Static task
static1
Behavioral task
behavioral1
Sample
e8506f3be03c33b38a0a86bd6f845f3d9788429b5faa2d981aedcadd42995f5d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e8506f3be03c33b38a0a86bd6f845f3d9788429b5faa2d981aedcadd42995f5d.exe
Resource
win10v2004-20230220-en
General
-
Target
e8506f3be03c33b38a0a86bd6f845f3d9788429b5faa2d981aedcadd42995f5d
-
Size
1.7MB
-
MD5
1138332a860dbc5091d0ec169ba59bfa
-
SHA1
c97212524c9e77c473f8008ef6507a480c112d16
-
SHA256
e8506f3be03c33b38a0a86bd6f845f3d9788429b5faa2d981aedcadd42995f5d
-
SHA512
4f6c9d5ddff3708cc99828163cc0b2667022f231082f8beccc8b37f24bb6fdd80b53e1d33493e04a69312a012f7edc35e11aeac4ca896b87fc6acc91e16feea4
-
SSDEEP
24576:PfDyvSzIiMWg2AMq0GskX7rjC/2umJw+oQoNK3Ovd6PWHG/bXt9DtlTVib:lGskXigwTNp6WHwzt9DDi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e8506f3be03c33b38a0a86bd6f845f3d9788429b5faa2d981aedcadd42995f5d
Files
-
e8506f3be03c33b38a0a86bd6f845f3d9788429b5faa2d981aedcadd42995f5d.exe windows x86
0b5807d52810b19e957f172d13914630
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEvent
WaitForMultipleObjects
CreateEventW
GetCurrentProcessId
GetFileSizeEx
GetLocalTime
ReleaseMutex
CreateMutexW
WideCharToMultiByte
CreateProcessA
CreateProcessW
GetCommandLineW
InterlockedExchange
VirtualProtect
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
GetEnvironmentVariableW
SetEnvironmentVariableW
IsBadReadPtr
GetFileSize
ReadFile
SetFilePointer
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
IsBadStringPtrW
WinExec
InterlockedIncrement
FindResourceExW
FindResourceW
OutputDebugStringW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
GetTickCount
GetFileTime
SizeofResource
LoadResource
WaitForSingleObject
GetExitCodeProcess
GetProcAddress
LockResource
RegisterWaitForSingleObject
CloseHandle
DeleteCriticalSection
WriteConsoleW
SetStdHandle
WaitForSingleObjectEx
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
SetConsoleCtrlHandler
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
EnumSystemLocalesW
InitializeCriticalSectionAndSpinCount
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileType
GetCurrentThread
GetACP
GetStdHandle
GetModuleFileNameA
ExitProcess
GetFullPathNameA
EnterCriticalSection
GetDriveTypeW
GetFileAttributesExW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
RtlUnwind
FindNextFileW
FindFirstFileW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
DosDateTimeToFileTime
FileTimeToDosDateTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
SetFileTime
SetEndOfFile
FlushFileBuffers
WriteFile
FormatMessageA
TryEnterCriticalSection
WritePrivateProfileStringW
GetPrivateProfileIntW
InitializeCriticalSection
SetLastError
GetCurrentThreadId
OutputDebugStringA
FreeLibrary
MultiByteToWideChar
MoveFileExW
MoveFileW
CopyFileW
DeleteFileW
SetFileAttributesW
CreateFileW
GetTempFileNameW
GetLastError
RaiseException
OpenProcess
GetProcessHeap
HeapSize
HeapFree
InterlockedDecrement
VirtualQuery
Thread32Next
Thread32First
CreateToolhelp32Snapshot
SetThreadContext
GetThreadContext
ResumeThread
SuspendThread
OpenThread
HeapCreate
GetVersionExW
GetSystemWindowsDirectoryW
FreeResource
Sleep
InterlockedCompareExchange
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
DeviceIoControl
LoadLibraryExW
InterlockedExchangeAdd
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
EncodePointer
FormatMessageW
LeaveCriticalSection
GetFullPathNameW
ResetEvent
GetTempPathW
HeapReAlloc
HeapAlloc
HeapDestroy
GetUserDefaultLCID
DecodePointer
user32
GetClassInfoExW
CreateWindowExW
IsWindow
CallWindowProcW
DefWindowProcW
PostMessageW
SendMessageTimeoutW
SendMessageW
GetWindowThreadProcessId
UnregisterClassW
RegisterClassExW
RegisterWindowMessageW
DestroyWindow
GetAncestor
GetMonitorInfoW
MonitorFromRect
SetWindowPlacement
GetWindowPlacement
LoadStringW
GetKeyState
DeregisterShellHookWindow
RegisterShellHookWindow
IsRectEmpty
MessageBoxW
AdjustWindowRectEx
GetForegroundWindow
UpdateWindow
SetMenu
LoadIconW
SetClassLongW
PtInRect
FrameRect
WindowFromPoint
ClientToScreen
GetCursorPos
SetCursor
GetWindowRect
GetClientRect
EndPaint
BeginPaint
ReleaseDC
GetDC
GetSystemMetrics
ReleaseCapture
SetCapture
GetCapture
SetFocus
UpdateLayeredWindow
GetDoubleClickTime
ReplyMessage
GetMessageTime
GetMessagePos
TrackMouseEvent
ScreenToClient
RegisterClipboardFormatW
IsDialogMessageW
TranslateAcceleratorW
LoadAcceleratorsW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
SetParent
IsWindowVisible
SetWindowPos
ShowWindow
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
LoadCursorW
FindWindowW
SetWindowLongW
GetWindowLongW
UnregisterClassA
SetWindowTextW
KillTimer
SetTimer
gdi32
GetStockObject
GetDeviceCaps
CreateSolidBrush
SwapBuffers
CreateDIBSection
SetPixelFormat
DeleteDC
CreateCompatibleDC
ChoosePixelFormat
SelectObject
GetTextExtentPoint32W
DeleteObject
advapi32
OpenProcessToken
CryptContextAddRef
CryptDecrypt
CryptEncrypt
CryptImportKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyW
RegCloseKey
CryptGenRandom
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegEnumValueW
GetTokenInformation
RegCreateKeyExW
RegEnumKeyExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
shell32
SHGetFolderPathW
DragFinish
SHGetSpecialFolderPathW
SHCreateDirectoryExW
ord165
ShellExecuteW
SHGetFolderPathA
DragQueryFileW
ShellExecuteExW
SHCreateDirectoryExA
ole32
ReleaseStgMedium
RevokeDragDrop
CoInitialize
CoUninitialize
StringFromGUID2
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
DoDragDrop
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
RegisterDragDrop
oleaut32
VariantInit
VariantClear
SysAllocString
SysFreeString
shlwapi
StrTrimW
PathFindFileNameA
PathFindExtensionW
PathIsDirectoryW
PathCompactPathW
PathCombineW
PathAppendW
SHGetValueW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
PathCanonicalizeW
StrCmpIW
StrStrIA
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
StrToIntExW
StrStrIW
PathFindExtensionA
opengl32
glTexSubImage2D
glVertex2f
glVertex2i
glViewport
wglCreateContext
wglDeleteContext
wglMakeCurrent
glTexImage2D
glTexEnvf
glBegin
glBindTexture
glBlendFunc
glClear
glClearColor
glColor3f
glColor4f
glDeleteTextures
glDisable
glDrawArrays
glEnable
glRotatef
glPushMatrix
glTexParameteri
glEnd
glGenTextures
glPopMatrix
glPopAttrib
glPixelStorei
glOrtho
glMatrixMode
glLoadIdentity
glLineWidth
glPushAttrib
glHint
glInterleavedArrays
psapi
EnumProcessModules
GetModuleFileNameExW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
libcef
cef_print_settings_create
cef_post_data_element_create
cef_write_json
cef_post_data_create
cef_response_create
cef_get_current_platform_thread_id
cef_v8stack_trace_get_current
cef_zip_reader_create
cef_string_list_copy
cef_request_create
cef_time_to_timet
cef_string_list_free
cef_string_utf16_cmp
cef_string_utf16_to_utf8
cef_string_utf8_to_utf16
cef_string_utf16_clear
cef_string_utf8_clear
cef_string_utf16_set
cef_string_multimap_free
cef_string_multimap_alloc
cef_task_runner_get_for_thread
cef_task_runner_get_for_current_thread
cef_dictionary_value_create
cef_list_value_create
cef_string_multimap_append
cef_string_multimap_value
cef_string_multimap_key
cef_string_userfree_utf16_free
cef_string_list_alloc
cef_visit_web_plugin_info
cef_refresh_web_plugins
cef_add_web_plugin_path
cef_add_web_plugin_directory
cef_remove_web_plugin_path
cef_unregister_internal_web_plugin
cef_force_web_plugin_shutdown
cef_register_web_plugin_crash
cef_is_web_plugin_unstable
cef_currently_on
cef_post_task
cef_post_delayed_task
cef_register_extension
cef_register_scheme_handler_factory
cef_clear_scheme_handler_factories
cef_execute_process
cef_initialize
cef_shutdown
cef_do_message_loop_work
cef_run_message_loop
cef_quit_message_loop
cef_set_osmodal_loop
cef_enable_highdpi_support
cef_get_geolocation
cef_add_cross_origin_whitelist_entry
cef_remove_cross_origin_whitelist_entry
cef_clear_cross_origin_whitelist
cef_parse_url
cef_create_url
cef_format_url_for_security_display
cef_get_mime_type
cef_get_extensions_for_mime_type
cef_base64encode
cef_base64decode
cef_string_multimap_size
cef_uridecode
cef_parse_csscolor
cef_parse_json
cef_parse_jsonand_return_error
cef_uriencode
cef_get_path
cef_launch_process
cef_begin_tracing
cef_end_tracing
cef_now_from_system_trace_time
cef_api_hash
cef_string_map_alloc
cef_string_map_free
cef_command_line_create
cef_command_line_get_global
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_log
cef_string_wide_to_utf8
cef_stream_reader_create_for_file
cef_stream_reader_create_for_data
cef_stream_reader_create_for_handler
cef_cookie_manager_get_global_manager
cef_cookie_manager_create_manager
cef_process_message_create
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_drag_data_create
cef_request_context_get_global_context
cef_request_context_create_context
create_context_shared
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8value_create_undefined
cef_v8value_create_null
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_uint
cef_v8value_create_double
cef_v8value_create_date
cef_v8value_create_string
cef_v8value_create_object
cef_v8value_create_array
cef_v8value_create_function
cef_binary_value_create
cef_value_create
cef_string_list_size
cef_string_list_value
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
crypt32
CryptBinaryToStringW
CryptBinaryToStringA
CryptStringToBinaryW
CertGetNameStringW
CryptStringToBinaryA
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
iphlpapi
GetAdaptersInfo
wininet
InternetGetConnectedState
urlmon
URLDownloadToCacheFileW
URLDownloadToFileW
Sections
.text Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 254KB - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 20KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 137KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE