Static task
static1
Behavioral task
behavioral1
Sample
bd76d4bc243386a1b075fbd0331423d39081fec14825bf9c0ca6b3f94c251c39.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
bd76d4bc243386a1b075fbd0331423d39081fec14825bf9c0ca6b3f94c251c39.exe
Resource
win10v2004-20230703-en
General
-
Target
bd76d4bc243386a1b075fbd0331423d39081fec14825bf9c0ca6b3f94c251c39
-
Size
224KB
-
MD5
4f7855311978ab65edda345410fef1a5
-
SHA1
61cf646e4b06edf9f3b542ebd3cb909c35bdc516
-
SHA256
bd76d4bc243386a1b075fbd0331423d39081fec14825bf9c0ca6b3f94c251c39
-
SHA512
89181014e8b443dd64c4123d489256d7c4bf0fbe8b93338e72c40a7f69e83517c79a89d92f503d80e244acbd40259090b60d934e5b2da34c9edd00e39c448a66
-
SSDEEP
3072:Bvwqu+Dn6JYGJSvl+6LHMX6cDDW5fMT66+9iWTBfxtFFZcKx:Bv5FDnkYc2HMKcXGkD+9iWTBBFH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd76d4bc243386a1b075fbd0331423d39081fec14825bf9c0ca6b3f94c251c39
Files
-
bd76d4bc243386a1b075fbd0331423d39081fec14825bf9c0ca6b3f94c251c39.exe windows x86
13b4dac404c7bca8f5143c8a24f053bb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
SetCurrentDirectoryA
GetModuleFileNameA
TerminateThread
OpenEventA
MultiByteToWideChar
GetEnvironmentVariableA
FreeLibrary
MoveFileExA
GetCommandLineA
WritePrivateProfileStringA
CreateThread
DeleteFileA
GetSystemDirectoryA
GetTempPathA
OpenMutexA
GetTickCount
LoadLibraryA
CloseHandle
GetLocalTime
SetDllDirectoryA
ResetEvent
SetEvent
GetTempFileNameA
GetExitCodeProcess
WaitForSingleObject
GetFileAttributesA
GetProcAddress
GetLastError
CreateEventA
GetCurrentProcessId
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
OpenFileMappingA
FlushFileBuffers
GetFileAttributesExA
FormatMessageA
WriteFile
CreateFileA
GetFileSize
SetFilePointer
GetCurrentThreadId
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
GetVersion
Process32Next
GetCurrentProcess
QueryDosDeviceA
Process32First
TerminateProcess
ReadFile
GetModuleHandleA
GetWindowsDirectoryA
CreateMutexA
GetCurrentDirectoryA
GetStdHandle
CreateToolhelp32Snapshot
OpenProcess
SetLastError
SetFileTime
RemoveDirectoryA
CopyFileA
LocalFileTimeToFileTime
SetFileAttributesA
SetEndOfFile
FindClose
CreateFileMappingA
SystemTimeToFileTime
MoveFileA
FindNextFileA
CreateDirectoryA
GetFileTime
FindFirstFileA
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileStringA
GetVersionExA
GetSystemInfo
GetProcessHeap
HeapReAlloc
HeapSize
HeapAlloc
HeapFree
DosDateTimeToFileTime
GetSystemTimeAsFileTime
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
ExitProcess
SetEnvironmentVariableA
SetEnvironmentVariableW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
user32
SetWindowTextA
EndDialog
GetSystemMetrics
ExitWindowsEx
DialogBoxParamA
MessageBoxExA
SendDlgItemMessageA
MessageBoxA
GetDlgItemTextA
advapi32
SetSecurityDescriptorDacl
AllocateAndInitializeSid
LookupPrivilegeValueA
FreeSid
GetTokenInformation
OpenProcessToken
CheckTokenMembership
GetSidSubAuthority
CreateProcessWithLogonW
AdjustTokenPrivileges
RegEnumKeyExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
CreateServiceA
ControlService
QueryServiceConfigA
QueryServiceStatusEx
QueryServiceStatus
OpenServiceA
CloseServiceHandle
OpenSCManagerA
DeleteService
ChangeServiceConfigA
StartServiceA
InitializeSecurityDescriptor
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
psapi
GetModuleFileNameExA
shlwapi
StrStrIA
ws2_32
select
socket
htons
__WSAFDIsSet
connect
gethostbyname
WSAGetLastError
WSASetLastError
ntohs
ntohl
recvfrom
sendto
setsockopt
closesocket
htonl
inet_addr
WSAStartup
bind
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Sections
.text Size: 156KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ