Static task
static1
Behavioral task
behavioral1
Sample
1f514a573bcd89exeexeexeex.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
1f514a573bcd89exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
1f514a573bcd89exeexeexeex.exe
-
Size
179KB
-
MD5
1f514a573bcd8925ad519fb85f876f87
-
SHA1
ad3c86b2d76141f9195c31f77f5a7dcaa0cd20df
-
SHA256
af1815b5f27fe3948e4969e0ef8ded58cee63a9ef3421ea320122c93e60e3b69
-
SHA512
eea7f03fe5da49b9b1083cffbdeebb45f9a145deae7e9c9e5ba33376cb2b510773c0a77ea037a676e7bfe13164e135627d937840944bf0b33a186b719a43af03
-
SSDEEP
3072:4BSF3kHSHUN4yTGnBDhVj3AyxulLGGwmyK0z2FWqnSGhloPv2:8SF3kHScNTeBDh93AHQJmyKHWDSl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f514a573bcd89exeexeexeex.exe
Files
-
1f514a573bcd89exeexeexeex.exe.exe windows x86
9a8e99aef6e95745bc22ffa8d40cfbbb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CryptBinaryToStringA
CryptStringToBinaryA
CryptDecodeObjectEx
shlwapi
StrStrIW
PathSkipRootW
StrPBrkA
StrCpyNW
PathFindFileNameW
StrStrA
PathMatchSpecW
StrCmpNA
StrSpnA
StrToInt64ExA
PathCombineW
StrToIntA
StrCmpNIW
StrChrA
StrCmpNIA
PathFindFileNameA
StrChrW
StrCmpNW
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
ws2_32
htons
inet_addr
htonl
shutdown
closesocket
gethostbyname
sendto
inet_ntoa
socket
WSAStartup
kernel32
ExitProcess
RtlUnwind
LocalFree
lstrcmpiA
GetCommandLineW
CreateMutexW
SetErrorMode
GetCurrentProcess
GetProcAddress
GetCurrentThread
WaitForMultipleObjects
TerminateProcess
GetModuleFileNameW
GetCurrentThreadId
SetThreadPriority
GetTempPathW
GetLastError
OutputDebugStringA
SetProcessShutdownParameters
IsBadStringPtrA
SetFilePointer
FlushFileBuffers
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
IsBadWritePtr
IsBadReadPtr
IsBadStringPtrW
lstrcpyA
PeekNamedPipe
SystemTimeToFileTime
MoveFileExW
SetFileTime
lstrlenW
CreateFileW
CreateProcessA
GetSystemDirectoryA
GetLocalTime
CreatePipe
GetTickCount
ReadFile
FileTimeToSystemTime
OpenEventW
GetFileAttributesW
GetModuleHandleW
TlsAlloc
CreateThread
lstrcpyW
MulDiv
FileTimeToLocalFileTime
DeleteCriticalSection
GetFileTime
VirtualProtect
GetFileSizeEx
CreateEventW
EnterCriticalSection
MoveFileW
lstrlenA
SearchPathW
GetTempFileNameW
FindFirstFileW
GetNativeSystemInfo
GetDriveTypeW
GetLogicalDrives
VirtualFree
FindClose
QueryDosDeviceW
GetTimeFormatW
lstrcmpiW
lstrcatW
FindNextFileW
SetFileAttributesW
HeapReAlloc
HeapAlloc
HeapFree
HeapCreate
HeapValidate
SetLastError
GetProcessHeaps
HeapSetInformation
GetCurrentProcessId
CreateDirectoryW
GetComputerNameA
LeaveCriticalSection
Sleep
InitializeCriticalSection
WriteFile
VirtualAlloc
OutputDebugStringW
SetEvent
lstrcpynW
WaitForSingleObject
lstrcpynA
OpenProcess
SetFilePointerEx
MultiByteToWideChar
GetVersionExW
GetFileSize
WideCharToMultiByte
GetDateFormatW
GetHandleInformation
CloseHandle
CreateToolhelp32Snapshot
GetModuleHandleA
Process32NextW
GetSystemInfo
Process32FirstW
user32
wsprintfW
GetForegroundWindow
RegisterClassExW
UnregisterClassW
DispatchMessageW
DefWindowProcW
RegisterClassW
FillRect
DrawTextA
GetDC
CreateWindowExW
SystemParametersInfoW
PeekMessageW
GetKeyboardLayoutList
GetSystemMetrics
CharLowerBuffA
TranslateMessage
wsprintfA
ReleaseDC
advapi32
CryptAcquireContextW
CryptGetKeyParam
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryValueExW
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
CryptGenRandom
CryptReleaseContext
AdjustTokenPrivileges
FreeSid
AllocateAndInitializeSid
LookupPrivilegeValueW
RegOpenKeyW
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegCloseKey
CryptDestroyKey
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize
shell32
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
SHChangeNotify
gdi32
SetTextColor
DeleteDC
GetDeviceCaps
GetDIBits
SetBkColor
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
GetObjectW
GetStockObject
ntdll
_alldiv
memcpy
isspace
_allmul
RtlDosPathNameToNtPathName_U
NtDeleteFile
RtlFreeUnicodeString
ZwQuerySystemInformation
tolower
memmove
ZwOpenProcess
memset
_aulldvrm
NtQueryVirtualMemory
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 105KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ