Behavioral task
behavioral1
Sample
30c587cc396239ad4ceffc549eff396b3475ad7b1ae8e91cf0b3412a91168d34.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
30c587cc396239ad4ceffc549eff396b3475ad7b1ae8e91cf0b3412a91168d34.exe
Resource
win10v2004-20230831-en
General
-
Target
30c587cc396239ad4ceffc549eff396b3475ad7b1ae8e91cf0b3412a91168d34
-
Size
1.4MB
-
MD5
207b588613acecec83658ea270b38d98
-
SHA1
614979f77f1aeab17175c2bcc70ba139d27ce54f
-
SHA256
30c587cc396239ad4ceffc549eff396b3475ad7b1ae8e91cf0b3412a91168d34
-
SHA512
8d6a6328904087dd433836e266b216903f898b67c83f2d5d7b110cd11eba5b4a6fc712b99e5269dbf94f414b4f8db1c9573706716f066c79be7311820b894651
-
SSDEEP
24576:QhT5scRn+U2e4+e6nUAuIRLIgT7h/qBsPO/PNiPN:08WeVAjSg/JPO/l
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30c587cc396239ad4ceffc549eff396b3475ad7b1ae8e91cf0b3412a91168d34
Files
-
30c587cc396239ad4ceffc549eff396b3475ad7b1ae8e91cf0b3412a91168d34.exe windows x86
0807cdf2f4d2af05d5676079ac38231e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
ExitProcess
GetConsoleMode
ReadFile
SetFilePointerEx
SetStdHandle
ReadConsoleW
GetConsoleCP
GetModuleFileNameW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
SetEndOfFile
InterlockedDecrement
WaitForMultipleObjects
ReleaseSemaphore
WaitForSingleObject
SetEvent
SetThreadPriority
CreateThread
CreateSemaphoreW
CreateEventW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
GetCurrentThread
LocalFree
Sleep
GetPrivateProfileIntW
WritePrivateProfileStringW
GetPrivateProfileStringW
WinExec
lstrcpyW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
CreateMutexW
OpenMutexW
GetVersionExW
GetCurrentThreadId
CreateDirectoryW
GetCurrentProcess
WriteFile
CreateFileW
CloseHandle
DeleteFileW
GetLastError
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileType
FindFirstFileExW
GetModuleHandleExW
ExitThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
VirtualFree
IsDebuggerPresent
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
DuplicateHandle
WaitForSingleObjectEx
TryEnterCriticalSection
GetStringTypeW
EncodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LoadLibraryExW
CreateFileA
SetFilePointer
InterlockedExchange
GetModuleFileNameA
DeleteFileA
GetFileSize
GetLocalTime
GetCurrentProcessId
FormatMessageA
GetFileAttributesW
SetFileAttributesW
FindClose
FindNextFileW
TerminateProcess
GetModuleHandleA
CreateProcessW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
GetThreadTimes
CreateTimerQueue
SignalObjectAndWait
SwitchToThread
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
VirtualAlloc
user32
GetWindowRect
PostMessageW
SetForegroundWindow
GetCursorPos
KillTimer
SetTimer
GetSystemMetrics
LoadImageW
PostQuitMessage
SendMessageW
MessageBoxW
FindWindowW
MoveWindow
SystemParametersInfoW
SetWindowPos
MonitorFromWindow
GetMonitorInfoW
gdi32
DeleteObject
advapi32
OpenThreadToken
ConvertSidToStringSidW
LookupAccountSidW
RegQueryValueExA
RegOpenKeyExA
RegQueryValueW
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
shell32
ShellExecuteW
ShellExecuteExW
Shell_NotifyIconW
CommandLineToArgvW
SHGetSpecialFolderPathW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
CoInitializeEx
oleaut32
VariantClear
SysFreeString
SysAllocString
shlwapi
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathRemoveFileSpecA
PathIsRelativeW
ord176
PathCombineW
dtlui
?ShowModal@CWindowWnd@DuiLib@@UAEIXZ
?GetWindowClassName@CMenuImplBase@DuiLib@@UBEPB_WXZ
?GetClassStyle@CWindowWnd@DuiLib@@MBEIXZ
?HandleMessage@CMenuImplBase@DuiLib@@UAEJIIJ@Z
?OnCreate@CMenuImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKillFocus@CMenuImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKeyDown@CMenuImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSize@CMenuImplBase@DuiLib@@UAEJIIJAAH@Z
?GetXmlFile@CMenuImplBase@DuiLib@@MAE?AVCDuiString@2@XZ
?GetItemCount@CMenuImplBase@DuiLib@@MAEHXZ
?GetItemElementHeght@CMenuImplBase@DuiLib@@MAEHXZ
??1CDialogBuilder@DuiLib@@QAE@XZ
?SetBkImage@CControlUI@DuiLib@@QAEXPB_W@Z
?Notify@CMenuImplBase@DuiLib@@UAEXAAUtagTNotifyUI@2@@Z
?Close@CMenuImplBase@DuiLib@@UAEXI@Z
??0WindowImplBaseNew@DuiLib@@QAE@XZ
??1WindowImplBaseNew@DuiLib@@UAE@XZ
?InitWinParam@WindowImplBaseNew@DuiLib@@UAEXPB_W@Z
?Create@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKKHHHHPAUHMENU__@@@Z
?ShowModal@WindowImplBaseNew@DuiLib@@UAEIXZ
??0CDuiRect@DuiLib@@QAE@XZ
?GetWidth@CDuiRect@DuiLib@@QBEHXZ
?GetHeight@CDuiRect@DuiLib@@QBEHXZ
??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
??0CDuiRect@DuiLib@@QAE@ABUtagRECT@@@Z
??BCDuiString@DuiLib@@QBEPB_WXZ
??1CDuiString@DuiLib@@QAE@XZ
?Close@CWindowWnd@DuiLib@@QAEXI@Z
?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@PB_W@Z
?GetWindowClassName@WindowImplBaseNew@DuiLib@@UBEPB_WXZ
?GetSuperClassName@CWindowWnd@DuiLib@@MBEPB_WXZ
?GetClassStyle@WindowImplBaseNew@DuiLib@@UBEIXZ
?HandleMessage@WindowImplBaseNew@DuiLib@@UAEJIIJ@Z
?OnFinalMessage@WindowImplBaseNew@DuiLib@@UAEXPAUHWND__@@@Z
?CreateDuiWindow@WindowImplBaseNew@DuiLib@@UAEPAUHWND__@@PAU3@PB_WPAVIDialogBuilderCallback@2@KK@Z
?CreateWin@WindowImplBaseNew@DuiLib@@UAEXXZ
?AdjustPostion@WindowImplBaseNew@DuiLib@@UAEXXZ
?OnClose@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnDestroy@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnTimer@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnNcActivate@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnNcCalcSize@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnNcPaint@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnNcHitTest@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnGetMinMaxInfo@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnMouseWheel@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnSize@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnSysCommand@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnCreate@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnKeyDown@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnSetFocus@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnLButtonDown@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnLButtonUp@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnMouseMove@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnMouseLeave@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnMouseHover@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?OnSetForegoundWindow@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?HandleCustomMessage@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?SetResType@WindowImplBaseNew@DuiLib@@UAEXW4RESTYPE@2@PB_WH1_N@Z
?SetXmlZip@WindowImplBaseNew@DuiLib@@UAEXPB_W@Z
?WindowInitNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?KillFocusNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?SetFocusNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?DBClickNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?SelectChangedNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?HeaderClickNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?HeaderCheckNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?TextChangedNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?ItemSelectNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?ItemClickNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?ItemDBClickNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?LinkNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?GetSkinFile@WindowImplBaseNew@DuiLib@@MAE?AVCDuiString@2@XZ
?ResponseDefaultKeyEvent@WindowImplBaseNew@DuiLib@@MAEJI@Z
?UpdateWindowState@WindowImplBaseNew@DuiLib@@MAEXIJ@Z
?Notify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?MessageHandler@WindowImplBaseNew@DuiLib@@UAEJIIJAA_N@Z
?ShowWindow@CWindowWnd@DuiLib@@QAEX_N0@Z
?GetHWND@CWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
?InitAfterCreate@WindowImplBaseNew@DuiLib@@UAEXXZ
?OnKillFocus@WindowImplBaseNew@DuiLib@@UAEJIIJAAH@Z
?SetInstance@CPaintManagerUI@DuiLib@@SAXPAUHINSTANCE__@@@Z
?SetResourcePath@CPaintManagerUI@DuiLib@@SAXPB_W@Z
??HCDuiString@DuiLib@@QBE?AV01@PB_W@Z
?GetInstancePath@CPaintManagerUI@DuiLib@@SA?AVCDuiString@2@XZ
?CenterWindow@CWindowWnd@DuiLib@@QAEXXZ
?MessageLoop@CPaintManagerUI@DuiLib@@SAXXZ
?GetInstance@CPaintManagerUI@DuiLib@@SAPAUHINSTANCE__@@XZ
??0CDuiString@DuiLib@@QAE@XZ
?Format@CDuiString@DuiLib@@QAAHPB_WZZ
?GetData@CDuiString@DuiLib@@QBEPB_WXZ
?PostMessageW@CWindowWnd@DuiLib@@QAEJIIJ@Z
?ClickNotify@WindowImplBaseNew@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
??0CMenuImplBase@DuiLib@@QAE@XZ
??1CMenuImplBase@DuiLib@@QAE@XZ
?InitParam@CMenuImplBase@DuiLib@@QAEXPAUHWND__@@PB_WPAVIDialogBuilderCallback@2@@Z
?AdjustPostion@CMenuImplBase@DuiLib@@UAEXXZ
?OnFinalMessage@CMenuImplBase@DuiLib@@UAEXPAUHWND__@@@Z
?InitItem@CMenuImplBase@DuiLib@@UAEXXZ
?AddListItem@CMenuImplBase@DuiLib@@QAEXPAVCControlUI@2@@Z
??0CDialogBuilder@DuiLib@@QAE@XZ
?IsValid@CMarkup@DuiLib@@QBE_NXZ
?GetMarkup@CDialogBuilder@DuiLib@@QAEPAVCMarkup@2@XZ
?Create@CDialogBuilder@DuiLib@@QAEPAVCControlUI@2@VSTRINGorID@2@PB_WPAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z
?Create@CDialogBuilder@DuiLib@@QAEPAVCControlUI@2@PAVIDialogBuilderCallback@2@PAVCPaintManagerUI@2@PAV32@@Z
?SetSubControlText@CContainerUI@DuiLib@@QAE_NPB_W0@Z
?FindSubControl@CContainerUI@DuiLib@@QAEPAVCControlUI@2@PB_W@Z
wininet
InternetCheckConnectionW
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
Sections
.text Size: 575KB - Virtual size: 575KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 148KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 564KB - Virtual size: 563KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX Size: 57KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE