Static task
static1
Behavioral task
behavioral1
Sample
544fad643cf77a75d9c1b1cf78de63394bbe5fd11205901c05b2dff3dd9e30d1.exe
Resource
win7-20230712-en
General
-
Target
544fad643cf77a75d9c1b1cf78de63394bbe5fd11205901c05b2dff3dd9e30d1
-
Size
5.0MB
-
MD5
4d21665c9c18291b58b8e0e4d4bc5bb0
-
SHA1
685d6f8d5559ac81a4f8230530f23342c34ec318
-
SHA256
544fad643cf77a75d9c1b1cf78de63394bbe5fd11205901c05b2dff3dd9e30d1
-
SHA512
7935ed692491634db5f4f8eb2e53403e44b7bddea92fb2afa9b6ba898af99939f20a0467a2db3238fb49a1571b201bff1080bd77adba99b1d519f0c8ebdb0836
-
SSDEEP
98304:Um7zynZHB0veuOUUx6B6i5ob02zi31fLO2WbJUSGDqb0zR:UmMhY3OUNDMbJUrdz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 544fad643cf77a75d9c1b1cf78de63394bbe5fd11205901c05b2dff3dd9e30d1
Files
-
544fad643cf77a75d9c1b1cf78de63394bbe5fd11205901c05b2dff3dd9e30d1.exe windows x64
9c44fe76a0ec044c6f59ae2f0b46bf25
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
GetGeoInfoW
GetUserGeoID
VerSetConditionMask
GetEnvironmentVariableW
GetCurrentProcess
GetCurrentProcessId
OpenProcess
GetVersionExW
FreeLibrary
GetModuleFileNameW
LoadLibraryW
VerifyVersionInfoW
GetLocaleInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ExpandEnvironmentStringsW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetLongPathNameW
ReadFile
SetFilePointer
WriteFile
GetTempPathW
CopyFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
UnregisterWaitEx
RegisterWaitForSingleObject
CancelIo
SleepEx
QueueUserAPC
lstrlenW
ReadDirectoryChangesW
SetLastError
LoadLibraryA
LCMapStringW
GetUserDefaultLCID
OutputDebugStringW
GetCurrentThread
GetPackagesByPackageFamily
OpenPackageInfoByFullName
ClosePackageInfo
GetPackageInfo
GetVolumeInformationW
GetSystemDirectoryW
GetComputerNameW
GetFileAttributesW
GetFileSizeEx
CreateThread
GetFileSize
ReleaseMutex
CreateMutexA
CompareStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnlockFileEx
GetModuleHandleA
LocalAlloc
QueryFullProcessImageNameW
InitializeCriticalSection
TryEnterCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
MultiByteToWideChar
IsDebuggerPresent
RaiseException
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetStringTypeW
EncodePointer
LCMapStringEx
GetCPInfo
GetSystemTimeAsFileTime
ReleaseSemaphore
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
ResumeThread
TlsFree
GetSystemInfo
CreateWaitableTimerA
InitializeCriticalSectionAndSpinCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetACP
GetFileType
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
SetEnvironmentVariableA
IsValidCodePage
GetOEMCP
SetConsoleCtrlHandler
GetCommandLineA
GetCommandLineW
OutputDebugStringA
SetStdHandle
WriteConsoleW
SetEndOfFile
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFullPathNameW
SwitchToFiber
DeleteFiber
CreateFiber
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
GetSystemDirectoryA
ConvertFiberToThread
ConvertThreadToFiber
SetConsoleMode
ReadConsoleA
MapViewOfFile
CreateFileMappingW
GetSystemTime
LockFileEx
UnlockFile
HeapCompact
DeleteFileA
CreateFileA
WaitForSingleObject
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetDefaultDllDirectories
SetDllDirectoryW
FreeConsole
AttachConsole
Sleep
GetModuleHandleW
GetProcAddress
GetLastError
WaitForMultipleObjects
GetTickCount
ResetEvent
HeapFree
GetProcessHeap
HeapAlloc
SetEvent
WaitForSingleObjectEx
CloseHandle
CreateEventW
CreateEventA
LocalFree
WideCharToMultiByte
FormatMessageW
FormatMessageA
HeapCreate
AreFileApisANSI
GetCurrentDirectoryW
PeekNamedPipe
GetDriveTypeW
FlushViewOfFile
gdiplus
GdiplusShutdown
GdiplusStartup
user32
GetUserObjectInformationW
MessageBoxW
TranslateMessage
DispatchMessageW
LoadStringW
LoadIconW
LoadCursorW
RegisterClassExW
PostQuitMessage
DefWindowProcW
FindWindowW
SendMessageW
MsgWaitForMultipleObjects
wsprintfW
PeekMessageW
GetProcessWindowStation
CreateWindowExW
advapi32
CryptSignHashW
CryptEnumProvidersW
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
OpenProcessToken
GetTokenInformation
RegQueryValueExW
RegNotifyChangeKeyValue
RegCreateKeyExW
OpenThreadToken
RegOpenKeyW
LookupAccountNameW
RegDeleteValueW
RegSetValueExW
ConvertSidToStringSidW
RegEnumValueW
RegQueryInfoKeyW
CryptDecrypt
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
shell32
SHGetDesktopFolder
SHGetFolderPathW
SHCreateDirectoryExW
SHGetMalloc
CommandLineToArgvW
SHFileOperationW
ole32
CoCreateGuid
CoTaskMemFree
PropVariantClear
CoCreateInstance
CoUninitialize
CoInitializeEx
StringFromGUID2
oleaut32
SysAllocStringLen
VariantClear
SysFreeString
msi
ord173
ord217
rpcrt4
UuidToStringW
RpcStringFreeW
userenv
ExpandEnvironmentStringsForUserW
shlwapi
StrRetToBufW
ord487
PathFindFileNameW
SHRegDuplicateHKey
PathFileExistsW
bcrypt
BCryptGenRandom
crypt32
CertDuplicateCertificateContext
CertFindCertificateInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertFreeCertificateContext
CertOpenSystemStoreA
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
ws2_32
htons
socket
setsockopt
listen
WSAIoctl
select
gethostname
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
htonl
connect
closesocket
bind
accept
WSASetLastError
send
recv
freeaddrinfo
getaddrinfo
WSAGetLastError
WSACleanup
ntohs
getsockopt
getsockname
ioctlsocket
recvfrom
sendto
getpeername
__WSAFDIsSet
wldap32
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord301
ord46
ord143
ord22
ord41
ord50
ord45
ord60
ord211
ord217
normaliz
IdnToAscii
Sections
.text Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 931KB - Virtual size: 930KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 147KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 187KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 600KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE