Static task
static1
Behavioral task
behavioral1
Sample
__ExtractWizard.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
__ExtractWizard.exe
Resource
win10v2004-20230703-en
General
-
Target
__ExtractWizard.exe
-
Size
100KB
-
MD5
040d5535f82c71420ccd9efcab28db67
-
SHA1
169007b38c8a9cfe4b67feb1d4bf953c679ff86d
-
SHA256
6bf976d7a8f84effeef0f213a7b229e7c474ba0db77c7c249450f59b6d19701c
-
SHA512
97310f20b40f8a5f65adf962f00aa71e21c80387938f880e36458665878f713227434b562141ebbf5f3a4c4004a83981514b95426436975fe3c3933d2f9fda49
-
SSDEEP
1536:0lArjllf3nNB5e7B3T13vrnD28lp//+0PE4tPYn:WArzYJvlphPE4tPYn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource __ExtractWizard.exe
Files
-
__ExtractWizard.exe.exe windows x86
ffdebeadeffd162f49a9d20ba734d102
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
PropertySheetA
kernel32
GetConsoleOutputCP
WriteConsoleA
HeapSize
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
WriteConsoleW
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
CompareStringW
CompareStringA
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSection
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetDiskFreeSpaceA
CreateFileA
CloseHandle
ReadFile
LoadLibraryA
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
MultiByteToWideChar
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
SetEnvironmentVariableA
WideCharToMultiByte
GetLastError
SetEnvironmentVariableW
ExitProcess
Sleep
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
SetEndOfFile
user32
SetWindowLongA
GetDesktopWindow
GetWindowTextA
SetWindowTextA
PostMessageA
CheckRadioButton
IsDlgButtonChecked
SendMessageA
MoveWindow
GetWindow
GetDlgItem
GetParent
GetWindowRect
SetWindowPos
UpdateWindow
CallWindowProcA
RemovePropA
BeginPaint
FillRect
LoadBitmapA
GetClientRect
EndPaint
GetPropA
GetWindowLongA
SetPropA
gdi32
GetStockObject
CreateFontIndirectA
SelectObject
SetTextColor
TextOutA
DeleteObject
CreateCompatibleDC
GetObjectA
BitBlt
DeleteDC
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
ole32
CoInitialize
CoUninitialize
Sections
.text Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ