Static task
static1
Behavioral task
behavioral1
Sample
9b21a288a3f34cexeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
9b21a288a3f34cexeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
9b21a288a3f34cexeexeexeex.exe
-
Size
664KB
-
MD5
9b21a288a3f34c3931a365e4a45b1643
-
SHA1
26b463eaa3ee141161245057ae9722900aaed564
-
SHA256
76f6079534dde2c41ba96c502b1e4f299ccad170429ce29788315d4523442839
-
SHA512
c153459e807c243a37947d14cdf5e6b6a917672c71c165cc11418d651987d5666fcae0b0e5327eb0ff3f98bfd7a024a90f8814d4b747d97db7655d2314ac1881
-
SSDEEP
12288:OeDxaDoNaYAn+zYwv10nOcR5vd1YkCBNiNkqkuRXZiliFrW/IsC7V7+mybr:OeDxJHN0njnvd1YPBkhRXZYorWbaIZbr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b21a288a3f34cexeexeexeex.exe
Files
-
9b21a288a3f34cexeexeexeex.exe.exe windows x86
be6dc019be2bf09e8f5049f8f22ef675
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
GetVersionExW
GetTickCount
Sleep
GetSystemDirectoryW
DeleteFileW
GetTempPathW
SetLastError
GlobalHandle
GlobalFree
GlobalAlloc
LockResource
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
GlobalUnlock
GlobalLock
MulDiv
lstrcmpW
InitializeCriticalSectionAndSpinCount
lstrlenA
ExitProcess
SetEvent
CreateEventW
CreateThread
CloseHandle
WaitForSingleObject
GetCommandLineW
LocalFree
lstrcpyW
FreeResource
CreateDirectoryW
GetProcessId
RemoveDirectoryW
TerminateProcess
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ReadFile
GetPrivateProfileIntW
WriteFile
MoveFileW
WritePrivateProfileStringW
GetPrivateProfileStringW
LoadLibraryW
FindFirstFileW
FindClose
SetEnvironmentVariableA
CompareStringW
SetEndOfFile
CreateFileA
WriteConsoleW
GetCurrentThreadId
SetStdHandle
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
GetFileType
SetHandleCount
FatalAppExitA
FlushFileBuffers
IsValidCodePage
GetOEMCP
GetACP
GetLocaleInfoW
GetTimeZoneInformation
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapReAlloc
GetConsoleMode
GetConsoleCP
HeapDestroy
HeapCreate
GetStdHandle
HeapSize
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
GetCPInfo
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetDateFormatA
GetTimeFormatA
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
GetStringTypeW
InterlockedExchange
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
WideCharToMultiByte
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
RaiseException
lstrcmpiW
GetModuleHandleW
GetProcAddress
lstrlenW
FreeLibrary
GetLastError
CreateFileW
GetProcessAffinityMask
user32
CharNextW
LoadIconW
GetClientRect
ScreenToClient
PtInRect
GetForegroundWindow
IsWindow
UnregisterClassA
SendMessageW
KillTimer
MessageBoxW
InvalidateRect
SetActiveWindow
GetDlgItem
ReleaseDC
GetDesktopWindow
GetWindowThreadProcessId
GetDC
wsprintfW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
ShowWindow
DestroyWindow
MoveWindow
SetWindowPos
SetWindowLongW
GetWindowLongW
DialogBoxIndirectParamW
RegisterClassExW
LoadCursorW
DefWindowProcW
GetFocus
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
PostThreadMessageW
SendDlgItemMessageW
MapDialogRect
SetWindowContextHelpId
EndDialog
RegisterWindowMessageW
BeginPaint
EndPaint
IsChild
CallWindowProcW
SetFocus
GetWindow
GetClassNameW
GetSysColor
RedrawWindow
GetClassInfoExW
CreateWindowExW
CreateAcceleratorTableW
ClientToScreen
GetParent
SetCapture
ReleaseCapture
FillRect
InvalidateRgn
DestroyAcceleratorTable
gdi32
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontW
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps
SelectObject
advapi32
RegSetValueExW
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
shell32
CommandLineToArgvW
Shell_NotifyIconW
ole32
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
OleUninitialize
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoInitialize
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoReleaseServerProcess
CoAddRefServerProcess
oleaut32
VariantChangeType
SetErrorInfo
GetErrorInfo
CreateErrorInfo
UnRegisterTypeLi
RegisterTypeLi
DispCallFunc
SysAllocStringLen
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringLen
VariantInit
SysFreeString
SysAllocString
SafeArrayCreateVector
VariantClear
VariantCopy
VarUI4FromStr
secur32
GetUserNameExW
winhttp
WinHttpReceiveResponse
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpSetStatusCallback
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpGetProxyForUrl
WinHttpSetOption
WinHttpOpen
WinHttpCloseHandle
Sections
.text Size: 381KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ