ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20230703-en
General
-
Target
7ba09403e9d7122a20fa510de11f7809822e6e11efb164414e2148b762cf4e75.bin.sample.gz
-
Size
249KB
-
MD5
57e2bdbd3f465f1d9872356d151b7a92
-
SHA1
66b6bb20ff4664ade238275adb77f25727971d61
-
SHA256
db76e22b8ff48822dd84bddad46cf747141d492e5be50dc68d26b82e8977cfeb
-
SHA512
e818eadb11e872620d5afc21ff6215d2a08f8f975521fc4e2453e04c47eda0b7619d6004cdda12f4deaa5bbc36b088b63b327b892c301cabd367d1f4b0cbb39d
-
SSDEEP
6144:1m9HiFrLUYqzwdn+/39jRh6q3g00SwM45nT2kmr:Etid4YqzwF+xz5gDSA5nK7r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/sample
Files
-
7ba09403e9d7122a20fa510de11f7809822e6e11efb164414e2148b762cf4e75.bin.sample.gz.gz
-
sample.exe windows x86
781b54a14025c4a5f8d8c2b110250416
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenThread
SetThreadContext
CreateDirectoryW
WriteFile
GetTempPathA
GetFileSize
LoadLibraryW
LeaveCriticalSection
HeapAlloc
CreateFileW
GetTempPathW
CreateSemaphoreW
GetModuleHandleW
GetExitCodeProcess
GetTickCount
ReleaseMutex
SetUnhandledExceptionFilter
GetCommandLineA
LocalAlloc
TerminateThread
CreateMutexW
SystemTimeToFileTime
ExitProcess
SetFilePointer
WaitForSingleObject
lstrcpynW
MoveFileExW
WaitForMultipleObjects
FindFirstFileA
EnterCriticalSection
FindNextFileW
Sleep
CreatePipe
LocalFree
PeekNamedPipe
VirtualFree
VirtualProtect
GetProcessHeap
GetLogicalDriveStringsA
CloseHandle
VirtualProtectEx
GetSystemTime
IsBadReadPtr
CopyFileW
MapViewOfFile
CreateFileMappingW
GetComputerNameW
GetDriveTypeA
CreateToolhelp32Snapshot
GetCurrentProcess
GetExitCodeThread
CreateFileA
GetFileAttributesW
GetModuleFileNameA
ResumeThread
GetLastError
UnmapViewOfFile
GetLogicalDrives
GetFileTime
InitializeCriticalSection
GetCurrentDirectoryW
FileTimeToLocalFileTime
GetDriveTypeW
Process32NextW
GetFileAttributesExW
MoveFileExA
CreateEventW
FindNextFileA
FindFirstFileExW
lstrcmpW
SetCurrentDirectoryW
GetSystemTimeAsFileTime
TerminateProcess
GetThreadContext
MultiByteToWideChar
ExpandEnvironmentStringsA
GetProcAddress
FindClose
DeleteFileA
GetTempFileNameW
CompareFileTime
OpenProcess
DeleteFileW
lstrcmpiW
ResetEvent
GetCurrentProcessId
VirtualAlloc
GetSystemDirectoryW
DeleteCriticalSection
FileTimeToSystemTime
CreateThread
Thread32First
lstrlenW
SetEnvironmentVariableW
SetFileTime
Thread32Next
ExpandEnvironmentStringsW
SetThreadPriority
GetLocalTime
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
FlushFileBuffers
Process32FirstW
FindFirstFileW
GetModuleFileNameW
WideCharToMultiByte
CreateProcessW
ReleaseSemaphore
ReadFile
VirtualQueryEx
GetVersionExW
GetFileInformationByHandle
LoadLibraryA
LocalFileTimeToFileTime
SetEvent
GetCurrentThreadId
GetConsoleMode
GetConsoleCP
CompareStringW
CompareStringA
RtlUnwind
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
QueryPerformanceCounter
HeapReAlloc
GetModuleHandleA
HeapFree
GetVersionExA
GetStartupInfoA
UnhandledExceptionFilter
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
IsDebuggerPresent
HeapDestroy
HeapCreate
HeapSize
GetStdHandle
RaiseException
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
WriteConsoleW
user32
GetDesktopWindow
wsprintfW
MessageBoxW
advapi32
RegisterServiceCtrlHandlerW
QueryServiceConfigW
IsValidSid
SetServiceStatus
AllocateAndInitializeSid
StartServiceCtrlDispatcherW
EqualSid
IsTextUnicode
OpenProcessToken
LookupAccountSidW
GetTokenInformation
ChangeServiceConfig2W
FreeSid
psapi
GetModuleBaseNameW
ws2_32
ntohl
wininet
InternetCrackUrlW
InternetCrackUrlA
rpcrt4
UuidCreateSequential
shlwapi
PathCanonicalizeW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
Exports
Exports
Sections
.text Size: 384KB - Virtual size: 383KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ