Static task
static1
Behavioral task
behavioral1
Sample
dc2423e21752f431ce3ad010ce41f56914e414f5a88fd3169e78d4cc08082f7b.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
dc2423e21752f431ce3ad010ce41f56914e414f5a88fd3169e78d4cc08082f7b.exe
Resource
win10v2004-20230703-en
General
-
Target
1.7z
-
Size
457KB
-
MD5
69c6ad6d4409f366bcfaf207cfaf2460
-
SHA1
5256d37d6431223aeda84227f1bb09dcd82f0de9
-
SHA256
1b9d58137315a59d74523ff40a375faff2377de6f3aa905137c843ca900dd87a
-
SHA512
425eaa5a64a6b11f8fa37213828911ad2d5b2cbf181e3023db58ce5b04f70edf52830ea939eb7c880e9cccebf01d04d501da4e817cb52b0880605c834671fa45
-
SSDEEP
6144:AxsxZv8KKXF0ZGzi8iZAlD2zh16AoCqy7AyW7oZdgwgRqY7s17AYLfXHYI86U+gF:+sxSDzi9gD2z5AyO6gMHAYLfXaMM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/dc2423e21752f431ce3ad010ce41f56914e414f5a88fd3169e78d4cc08082f7b
Files
-
1.7z.7z
Password: infected
-
dc2423e21752f431ce3ad010ce41f56914e414f5a88fd3169e78d4cc08082f7b.exe windows x86
Password: infected
749a7bb1f0b4c4455949c0b2bf7f9e9f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
GetCurrentProcess
SetEndOfFile
WriteConsoleW
CreateFileW
HeapSize
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetConsoleCP
HeapReAlloc
GetVersionExW
VirtualAlloc
VirtualFree
lstrcmpW
lstrcpyW
lstrcatW
DecodePointer
lstrlenW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetStdHandle
GetFileType
WriteFile
GetProcAddress
MultiByteToWideChar
DeleteFiber
WideCharToMultiByte
ConvertFiberToThread
GetTickCount
GlobalMemoryStatus
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
SetConsoleCtrlHandler
ReadFile
CompareStringW
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
CloseHandle
user32
GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
wsprintfW
advapi32
CryptGenRandom
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
RegSetKeySecurity
RegEnumValueW
RegCreateKeyExW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
SetThreadToken
OpenProcessToken
AddAccessAllowedAceEx
AdjustTokenPrivileges
AllocateAndInitializeSid
DuplicateTokenEx
GetLengthSid
InitializeAcl
InitializeSecurityDescriptor
PrivilegeCheck
RevertToSelf
SetSecurityDescriptorDacl
LookupPrivilegeValueW
RegCloseKey
RegEnumKeyExW
RegLoadKeyW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegUnLoadKeyW
RegGetValueW
ws2_32
WSASetLastError
send
closesocket
recv
WSAGetLastError
WSACleanup
crypt32
CertDuplicateCertificateContext
CertFindCertificateInStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty
Sections
.text Size: 721KB - Virtual size: 721KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 299KB - Virtual size: 299KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ