Static task
static1
Behavioral task
behavioral1
Sample
b7ceec6d90f4e9983a384e4301517c16d288a555ee8c721a2e45f25afb2688bc.exe
Resource
win7-20230831-en
General
-
Target
b7ceec6d90f4e9983a384e4301517c16d288a555ee8c721a2e45f25afb2688bc
-
Size
3.2MB
-
MD5
d1f487071fa28bbc6b529da30a3389a5
-
SHA1
34d2aff78ecc0a91adfa8d4b08441b938615c6f3
-
SHA256
b7ceec6d90f4e9983a384e4301517c16d288a555ee8c721a2e45f25afb2688bc
-
SHA512
0b6ce5b5157e40ce0f4a830e7c46da7a29c7d34f6ee42a8d461eeffede229b7175b1f8ebea32a71247f2781681b8e6d3a37466f9e78fcbe9c068308a58c31d9b
-
SSDEEP
49152:S2WBRsqmfaXhyYS0ZeJqF5ap7/VehBwDpS9Q1ae8C2w6AX1nrg4tlITAbTiDlvEZ:zWXsqga7Sge25+ehl9yae7lZrgIsEZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7ceec6d90f4e9983a384e4301517c16d288a555ee8c721a2e45f25afb2688bc
Files
-
b7ceec6d90f4e9983a384e4301517c16d288a555ee8c721a2e45f25afb2688bc.exe windows:6 windows x86
b7d80f43e5eb116589c452c44355051a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetSetOptionW
InternetCloseHandle
InternetOpenW
HttpQueryInfoW
InternetReadFile
HttpOpenRequestA
InternetWriteFile
InternetCrackUrlA
HttpEndRequestW
InternetOpenUrlW
HttpAddRequestHeadersA
InternetConnectA
HttpAddRequestHeadersW
InternetCanonicalizeUrlW
InternetGetConnectedState
HttpOpenRequestW
InternetQueryOptionW
HttpSendRequestW
InternetConnectW
HttpQueryInfoA
HttpSendRequestExW
kernel32
WaitForMultipleObjects
GetSystemDirectoryA
SleepEx
CloseHandle
WaitForSingleObject
GetModuleHandleW
GetProcAddress
GetSystemInfo
Sleep
FindClose
SwitchToThread
GetModuleHandleA
GetModuleFileNameW
FreeLibrary
ReadFile
SetLastError
GetCurrentProcess
WriteFile
SetFilePointer
CreateFileW
GetCurrentThreadId
DuplicateHandle
ExitThread
CreateEventW
FormatMessageW
GlobalAlloc
GlobalFree
CreateThread
LocalFree
GetFileSize
CreateDirectoryW
GetProcessId
GetFileAttributesW
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
MoveFileExW
SystemTimeToFileTime
CreateProcessW
CopyFileW
GetTempFileNameW
GetFileTime
GetExitCodeProcess
GetCommandLineW
GetTempPathW
GetSystemDirectoryW
LoadLibraryW
OpenMutexW
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
RemoveDirectoryW
OpenProcess
CreateMutexW
ReleaseMutex
FindNextFileW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
OutputDebugStringW
SetPriorityClass
TlsSetValue
TlsGetValue
OpenEventW
LoadLibraryExW
lstrlenW
LocalAlloc
lstrcpyW
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
GetVersionExW
SetEvent
VirtualFree
VirtualAlloc
TlsAlloc
TlsFree
GetDiskFreeSpaceExW
GetSystemTime
GetTickCount
TryEnterCriticalSection
TerminateProcess
lstrcatW
GetLocalTime
VirtualQuery
IsDebuggerPresent
SetUnhandledExceptionFilter
GetACP
CreateFileA
CreateFileMappingA
WaitNamedPipeW
GetSystemTimeAsFileTime
WaitForSingleObjectEx
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
SetNamedPipeHandleState
AreFileApisANSI
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
LoadLibraryA
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
FormatMessageA
ResetEvent
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
GetStringTypeW
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetCurrentThread
GetTimeZoneInformation
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ExitProcess
GetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindFirstFileW
ReadConsoleW
IsValidCodePage
GetOEMCP
SetFilePointerEx
GetConsoleCP
GetCurrentDirectoryW
SetStdHandle
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
DeleteFileW
GetCurrentProcessId
WideCharToMultiByte
MultiByteToWideChar
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
OpenFileMappingW
GetConsoleMode
user32
wvsprintfW
SetRectEmpty
wsprintfW
FindWindowW
GetSystemMetrics
LoadIconW
CreateWindowExW
DestroyWindow
PostMessageW
gdi32
DeleteObject
DeleteDC
CreateCompatibleDC
SelectObject
GetFontData
CreateFontIndirectW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
AddAccessAllowedAceEx
GetLengthSid
RegSetValueExW
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegCreateKeyExW
RegOpenKeyW
CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
OpenProcessToken
LookupAccountSidW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
SetSecurityInfo
shell32
ShellExecuteExW
SHGetFolderPathW
ShellExecuteW
Shell_NotifyIconW
SHFileOperationW
ole32
StringFromCLSID
CoCreateGuid
CoTaskMemFree
imm32
ImmDisableIME
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
psapi
GetProcessMemoryInfo
ws2_32
closesocket
WSACleanup
WSAStartup
WSASetLastError
ioctlsocket
sendto
recvfrom
listen
accept
select
__WSAFDIsSet
gethostname
gethostbyaddr
getservbyname
getservbyport
gethostbyname
inet_ntoa
inet_addr
htonl
WSAGetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
send
recv
wldap32
ord35
ord46
ord211
ord60
ord50
ord41
ord301
ord200
ord30
ord79
ord143
ord33
ord32
ord27
ord26
ord22
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 771KB - Virtual size: 770KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 44KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 175KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE