtlMultiByteToUnicodeN
RtlOemToUnicodeN
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlUnicodeToMultiByteN
RtlUnicodeToOemN
_wcslwr
wcschr
NtQueryInformationFile
NtFsControlFile
NtDeviceIoControlFile
NtQueryVolumeInformationFile
wcstoul
_wcstoui64
NtWriteFile
NtCreateFile
NtReadFile
RtlRaiseStatus
NtQuerySystemInformation
RtlSizeHeap
RtlFreeHeap
RtlFreeUnicodeString
NtOpenProcessToken
NtAdjustPrivilegesToken
NtShutdownSystem
NtQuerySystemTime
RtlValidRelativeSecurityDescriptor
RtlGetVersion
RtlTimeToTimeFields
VerSetConditionMask
RtlVerifyVersionInfo
NtDisplayString
NtSerializeBoot
swprintf_s
NtCreateEvent
NtClearEvent
NtSetThreadExecutionState
NtWaitForMultipleObjects
NtCancelIoFile
RtlQueryRegistryValuesEx
RtlRandomEx
NtQueryPerformanceCounter
isprint
NtOpenKey
NtQueryValueKey
RtlPrefixUnicodeString
qsort
RtlDeleteSecurityObject
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlLengthSid
RtlCopySid
RtlAddAce
RtlCreateAcl
RtlQueryInformationAcl
RtlCreateSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlNewSecurityObject
RtlValidSecurityDescriptor
RtlLengthSecurityDescriptor
RtlAddAccessAllowedAce
RtlInitializeGenericTable
RtlInsertElementGenericTable
RtlInitializeBitMap
RtlSetBits
RtlLookupElementGenericTable
RtlClearBits
RtlFindSetBits
RtlDeleteElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlNumberOfSetBits
RtlInitializeGenericTableAvl
RtlEnumerateGenericTableAvl
RtlLookupFirstMatchingElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableFullAvl
RtlInsertElementGenericTableFullAvl
RtlDeleteElementGenericTableAvlEx
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlWriteRegistryValue
RtlGetPersistedStateLocation
wcscpy_s
wcscat_s
RtlTimeFieldsToTime
RtlSystemTimeToLocalTime
RtlFindMessage
RtlUTF8ToUnicodeN
wcsncmp
RtlInitUTF8StringEx
RtlInitAnsiStringEx
RtlUTF8StringToUnicodeString
RtlAnsiStringToUnicodeString
RtlFormatMessage
RtlNumberGenericTableElementsAvl
RtlComputeCrc32
DbgPrint
RtlCrc64
RtlUpcaseUnicodeString
EtwEventUnregister
EtwEventRegister
EtwEventSetInformation
EtwEventWriteTransfer
DbgPrintEx
NtFlushBuffersFile
NtQueryAttributesFile
RtlLocalTimeToSystemTime
RtlUnwind
_alldiv
_alldvrm
_allmul
_allrem
_allshl
_aulldiv
_aulldvrm
_aullrem
_chkstk
memcmp
memcpy
memset
Sections
.text Size: 552KB - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 321KB - Virtual size: 321KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ