Static task
static1
Behavioral task
behavioral1
Sample
2105b967b0ba071c48541966cdb5d9ffc5fa6e974fed5bf85c9c4211cd85cdcf.exe
Resource
win7-20230831-en
General
-
Target
2105b967b0ba071c48541966cdb5d9ffc5fa6e974fed5bf85c9c4211cd85cdcf
-
Size
860KB
-
MD5
0f57d82d24b5545a1798d1df8870ba69
-
SHA1
4a9eaf38c0cd478e8e8c1d8a8e29acf1243dfd25
-
SHA256
2105b967b0ba071c48541966cdb5d9ffc5fa6e974fed5bf85c9c4211cd85cdcf
-
SHA512
199eb96e2b676a0eac39037a9959162cb28fed1afe1c9351d7c8dad5f76e2bdc5c3069bb1951f551e7123f2b10ce164de2050b4a4095a26ce00701a732622767
-
SSDEEP
12288:/x1XoyQ9I++TE42BbCjMWbDev+hQSSqD15/rViBnsFFl:wd9NwAbCjMF2hQe1J5iCFFl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2105b967b0ba071c48541966cdb5d9ffc5fa6e974fed5bf85c9c4211cd85cdcf
Files
-
2105b967b0ba071c48541966cdb5d9ffc5fa6e974fed5bf85c9c4211cd85cdcf.exe windows x86
3e9da80c48735bbb750b5daaccd541fe
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedIncrement
InterlockedDecrement
lstrlenA
GlobalUnlock
GetLastError
lstrcpynA
EnterCriticalSection
lstrcpyA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
SetFilePointer
FlushFileBuffers
GlobalLock
TlsAlloc
GlobalFree
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GlobalFlags
WritePrivateProfileStringA
lstrcatA
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetVersion
GetProcessVersion
SetErrorMode
GetCPInfo
GetOEMCP
RtlUnwind
RaiseException
GetSystemTime
GetLocalTime
GetACP
HeapSize
SetStdHandle
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalAlloc
GlobalDeleteAtom
lstrcmpA
lstrcmpiA
GetCurrentThread
GetCurrentThreadId
SetLastError
GetTimeZoneInformation
GetTickCount
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCommandLineA
SetFileAttributesA
DeleteFileA
GetModuleFileNameA
GetStartupInfoA
GetCurrentProcessId
CreateProcessA
WaitForSingleObject
CreateFileA
WriteFile
CreateDirectoryA
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetModuleHandleA
GetProcessHeap
WideCharToMultiByte
lstrlenW
IsBadCodePtr
IsBadReadPtr
LocalFree
LocalAlloc
IsDebuggerPresent
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
OpenProcess
user32
GetMenuItemID
GetSubMenu
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
GetSysColor
MapWindowPoints
LoadIconA
LoadCursorA
GetSysColorBrush
LoadStringA
DestroyMenu
GetMenuItemCount
UnhookWindowsHookEx
ClientToScreen
GetWindow
CreateWindowExA
GetWindowRect
PtInRect
GetSystemMetrics
GetWindowTextA
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetActiveWindow
GetKeyState
CallNextHookEx
ValidateRect
IsWindowVisible
GetCursorPos
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
EnableWindow
SetCursor
SendMessageA
PostMessageA
PostQuitMessage
SetWindowTextA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetClassNameA
DestroyWindow
GetMessagePos
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetFocus
ShowWindow
SetWindowPos
SetWindowLongA
GetDlgItem
GrayStringA
DrawTextA
TabbedTextOutA
ReleaseDC
GetDC
GetDlgCtrlID
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
GetNextDlgTabItem
UnregisterClassA
gdi32
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SetMapMode
SetTextColor
SetBkColor
GetObjectA
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
CreateBitmap
wininet
InternetSetOptionA
InternetConnectA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCrackUrlA
InternetCanonicalizeUrlA
DeleteUrlCacheEntry
InternetCloseHandle
InternetOpenA
advapi32
LookupAccountSidA
GetTokenInformation
OpenProcessToken
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
shell32
SHFileOperationW
SHFreeNameMappings
urlmon
URLDownloadToFileA
oleaut32
SysFreeString
ole32
CoCreateInstance
CoSetProxyBlanket
shlwapi
PathFindExtensionA
PathFileExistsA
rasapi32
RasHangUpA
RasGetConnectStatusA
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comctl32
ord17
wsock32
WSAStartup
WSACleanup
closesocket
recv
send
select
Sections
.text Size: 116KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 716KB - Virtual size: 836KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ