Static task
static1
Behavioral task
behavioral1
Sample
3bdadecd8f81547bed5555327864c46b706a02f1a6d9b857aa6be5da44798e23.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3bdadecd8f81547bed5555327864c46b706a02f1a6d9b857aa6be5da44798e23.exe
Resource
win10v2004-20230703-en
General
-
Target
3bdadecd8f81547bed5555327864c46b706a02f1a6d9b857aa6be5da44798e23
-
Size
10.3MB
-
MD5
9330aeebef46934da47327606e467a79
-
SHA1
4dd992c63a2c78ffb62c20db307babd79e097e05
-
SHA256
3bdadecd8f81547bed5555327864c46b706a02f1a6d9b857aa6be5da44798e23
-
SHA512
06d67de4742c00368f5872ff992efad4fd3bf30a0cfc08f7657bae5641045c8778506b839e716875eaeb6595b51010fd7ae440767da23900e8545c8a807c11e1
-
SSDEEP
196608:m/oCHDKBRPGRCQK97TuJghali4NE0apE7V0xQoOBzWhKtM02D8khcRwTl5egOhUS:vODKBdGRM7GRNE0apE7V0xQoOBzWh+MC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3bdadecd8f81547bed5555327864c46b706a02f1a6d9b857aa6be5da44798e23
Files
-
3bdadecd8f81547bed5555327864c46b706a02f1a6d9b857aa6be5da44798e23.exe windows x86
18629a7a227fe7ad84e02e17f6265e5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
kernel32
GetDiskFreeSpaceA
GetSystemDirectoryA
GetSystemInfo
ReadFile
GetEnvironmentVariableA
WaitForSingleObject
GetCurrentProcess
MultiByteToWideChar
FindClose
FindNextFileA
FindFirstFileA
LocalAlloc
SetFileAttributesA
GetFileAttributesA
RemoveDirectoryA
GetTickCount
GetFileAttributesExA
CreateProcessA
GetStartupInfoA
CreatePipe
WriteConsoleW
SetStdHandle
FormatMessageA
lstrlenA
GetModuleHandleA
OpenProcess
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateMutexA
OpenMutexA
CreateEventA
SetEvent
DeleteFileA
GetModuleFileNameA
MoveFileA
GetWindowsDirectoryA
CopyFileA
GetPrivateProfileIntA
LoadLibraryExA
GetProcAddress
Sleep
CreateDirectoryA
GetLocalTime
CreateFileA
GetLastError
CreateFileW
SetFilePointer
WriteFile
GetCurrentThreadId
CloseHandle
LocalFree
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
MoveFileExA
LoadLibraryW
FreeLibrary
GetExitCodeProcess
GetConsoleMode
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
ExitThread
CreateThread
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
QueryPerformanceCounter
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
GetConsoleCP
user32
ExitWindowsEx
advapi32
RegDeleteValueA
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
QueryServiceConfigA
QueryServiceStatusEx
StartServiceA
SetServiceStatus
LockServiceDatabase
QueryServiceLockStatusA
UnlockServiceDatabase
ChangeServiceConfigA
OpenServiceA
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
ole32
CoCreateGuid
Sections
.text Size: 287KB - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ