Static task
static1
Behavioral task
behavioral1
Sample
b7d1db3ccc36525284c5bb62cad0b323d7c383ffa82785aaad9e4a2fada0e642.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b7d1db3ccc36525284c5bb62cad0b323d7c383ffa82785aaad9e4a2fada0e642.exe
Resource
win10v2004-20230915-en
General
-
Target
b7d1db3ccc36525284c5bb62cad0b323d7c383ffa82785aaad9e4a2fada0e642
-
Size
14.2MB
-
MD5
dc050be08232a6b627674e397d7f77ba
-
SHA1
9b5eb81d69bec251cfd250cfd798c10dbb571fbb
-
SHA256
b7d1db3ccc36525284c5bb62cad0b323d7c383ffa82785aaad9e4a2fada0e642
-
SHA512
a8d5b3897a392af1a24885917c9ae2590e3ebac49b735d33d367346c12e9d3a9b16fd212757a4a40bf26bb922944a0874e302c301297dc3119eb2c9407f70641
-
SSDEEP
393216:60Bd0QUY/s5rtF0Sg3v3/UFoYSlXDrOoc:6u0/rESI3shSRDrOoc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7d1db3ccc36525284c5bb62cad0b323d7c383ffa82785aaad9e4a2fada0e642
Files
-
b7d1db3ccc36525284c5bb62cad0b323d7c383ffa82785aaad9e4a2fada0e642.exe windows x86
703f93fcde6dcd2a8bb9a24f40e2a325
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileExA
GetFileInformationByHandle
GetFullPathNameA
GetCurrentDirectoryW
GetTimeZoneInformation
GetWindowsDirectoryW
CopyFileExW
lstrcpyW
GetSystemDirectoryW
OpenMutexW
GetCurrentProcessId
CreateMutexW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
InitializeCriticalSectionAndSpinCount
lstrcmpW
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FlushInstructionCache
RaiseException
CreateFileMappingW
OpenFileMappingW
GetModuleFileNameW
InitializeCriticalSection
GetFileSizeEx
FormatMessageA
WaitForMultipleObjects
PeekNamedPipe
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetEvent
CreateDirectoryA
SetFileTime
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualFree
CreateFileA
SetFilePointer
GetFileSize
GetTickCount
OutputDebugStringW
GetCurrentThreadId
WritePrivateProfileStringW
GetSystemInfo
LocalFree
GetModuleHandleW
MoveFileExW
CreateDirectoryW
HeapFree
GetModuleHandleA
GetProcessHeap
HeapAlloc
FindClose
DeleteFileW
SetFileAttributesW
FindNextFileW
lstrcmpiW
RemoveDirectoryW
FindFirstFileW
lstrcatW
lstrlenW
GetFileAttributesW
lstrcpynW
TerminateProcess
OpenProcess
SystemTimeToFileTime
LoadLibraryExW
SetErrorMode
WriteFile
lstrlenA
CreateEventW
Sleep
GetTempPathW
GlobalFree
GetPrivateProfileStringW
MultiByteToWideChar
ReadFile
CreateFileW
WideCharToMultiByte
FindResourceExW
FindResourceW
LoadResource
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
SetHandleCount
GetLocaleInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetSystemTimeAsFileTime
ExitProcess
VirtualQuery
VirtualProtect
CreateThread
ExitThread
DecodePointer
EncodePointer
InterlockedExchange
InterlockedPopEntrySList
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
LoadLibraryA
GlobalMemoryStatus
QueryPerformanceCounter
GetStdHandle
GetFileType
GetVersion
GlobalReAlloc
lstrcmpiA
InterlockedIncrement
LockResource
SizeofResource
GetCurrentProcess
InterlockedDecrement
GetLastError
CreateProcessW
SetLastError
OutputDebugStringA
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
GetLocalTime
CloseHandle
Process32NextW
GetFileAttributesA
Process32FirstW
CreateToolhelp32Snapshot
CopyFileW
TerminateThread
WaitForSingleObject
user32
DrawTextW
GetClassNameW
IsWindow
SendMessageW
GetDlgItem
GetWindow
SetFocus
GetFocus
IsChild
EndPaint
BeginPaint
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
SetTimer
KillTimer
GetSystemMenu
UnregisterClassA
MessageBoxA
CallWindowProcW
InvalidateRect
GetDC
ReleaseDC
GetDesktopWindow
InflateRect
GetProcessWindowStation
GetUserObjectInformationW
IsWindowEnabled
TrackMouseEvent
DestroyAcceleratorTable
SetMenuItemInfoW
DefWindowProcW
SetForegroundWindow
RemoveMenu
GetMenuState
SetMenuInfo
GetMenuInfo
GetClassNameA
CallNextHookEx
GetCursorPos
SetWindowsHookExW
SetPropA
SetClassLongW
GetClassLongW
UnhookWindowsHookEx
GetMenuItemInfoW
SetWindowTextA
FindWindowA
GetWindowDC
GetMenuItemCount
UpdateWindow
GetPropA
OffsetRect
EqualRect
CopyRect
IsWindowVisible
SetParent
EndDialog
DialogBoxParamW
DrawIconEx
SetRect
IsRectEmpty
GetWindowThreadProcessId
MapWindowPoints
SetWindowLongW
GetSysColor
CharNextW
SetWindowPos
RedrawWindow
GetClassInfoExW
CreateWindowExW
DestroyWindow
CreateAcceleratorTableW
ClientToScreen
GetParent
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
FillRect
GetClientRect
GetWindowLongW
InvalidateRgn
IsIconic
IsDialogMessageW
LoadCursorW
SetWindowRgn
SetRectEmpty
IsZoomed
GetWindowRect
LoadIconW
FindWindowExW
SendMessageTimeoutW
EnableWindow
FindWindowW
RegisterClassExW
GetSystemMetrics
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
PostQuitMessage
SetCursor
PtInRect
EnableMenuItem
PostMessageW
ShowWindow
MessageBoxW
gdi32
SetBkMode
GetPixel
CreateFontW
SetBkColor
ExtTextOutW
CreatePen
CreateFontIndirectW
GetClipBox
ExcludeClipRect
Rectangle
SetTextColor
RoundRect
GetTextExtentPoint32W
Ellipse
CreateDCW
SelectPalette
RealizePalette
GetDIBits
CreateDIBitmap
CreateDIBSection
ExtCreateRegion
CombineRgn
SelectObject
GetDeviceCaps
GetObjectW
GetStockObject
DeleteDC
BitBlt
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
GetRgnBox
StretchBlt
advapi32
GetFileSecurityW
CryptCreateHash
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegEnumKeyExW
RegDeleteKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumValueW
DeleteService
ControlService
CloseServiceHandle
StartServiceW
OpenServiceW
CreateServiceW
OpenSCManagerW
GetUserNameW
BuildExplicitAccessWithNameW
DeleteAce
GetExplicitEntriesFromAclW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
SetFileSecurityW
GetSecurityDescriptorControl
SetSecurityDescriptorDacl
AddAccessAllowedAce
AddAce
EqualSid
GetAce
InitializeAcl
GetLengthSid
GetAclInformation
GetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptHashData
LookupAccountNameW
shell32
SHGetPathFromIDListW
SHGetFolderPathW
SHCreateDirectoryExW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHChangeNotify
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetMalloc
ole32
OleInitialize
OleUninitialize
CoTaskMemFree
PropVariantClear
CoUninitialize
CLSIDFromString
CoTaskMemRealloc
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
CoTaskMemAlloc
CoInitialize
CLSIDFromProgID
CoCreateInstance
oleaut32
SysStringLen
OleCreateFontIndirect
VariantInit
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
LoadRegTypeLi
VariantClear
VarUI4FromStr
wininet
InternetGetConnectedState
sensapi
IsNetworkAlive
shlwapi
PathAddBackslashW
PathFileExistsW
PathAppendW
SHGetValueW
PathIsDirectoryW
SHSetValueW
SHDeleteKeyW
SHDeleteValueW
StrCmpW
PathStripToRootW
PathRemoveFileSpecW
PathSkipRootW
PathIsSameRootW
SHStrDupW
StrChrIW
StrStrIW
comctl32
_TrackMouseEvent
InitCommonControlsEx
msimg32
TransparentBlt
AlphaBlend
urlmon
CoInternetSetFeatureEnabled
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
winhttp
WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpConnect
WinHttpSetTimeouts
WinHttpOpen
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCrackUrl
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
iphlpapi
GetAdaptersInfo
winmm
timeKillEvent
timeSetEvent
ws2_32
freeaddrinfo
getaddrinfo
sendto
recvfrom
connect
listen
ioctlsocket
gethostname
htonl
ntohl
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
socket
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSACleanup
WSAStartup
accept
normaliz
IdnToAscii
wldap32
ord217
ord143
ord22
ord30
ord200
ord32
ord35
ord79
ord26
ord50
ord33
ord301
ord27
ord41
ord46
ord60
ord45
ord211
crypt32
CertFindCertificateInStore
CryptStringToBinaryA
CertOpenStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptQueryObject
CertGetNameStringA
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertGetCertificateChain
CertCreateCertificateChainEngine
CertCloseStore
CertFreeCertificateContext
gdiplus
GdipGetImageHeight
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipDrawImageRectRect
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdiplusStartup
GdiplusShutdown
GdipDeleteGraphics
GdipFree
GdipReleaseDC
GdipAlloc
GdipCreateFromHDC
GdipSetCompositingMode
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipFillRectangle
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetPropertyItemSize
GdipCreateBitmapFromStream
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 99.9MB - Virtual size: 99.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 336KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ