Static task
static1
Behavioral task
behavioral1
Sample
34a22356d072f7ab2bf191c0283a4fd1d3f5f884cff751fa8540ef54eed76a9f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
34a22356d072f7ab2bf191c0283a4fd1d3f5f884cff751fa8540ef54eed76a9f.exe
Resource
win10v2004-20230221-en
General
-
Target
34a22356d072f7ab2bf191c0283a4fd1d3f5f884cff751fa8540ef54eed76a9f
-
Size
2.9MB
-
MD5
7a2649eaa6b57759b1f872517112b61c
-
SHA1
1c5de18deca63ae289426855a186322722625fab
-
SHA256
34a22356d072f7ab2bf191c0283a4fd1d3f5f884cff751fa8540ef54eed76a9f
-
SHA512
0e0c25a898dd06f99d06aaf1c697a6168d8d29d28fd6a962c64d7a29235970977fc15a2c9a825c04b4e94606658430ed11b240732858db34e6b136170360790d
-
SSDEEP
49152:J+8gSCYi3rfHsrA6lF7QfypdKMFP8zlhZNmuFb9TXQPyABKmHw8:dCYi36A66mdNwhZZbHMw8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 34a22356d072f7ab2bf191c0283a4fd1d3f5f884cff751fa8540ef54eed76a9f
Files
-
34a22356d072f7ab2bf191c0283a4fd1d3f5f884cff751fa8540ef54eed76a9f.exe windows x64
6c040a091fbd54a355c185e82b0f52bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
IsBadStringPtrW
MultiByteToWideChar
VirtualAllocEx
VirtualFreeEx
OpenProcess
CreateRemoteThread
WriteProcessMemory
SetEvent
ResetEvent
WaitForSingleObject
OpenMutexW
CreateEventW
LoadLibraryA
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
WriteFile
CreateFileW
GetModuleHandleExW
CreateMutexW
SizeofResource
GetCurrentProcessId
HeapAlloc
LocalFree
GetProcessHeap
CreateDirectoryW
GetWindowsDirectoryW
ReadFile
SetFilePointer
SetEndOfFile
Sleep
DeleteFileW
GetFileSize
GetTickCount
SetLastError
lstrlenW
LoadLibraryW
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
GetVersionExW
GetCurrentProcess
GetFileAttributesW
WriteConsoleW
SetStdHandle
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
LoadResource
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetProcAddress
FreeLibrary
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetErrorMode
GetLastError
RaiseException
DecodePointer
ReleaseMutex
GetFileAttributesExW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
SearchPathW
LockResource
GetSystemInfo
ResumeThread
OpenEventW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetACP
WideCharToMultiByte
GetVolumeInformationW
GetDiskFreeSpaceW
GetDriveTypeW
FindFirstFileW
GetLongPathNameW
GetShortPathNameW
RtlUnwind
TryEnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindClose
LocalFileTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
HeapFree
GetComputerNameExW
GlobalAlloc
GlobalFree
SetFileTime
GetFileTime
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
GetSystemDirectoryW
SetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileExW
CopyFileW
GetTempFileNameW
MoveFileW
DeviceIoControl
lstrcatW
lstrcpyW
GetFileSizeEx
CreateProcessW
GetExitCodeProcess
FormatMessageW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetLocalTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
VirtualQueryEx
CreateThread
GetProcessId
OpenThread
TerminateThread
GetThreadContext
SuspendThread
ReleaseSemaphore
CreateSemaphoreW
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetStdHandle
GetFileType
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameA
SetConsoleCtrlHandler
GetCurrentThread
HeapSize
HeapReAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetDateFormatW
user32
UnregisterClassW
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetMessageW
CharNextW
PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
advapi32
SetSecurityDescriptorDacl
ReportEventW
RegisterEventSourceW
DeregisterEventSource
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
shell32
SHGetFolderPathW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
oleaut32
VarUI4FromStr
SysFreeString
shlwapi
PathFileExistsW
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 621KB - Virtual size: 620KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 110KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ