Static task
static1
Behavioral task
behavioral1
Sample
dd92d89ac96b8e379cc2ad6e4e851672a3fafe2fc176786395d6c6fb633ad4b0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dd92d89ac96b8e379cc2ad6e4e851672a3fafe2fc176786395d6c6fb633ad4b0.exe
Resource
win10v2004-20230915-en
General
-
Target
dd92d89ac96b8e379cc2ad6e4e851672a3fafe2fc176786395d6c6fb633ad4b0
-
Size
3.0MB
-
MD5
950c033d91a1729610cc8b7b05fbd791
-
SHA1
82ba8bd9a392f04549ca2d46d1afa51bef2de757
-
SHA256
dd92d89ac96b8e379cc2ad6e4e851672a3fafe2fc176786395d6c6fb633ad4b0
-
SHA512
80d4ec105b75ca815a88b2009c197de54c37686bc952244ce009ce319e08d32fc03e8bb1c308f162e64bee7d14a7f03ab413ffac8e9c86b683702836a348ae54
-
SSDEEP
49152:VfNvgKAg1K/m69zUb3b5bo6jEb8FS2z5l+TwcUXEpwE:YOK/m6FUC6AOS2tld6wE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dd92d89ac96b8e379cc2ad6e4e851672a3fafe2fc176786395d6c6fb633ad4b0
Files
-
dd92d89ac96b8e379cc2ad6e4e851672a3fafe2fc176786395d6c6fb633ad4b0.exe windows x64
89fc557f925f579f70988c400eee5dbf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
IsBadStringPtrW
MultiByteToWideChar
VirtualAllocEx
VirtualFreeEx
OpenProcess
CreateRemoteThread
WriteProcessMemory
SetEvent
ResetEvent
WaitForSingleObject
OpenMutexW
CreateEventW
LoadLibraryA
QueryDosDeviceW
GetEnvironmentVariableW
GetLogicalDriveStringsW
VirtualQuery
WriteFile
CreateFileW
GetModuleHandleExW
CreateMutexW
ReleaseMutex
SizeofResource
HeapAlloc
LocalFree
GetProcessHeap
CreateDirectoryW
GetWindowsDirectoryW
ReadFile
SetFilePointer
SetEndOfFile
Sleep
DeleteFileW
GetFileSize
GetTickCount
SetLastError
lstrlenW
GetPrivateProfileStringW
LoadLibraryW
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
GetVersionExW
GetCurrentProcess
GetFileAttributesW
WriteConsoleW
SetStdHandle
WaitForSingleObjectEx
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
LoadResource
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetProcAddress
FreeLibrary
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetErrorMode
GetLastError
RaiseException
DecodePointer
GetCurrentProcessId
GetShortPathNameW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SearchPathW
LockResource
GetSystemInfo
ResumeThread
OpenEventW
OpenFileMappingW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetACP
WideCharToMultiByte
GetVolumeInformationW
GetDiskFreeSpaceW
GetDriveTypeW
FindFirstFileW
GetLongPathNameW
RtlUnwind
GetFileAttributesExW
TryEnterCriticalSection
InitializeCriticalSection
FindNextFileW
FindClose
LocalFileTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
DosDateTimeToFileTime
FileTimeToDosDateTime
HeapFree
GetComputerNameExW
GlobalAlloc
GlobalFree
SetFileTime
GetFileTime
GetFullPathNameW
RemoveDirectoryW
GetTempPathW
GetSystemDirectoryW
SetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileExW
CopyFileW
GetTempFileNameW
MoveFileW
DeviceIoControl
lstrcatW
lstrcpyW
GetFileSizeEx
CreateProcessW
GetExitCodeProcess
FormatMessageW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
GetLocalTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
VirtualQueryEx
CreateThread
GetProcessId
OpenThread
TerminateThread
GetThreadContext
SuspendThread
ReleaseSemaphore
CreateSemaphoreW
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
GetStdHandle
GetFileType
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameA
SetConsoleCtrlHandler
GetCurrentThread
HeapSize
HeapReAlloc
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleCP
user32
GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
UnregisterClassW
GetMessageW
CharNextW
PostThreadMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
advapi32
SetSecurityDescriptorDacl
ReportEventW
RegisterEventSourceW
DeregisterEventSource
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
InitializeAcl
GetLengthSid
AddAccessAllowedAce
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
shell32
SHGetFolderPathW
SHGetSpecialFolderPathW
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
oleaut32
SysFreeString
VarUI4FromStr
shlwapi
PathFileExistsW
Sections
.text Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 630KB - Virtual size: 629KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ