Static task
static1
Behavioral task
behavioral1
Sample
2648ca991e4016ef2a6c96b7b1bb16e5d1644e41cc09c5b6ac16a30365411374.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2648ca991e4016ef2a6c96b7b1bb16e5d1644e41cc09c5b6ac16a30365411374.exe
Resource
win10v2004-20230703-en
General
-
Target
2648ca991e4016ef2a6c96b7b1bb16e5d1644e41cc09c5b6ac16a30365411374
-
Size
10.0MB
-
MD5
b278637d1b46de5f296bf127ee41491d
-
SHA1
af25bafcbe456552d21b15454834703d8a016afb
-
SHA256
2648ca991e4016ef2a6c96b7b1bb16e5d1644e41cc09c5b6ac16a30365411374
-
SHA512
94a079aac744302be4f33cb96a3e3ef0ed0ffa156079b200449c3f3d0130309c8f23552ab4f5861dfba9d17d312f5b8f3d9450fe27d790fca8216037c1d14a81
-
SSDEEP
196608:ZVWdMlSkCdmYBzW2whVmBWEtKDz9/m6U7QUOZc7cxr1p0S2bc7yyfCP3:fcMSkCRBz2VmBlA/AMU00cpl2bc2yqP3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2648ca991e4016ef2a6c96b7b1bb16e5d1644e41cc09c5b6ac16a30365411374
Files
-
2648ca991e4016ef2a6c96b7b1bb16e5d1644e41cc09c5b6ac16a30365411374.exe windows x86
77e82d910b00f5dda4227cfbcd1516ff
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
kernel32
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
GetCurrentThreadId
CreateProcessA
GetSystemInfo
GetSystemTime
GetSystemDirectoryA
GetWindowsDirectoryA
GetVersionExA
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleExA
GetProcAddress
LoadLibraryA
LocalAlloc
LocalFree
FormatMessageA
lstrcmpA
lstrlenA
CopyFileA
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
GetLocaleInfoA
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetFullPathNameA
SetDefaultDllDirectories
lstrcpynA
lstrcpyA
lstrcatA
CompareStringA
GlobalAlloc
GlobalFree
VirtualProtect
VirtualQuery
GetModuleHandleW
LoadLibraryExA
GlobalUnlock
GlobalLock
FileTimeToLocalFileTime
GetFileTime
LocalFileTimeToFileTime
SetEndOfFile
SetFilePointer
SetFileTime
GetVolumeInformationA
GetLocalTime
GetVersion
DosDateTimeToFileTime
SetVolumeLabelA
FileTimeToSystemTime
SystemTimeToFileTime
lstrcmpiA
CreateDirectoryW
GetFileAttributesExW
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetFullPathNameW
GetCurrentDirectoryW
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeZoneInformation
ReadConsoleW
ReadFile
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetACP
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
HeapReAlloc
SetStdHandle
WriteConsoleW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
GetCommandLineW
GetCommandLineA
GetFileType
CreateEventA
CreateMutexA
WaitForSingleObject
ReleaseMutex
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
QueryPerformanceCounter
GetLastError
RaiseException
CloseHandle
DecodePointer
OutputDebugStringA
GetTempPathA
SetFileAttributesW
SetFileAttributesA
RemoveDirectoryA
GetLongPathNameA
GetFileAttributesA
FlushFileBuffers
FindNextFileA
FindFirstFileA
FindClose
DeleteFileW
DeleteFileA
CreateFileW
CreateFileA
CreateDirectoryA
VerSetConditionMask
GetDriveTypeA
LoadLibraryExW
RtlUnwind
InitializeSListHead
GetStartupInfoW
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
SetLastError
EncodePointer
OutputDebugStringW
IsDebuggerPresent
user32
DispatchMessageA
PeekMessageA
DefWindowProcA
DestroyWindow
ShowWindow
TranslateMessage
SetWindowTextA
GetWindowRect
GetWindowLongA
SetWindowLongA
ExitWindowsEx
CharPrevA
LoadStringA
CreateDialogParamA
LoadIconA
OemToCharA
CharNextA
wsprintfA
MsgWaitForMultipleObjects
SystemParametersInfoA
IsDialogMessageA
SetForegroundWindow
GetSystemMetrics
SetFocus
SetDlgItemTextA
GetDlgItem
MoveWindow
WaitMessage
PostMessageA
SendMessageA
MessageBoxA
advapi32
LookupPrivilegeValueA
SetKernelObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetKernelObjectSecurity
AdjustTokenPrivileges
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegQueryValueExA
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
FreeSid
AllocateAndInitializeSid
OpenProcessToken
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
ole32
CoTaskMemFree
CoCreateGuid
StringFromGUID2
Sections
.text Size: 276KB - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.didat Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ