Static task
static1
Behavioral task
behavioral1
Sample
Conferma Pagamento.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Conferma Pagamento.exe
Resource
win10v2004-20230220-en
General
-
Target
Conferma Pagamento.exe
-
Size
1.2MB
-
MD5
54803df779b6d86533a513c71fdbd82d
-
SHA1
844ee84c605cac35a2e661d811d1a4584c032c6b
-
SHA256
717c6d49e4df554a386191492a5b0096dc3d07000de5ed58d2862872ef3b83cc
-
SHA512
f411275f85db90dfa6a30b284d56965ff2c3d8ce845032cdb316164e9587be9e35c6ec06e025d2c8d9668593bcac84c73546a8d3b90646d9746399e401a1a312
-
SSDEEP
24576:fz9+2tE1IOF2V3sAYAph0S/naTzxafWxQn652FpOa/m:YiEOtAaLhLm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Conferma Pagamento.exe
Files
-
Conferma Pagamento.exe.exe windows x86
60b3de40b460773ece0a368ca6d61d4a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
kernel32
HeapFree
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
GetProcessHeap
HeapAlloc
HeapReAlloc
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetLastError
SwitchToThread
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
WakeConditionVariable
WakeAllConditionVariable
WaitForSingleObject
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
GetCurrentThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
WriteConsoleW
SetLastError
GetEnvironmentVariableW
CreateFileW
GetFullPathNameW
GetModuleHandleW
FormatMessageW
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcess
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
SleepEx
ReadFileEx
WriteFileEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
SetHandleInformation
PostQueuedCompletionStatus
SetFilePointerEx
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
DecodePointer
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
FindClose
ntdll
NtDeviceIoControlFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtCreateFile
ws2_32
bind
getpeername
WSAGetLastError
getsockname
shutdown
WSASend
send
recv
WSACleanup
WSAStartup
freeaddrinfo
getaddrinfo
getsockopt
connect
WSASocketW
WSAIoctl
ioctlsocket
setsockopt
closesocket
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptGenRandom
Sections
.text Size: 868KB - Virtual size: 868KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 289KB - Virtual size: 289KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ