Static task
static1
Behavioral task
behavioral1
Sample
WebSocketClientForTestv4.20(1).exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
WebSocketClientForTestv4.20(1).exe
Resource
win10v2004-20230703-en
General
-
Target
WebSocketClientForTestv4.20(1).exe
-
Size
1.5MB
-
MD5
142aa9eb8e10d3ec0c1116e1cca6db37
-
SHA1
4f0074d4f5d51026dddfa84cf48fd62f7a746772
-
SHA256
11d1f6973e75dc84ebbc1bcc0115fd0312093f7c8d713b96971fd20493eeb2a4
-
SHA512
6984bc44098c6221cf5d4ab0523558914a32a9a9ce555569eac3f513465ac673a5ac9c33aad4943dd4a4f4b8c0a813552d60981f225c5df73dbdd81c956bd021
-
SSDEEP
24576:2FQumagoACM1GoJqXPM4odpVpnrlw6e9shnCg00+QATmaS+:gNmOeGoJqXPgXnrlmshnUQimaB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource WebSocketClientForTestv4.20(1).exe
Files
-
WebSocketClientForTestv4.20(1).exe.exe windows x86
d4855ba26df3d5c7ad9d3e6fc2320090
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileAttributesA
InterlockedIncrement
InterlockedDecrement
IsBadWritePtr
lstrlenW
FatalAppExitA
DebugBreak
lstrcpyW
FreeResource
FindResourceW
LoadResource
GetCurrentProcess
SizeofResource
GetConsoleWindow
GetFileAttributesW
GetModuleFileNameW
GetLongPathNameW
LockResource
CloseHandle
GetFileSize
_llseek
WriteFile
ReadFile
CreateFileW
VirtualFree
FreeLibrary
SetDllDirectoryW
WaitForSingleObject
GetDllDirectoryW
CreateRemoteThread
InitializeCriticalSection
OpenProcess
VirtualFreeEx
LoadLibraryW
ReadProcessMemory
LeaveCriticalSection
GetProcAddress
VirtualAlloc
EnterCriticalSection
VirtualAllocEx
OpenThread
GetExitCodeThread
GetSystemInfo
DeleteCriticalSection
GetCurrentThreadId
WriteProcessMemory
SetFilePointer
GetCurrentThread
TerminateThread
Sleep
SuspendThread
ResumeThread
SystemTimeToTzSpecificLocalTime
GetTickCount
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
AllocConsole
SetEndOfFile
FlushConsoleInputBuffer
ReadConsoleW
SetConsoleCP
SetConsoleMode
GetConsoleOutputCP
GetStdHandle
GetFileType
SetConsoleCtrlHandler
LocalFree
SetConsoleWindowInfo
SetConsoleTitleW
GetCurrentProcessId
GetNativeSystemInfo
HeapAlloc
HeapFree
GetProcessHeap
IsBadReadPtr
SetLastError
LoadLibraryA
VirtualProtect
GetCPInfo
GetOEMCP
IsValidCodePage
GetModuleHandleW
ExitProcess
DecodePointer
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetFullPathNameW
HeapReAlloc
GetStringTypeW
ExitThread
CreateThread
RtlUnwind
GetTimeFormatW
GetDateFormatW
GetSystemTimeAsFileTime
DuplicateHandle
CreateProcessA
DeleteFileW
MoveFileW
SetStdHandle
InitializeCriticalSectionAndSpinCount
CreateProcessW
RaiseException
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapCreate
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CompareStringW
IsProcessorFeaturePresent
CreateFileA
CreatePipe
GetExitCodeProcess
HeapSize
WriteConsoleW
GetCurrentDirectoryW
GetDriveTypeW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FormatMessageA
GetModuleFileNameA
GetModuleHandleA
SetErrorMode
SetConsoleOutputCP
GetACP
user32
WinHelpA
MapWindowPoints
IsWindow
IsWindowVisible
EqualRect
GetActiveWindow
LoadIconA
RegisterClassA
GetClientRect
ShowWindow
DefWindowProcA
SetWindowPos
GetSystemMenu
SetActiveWindow
IsIconic
ModifyMenuA
GetWindowThreadProcessId
GetMessageW
TranslateMessage
PeekMessageW
DispatchMessageW
SendMessageA
SetForegroundWindow
MessageBoxW
SetWindowRgn
GetWindowRect
wsprintfA
SetFocus
OffsetRect
IntersectRect
MessageBoxA
GetWindowLongA
CreateWindowExA
CallWindowProcA
ole32
OleRegGetUserType
CreateOleAdviseHolder
CoTaskMemAlloc
OleCreate
OleSetContainedObject
StringFromIID
CLSIDFromString
CLSIDFromProgID
CoRegisterClassObject
CoRevokeClassObject
MkParseDisplayName
CreateBindCtx
CoCreateInstance
CoLockObjectExternal
StringFromCLSID
OleInitialize
OleUninitialize
CoTaskMemFree
shlwapi
SHDeleteKeyA
StrFormatByteSizeW
gdi32
SetViewportOrgEx
SetWindowOrgEx
DeleteObject
CreateRectRgnIndirect
SetViewportExtEx
SetWindowExtEx
SetMapMode
advapi32
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
shell32
ord165
oleaut32
SysFreeString
UnRegisterTypeLi
GetActiveObject
VariantInit
VariantCopyInd
VariantClear
LoadTypeLibEx
SysAllocStringLen
LoadRegTypeLi
LHashValOfNameSys
SafeArrayCreateVector
VariantTimeToSystemTime
SafeArrayAccessData
VariantCopy
SafeArrayDestroy
SafeArrayCreate
SystemTimeToVariantTime
SafeArrayGetDim
VariantChangeType
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayPutElement
DispGetIDsOfNames
SysStringLen
Sections
.text Size: 552KB - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 890KB - Virtual size: 889KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ