Static task
static1
Behavioral task
behavioral1
Sample
313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e.exe
Resource
win10v2004-20230703-en
General
-
Target
313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e
-
Size
2.7MB
-
MD5
4b5dac206f46ed2c79d80888170be06f
-
SHA1
8a85156e7b3b824bf4d9531cac516456d6585b6e
-
SHA256
313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e
-
SHA512
18b8fa9dd93c3583ce7dc31c3b7c77730a2af49e97812de345e1f76fc30d729da0ff12b136589fe16af36cb4857e45838af42e47e2018fb563df07e5df3d03ca
-
SSDEEP
49152:cWUePgPrD2jYvPJfnd6JeIKJWM2N4Fwu8M8kFNeQ4NM4Thrqp/tWnmbRpXDfyf2P:eePgPrD2jYvPRnd6JGo4KuykFNkNMnNt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e
Files
-
313e9ce71134d85fbe9909b8cb14dfd9225e1256ab098cabc5a3ceb81bb9495e.exe windows x86
96e174fe8b84c2669521d889cb848ef3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentThreadId
TerminateThread
LocalFree
GetModuleHandleA
LocalAlloc
GlobalUnlock
GetStartupInfoW
GetTimeZoneInformation
GetModuleFileNameW
ReadFile
GetVersionExW
LoadLibraryW
GlobalAlloc
WriteFile
OutputDebugStringW
WaitForSingleObject
GlobalLock
CreateDirectoryW
InterlockedDecrement
SetFilePointer
GetFileSize
GetWindowsDirectoryW
GetProcAddress
TerminateProcess
GetCurrentProcess
MultiByteToWideChar
ResumeThread
GetLastError
CreateSemaphoreA
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetSystemTimeAsFileTime
GetFileSizeEx
CreateFileW
lstrcpyW
GetModuleHandleW
QueryFullProcessImageNameW
OpenProcess
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetEnvironmentVariableW
CreateProcessW
GetFileAttributesExW
GetPrivateProfileIntW
FindNextFileW
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
SetEndOfFile
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
GetLocalTime
Sleep
RemoveDirectoryW
WideCharToMultiByte
FindClose
FindFirstFileW
WritePrivateProfileStringW
CopyFileW
LockResource
SizeofResource
FreeResource
LoadResource
FindResourceW
DeleteFileW
GetFileAttributesW
GetTickCount
GetCurrentDirectoryA
GetFullPathNameA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
SetStdHandle
GetConsoleCP
LCMapStringA
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetCPInfo
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetConsoleMode
SetConsoleMode
ReadConsoleInputA
CreateFileA
InterlockedExchange
GetFileInformationByHandle
SetConsoleCtrlHandler
ExitProcess
GetDriveTypeA
HeapReAlloc
RtlUnwind
RaiseException
CreateThread
ExitThread
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FlushConsoleInputBuffer
FindFirstFileA
GlobalMemoryStatus
GetCurrentProcessId
QueryPerformanceCounter
LoadLibraryA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
ExpandEnvironmentStringsA
FreeLibrary
WaitForMultipleObjects
PeekNamedPipe
SleepEx
GetStdHandle
GetFileType
GetVersion
FormatMessageA
SetLastError
InterlockedIncrement
SetFileTime
SystemTimeToFileTime
MulDiv
GetPrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
GlobalMemoryStatusEx
GetSystemInfo
GetComputerNameW
DeleteCriticalSection
InitializeCriticalSection
HeapFree
GetProcessHeap
GetCurrentDirectoryW
GetACP
user32
GetMonitorInfoW
IsWindow
MonitorFromWindow
wsprintfW
SetWindowRgn
GetWindowRect
IsIconic
TrackPopupMenu
AppendMenuW
CreatePopupMenu
GetCursorPos
BringWindowToTop
SetForegroundWindow
DestroyIcon
MessageBoxA
GetProcessWindowStation
GetUserObjectInformationW
GetWindowTextW
SetWindowTextW
GetWindowTextLengthW
MoveWindow
GetGUIThreadInfo
CreateAcceleratorTableW
InvalidateRgn
SetRect
CharPrevW
DrawTextW
FillRect
GetCaretBlinkTime
GetSysColor
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
LoadIconW
RegisterWindowMessageW
SetWindowPos
FindWindowW
ShowWindow
GetClientRect
ScreenToClient
CreateCaret
SetCursor
wvsprintfW
OffsetRect
CharNextW
ReleaseCapture
SetCapture
InvalidateRect
UnionRect
SetWindowLongW
GetWindowLongW
PostMessageW
DefWindowProcW
CreateWindowExW
PostQuitMessage
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
EnableWindow
GetWindow
GetParent
SendMessageW
LoadImageW
GetSystemMetrics
RegisterClassW
LoadCursorW
RegisterClassExW
GetClassInfoExW
CallWindowProcW
GetPropW
SetPropW
ReleaseDC
DestroyWindow
GetDC
KillTimer
SetTimer
GetKeyState
GetFocus
MapWindowPoints
PtInRect
IntersectRect
IsWindowVisible
GetUpdateRect
IsRectEmpty
EndPaint
BeginPaint
GetActiveWindow
gdi32
SetWindowOrgEx
CreatePen
SelectObject
SaveDC
BitBlt
RestoreDC
DeleteDC
GetStockObject
Rectangle
CreatePatternBrush
GdiFlush
GetObjectW
DeleteObject
CreateRoundRectRgn
CreateCompatibleBitmap
CreateCompatibleDC
GetTextMetricsW
GetObjectA
GetDeviceCaps
SelectClipRgn
CombineRgn
CreateRectRgnIndirect
GetClipBox
CreateDIBSection
StretchBlt
SetStretchBltMode
CreateSolidBrush
LineTo
MoveToEx
CreatePenIndirect
RoundRect
SetTextColor
SetBkMode
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
ExtSelectClipRgn
CreateFontIndirectW
advapi32
ReportEventA
DeregisterEventSource
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegisterEventSourceA
shell32
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ShellExecuteW
SHGetKnownFolderPath
ole32
CoInitialize
OleInitialize
CoUninitialize
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleLockRunning
CreateStreamOnHGlobal
OleUninitialize
CoTaskMemFree
oleaut32
VariantInit
SysFreeString
VariantClear
SysAllocString
iphlpapi
GetAdaptersAddresses
crypt32
CryptMsgGetParam
CertCloseStore
CertFindCertificateInStore
CryptMsgClose
CryptQueryObject
CertFreeCertificateContext
CertGetNameStringW
shlwapi
PathIsDirectoryW
gdiplus
GdipCloneImage
GdipSetInterpolationMode
GdipDisposeImage
GdipAlloc
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipFree
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipGetImageWidth
GdipGetImageHeight
GdipDrawImageRect
GdipDrawLine
GdipFillRectangleI
GdipCreatePen2
GdipSetSolidFillColor
GdipSetPenStartCap
GdipSetPenEndCap
GdiplusStartup
GdiplusShutdown
GdipDeletePath
GdipDeleteRegion
GdipDeleteBrush
GdipFillRegion
GdipSetPathGradientFocusScales
GdipSetPathGradientCenterColor
GdipCombineRegionRegion
GdipCreateRegionPath
GdipCreateRegionRect
GdipAddPathLineI
GdipAddPathArcI
GdipCreatePath
GdipSetPageUnit
GdipCreateFromHDC
GdipCloneBrush
GdipCreatePathGradientFromPath
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipDeleteFont
GdipDeleteStringFormat
GdipDeleteFontFamily
GdipDrawImage
GdipGraphicsClear
GdipDrawString
GdipSetPixelOffsetMode
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipCreateLineBrushI
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipGetFamily
GdipCreateSolidFill
GdipDrawImageI
GdipDeletePen
ws2_32
bind
getservbyname
gethostbyname
WSACleanup
WSAStartup
gethostname
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
recv
send
WSAIoctl
setsockopt
getsockname
ntohs
htons
getsockopt
getpeername
closesocket
socket
connect
freeaddrinfo
getaddrinfo
sendto
recvfrom
accept
listen
ioctlsocket
shutdown
htonl
wldap32
ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
comctl32
_TrackMouseEvent
ord17
imm32
ImmSetCompositionWindow
ImmGetContext
ImmReleaseContext
ImmSetCompositionFontW
Sections
.text Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 444KB - Virtual size: 443KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 45KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 17B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 189KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ