Static task
static1
Behavioral task
behavioral1
Sample
ff2871c84ebd60b7d9055f31ed9a12eee2ead24417e6671691a80cea6198b860.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ff2871c84ebd60b7d9055f31ed9a12eee2ead24417e6671691a80cea6198b860.exe
Resource
win10v2004-20230915-en
General
-
Target
ff2871c84ebd60b7d9055f31ed9a12eee2ead24417e6671691a80cea6198b860
-
Size
7.0MB
-
MD5
1c51b17bed49f4684da08cef5f6754ca
-
SHA1
ccf5b6ccdfdec2e34ce5f3321aef6fe8d478a294
-
SHA256
ff2871c84ebd60b7d9055f31ed9a12eee2ead24417e6671691a80cea6198b860
-
SHA512
2d55b753734151151ff5d136573d80627d24933e6290e65acfc308a67d257df87d58811b2a7576e7634bc1fe8a1e90e8292952a811b1edc113d523fac38c7cfc
-
SSDEEP
98304:BGearujN3YHtubgtivbj5qH/QJCS/M69yLlN3mlse54P:BGkjBqH/QJlALlRmleP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff2871c84ebd60b7d9055f31ed9a12eee2ead24417e6671691a80cea6198b860
Files
-
ff2871c84ebd60b7d9055f31ed9a12eee2ead24417e6671691a80cea6198b860.exe windows:5 windows x86
a3bd72d808893a8600818ffb5efe96a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FileTimeToLocalFileTime
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
SetEnvironmentVariableA
GetDriveTypeW
GetFullPathNameA
SetCurrentDirectoryW
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoA
GetProcessHeap
GetConsoleMode
GetConsoleCP
LCMapStringW
GetStringTypeW
HeapFree
HeapQueryInformation
HeapSize
HeapReAlloc
HeapAlloc
CreateFileA
GetTimeZoneInformation
IsValidCodePage
GetCPInfo
GetOEMCP
GetACP
IsProcessorFeaturePresent
SetConsoleCtrlHandler
FatalAppExitA
HeapDestroy
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
QueryPerformanceCounter
SetStdHandle
GetFileType
WriteConsoleW
OutputDebugStringA
GetStdHandle
VirtualQuery
GetSystemInfo
VirtualAlloc
GetSystemTimeAsFileTime
ExitThread
ExitProcess
GetModuleFileNameA
IsBadReadPtr
HeapValidate
GetDateFormatW
GetTimeFormatW
RaiseException
EncodePointer
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
DecodePointer
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
LocalLock
LocalUnlock
WaitForMultipleObjects
ReleaseMutex
CreateMutexW
ReleaseSemaphore
CreateSemaphoreW
InitializeCriticalSectionAndSpinCount
ResetEvent
PulseEvent
SearchPathW
GetTempPathW
FindResourceExW
GetNumberFormatW
GetWindowsDirectoryW
SetFileAttributesW
LocalFileTimeToFileTime
GetFileAttributesExW
GetFileSizeEx
GetCurrentDirectoryW
lstrcpyW
GetProfileIntW
VirtualProtect
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
EnterCriticalSection
LeaveCriticalSection
OpenEventA
InitializeCriticalSection
GlobalFlags
ReleaseActCtx
CreateActCtxW
SetErrorMode
GetUserDefaultLCID
ReplaceFileW
GetDiskFreeSpaceW
GetTempFileNameW
GetFileTime
SetFileTime
GetFileAttributesW
lstrlenA
GetAtomNameW
FindNextFileW
GetPrivateProfileIntW
GetShortPathNameW
lstrcmpiW
GetStringTypeExW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
DeleteFileW
MoveFileW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
GetCurrentProcess
DuplicateHandle
GetHandleInformation
CompareStringA
InterlockedExchange
lstrcmpA
GetCurrentThread
GetLocaleInfoW
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetThreadLocale
SystemTimeToFileTime
FileTimeToSystemTime
GetCurrentProcessId
GlobalFree
CopyFileW
GlobalSize
GlobalAlloc
FormatMessageW
LocalFree
GlobalLock
GlobalUnlock
MulDiv
SuspendThread
ResumeThread
GetThreadPriority
SetThreadPriority
CompareStringW
ActivateActCtx
DeactivateActCtx
SetLastError
GetModuleHandleW
GetVersionExW
FreeResource
lstrcmpW
FreeLibrary
GetCurrentThreadId
GlobalGetAtomNameW
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetTickCount
InterlockedDecrement
InterlockedIncrement
WritePrivateProfileStringW
GetExitCodeThread
TerminateThread
GetModuleFileNameW
CreateFileW
GetFileSize
ReadFile
LoadLibraryW
GetProcAddress
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenW
OutputDebugStringW
LoadResource
LockResource
SizeofResource
FindResourceW
MultiByteToWideChar
GetLastError
Sleep
SetEvent
CreateEventW
WaitForSingleObject
CreateThread
CloseHandle
DeleteCriticalSection
user32
GetWindowContextHelpId
SetWindowContextHelpId
SendNotifyMessageW
GetForegroundWindow
SetForegroundWindow
ShowCaret
HideCaret
SetCaretPos
GetCaretPos
CreateCaret
GetClipboardViewer
GetClipboardOwner
GetOpenClipboardWindow
OpenClipboard
SetClipboardViewer
ChangeClipboardChain
FlashWindow
WindowFromPoint
SetParent
GetLastActivePopup
FindWindowExW
FindWindowW
ChildWindowFromPointEx
ChildWindowFromPoint
ShowScrollBar
GetNextDlgTabItem
GetNextDlgGroupItem
DlgDirSelectComboBoxExW
DlgDirSelectExW
DlgDirListComboBoxW
DlgDirListW
GetDesktopWindow
SetCapture
GetActiveWindow
DrawCaption
DrawAnimatedRects
EnableScrollBar
RedrawWindow
LockWindowUpdate
GetDCEx
ShowOwnedPopups
IsWindowVisible
ValidateRgn
ValidateRect
InvalidateRgn
InvalidateRect
GetUpdateRgn
GetUpdateRect
UpdateWindow
ReleaseDC
GetWindowDC
GetDC
EndPaint
BeginPaint
ClientToScreen
BringWindowToTop
GetWindowRgn
SetWindowRgn
ArrangeIconicWindows
IsZoomed
IsIconic
HiliteMenuItem
GetSystemMenu
DrawMenuBar
DragDetect
CheckMenuRadioItem
GetMenuContextHelpId
SetMenuContextHelpId
LoadMenuIndirectW
LoadMenuW
SetMenuItemBitmaps
RemoveMenu
ModifyMenuW
InsertMenuItemW
InsertMenuW
GetSubMenu
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuStringW
GetMenuState
GetMenuItemID
GetMenuItemCount
GetMenuDefaultItem
SetMenuDefaultItem
EnableMenuItem
CheckMenuItem
AppendMenuW
DeleteMenu
IsMenu
NotifyWinEvent
CreateMenu
ScrollDC
GrayStringW
GetTabbedTextExtentW
DrawTextExW
TabbedTextOutW
GetWindowThreadProcessId
DrawFrameControl
DrawEdge
DrawStateW
DrawIcon
GetCursorPos
FrameRect
FillRect
ExcludeUpdateRgn
WindowFromDC
LoadBitmapW
GetSysColorBrush
RegisterWindowMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
PeekMessageW
DispatchMessageW
GetFocus
SetActiveWindow
SetFocus
AdjustWindowRectEx
ScreenToClient
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
ScrollWindow
GetWindowRect
GetScrollInfo
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
DestroyMenu
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
GetParent
GetWindow
DestroyIcon
CharUpperW
PostThreadMessageW
PostMessageW
GetSystemMetrics
GetCapture
WinHelpW
TrackPopupMenuEx
TrackPopupMenu
SetWindowPlacement
GetWindowPlacement
GetDlgItem
GetWindowTextLengthW
GetWindowTextW
GetKeyState
DestroyWindow
SendMessageW
GetDlgCtrlID
SetWindowsHookExW
CallNextHookEx
EnableWindow
MapDialogRect
LoadCursorW
CloseWindow
OpenIcon
GetMenuCheckMarkDimensions
CheckDlgButton
CheckRadioButton
GetDlgItemInt
GetDlgItemTextW
SetDlgItemInt
SetDlgItemTextW
IsDlgButtonChecked
ScrollWindowEx
IsDialogMessageW
GetClassLongW
GetClassNameW
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
SetMenu
GetMenu
GetMessageTime
SetWindowTextW
MoveWindow
ShowWindow
IsWindowEnabled
SetRectEmpty
CreatePopupMenu
PostQuitMessage
PeekMessageA
IsWindowUnicode
GetMessageA
DispatchMessageA
SubtractRect
UnionRect
IntersectRect
InflateRect
SetRect
DrawTextW
GetSysColor
SetTimer
KillTimer
LoadImageW
SetWindowPos
SetWindowLongW
GetWindowLongW
IsWindow
GetMessagePos
TranslateMessage
GetMessageW
RegisterClipboardFormatW
CreateDialogIndirectParamW
GetKeyNameTextW
MapVirtualKeyW
LoadAcceleratorsW
TranslateAcceleratorW
ReleaseCapture
InvertRect
SetCursor
EndDialog
GetClipboardFormatNameA
GetClipboardFormatNameW
RealChildWindowFromPoint
SystemParametersInfoW
GetAsyncKeyState
EnumDisplayMonitors
SetLayeredWindowAttributes
CharNextW
CopyAcceleratorTableW
MessageBeep
GetDialogBaseUnits
MonitorFromPoint
UpdateLayeredWindow
UnregisterClassW
GetIconInfo
CopyImage
DrawIconEx
DestroyAcceleratorTable
CreateAcceleratorTableW
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
SetCursorPos
SetClassLongW
SetClipboardData
CloseClipboard
EmptyClipboard
PtInRect
OffsetRect
MsgWaitForMultipleObjectsEx
DestroyCursor
EnumChildWindows
InSendMessage
GetDoubleClickTime
IsClipboardFormatAvailable
DefMDIChildProcW
TranslateMDISysAccel
DefFrameProcW
MapVirtualKeyExW
IsCharLowerW
WaitMessage
CharUpperBuffW
IsRectEmpty
DrawFocusRect
CopyIcon
gdi32
GetPaletteEntries
SetPaletteEntries
AnimatePalette
GetNearestPaletteIndex
ResizePalette
CreateRectRgn
CreateRectRgnIndirect
CreateEllipticRgn
CreateEllipticRgnIndirect
CreatePolygonRgn
CreatePolyPolygonRgn
CreateRoundRectRgn
PathToRegion
ExtCreateRegion
GetRegionData
SetRectRgn
CombineRgn
EqualRgn
OffsetRgn
GetRgnBox
PtInRegion
RectInRegion
CreateDCW
CreateICW
GetDeviceCaps
GetBrushOrgEx
SetBrushOrgEx
EnumObjects
GetNearestColor
RealizePalette
UpdateColors
GetBkColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextColor
GetMapMode
GetGraphicsMode
GetWorldTransform
GetViewportOrgEx
GetViewportExtEx
GetWindowOrgEx
GetWindowExtEx
DPtoLP
LPtoDP
FillRgn
FrameRgn
InvertRgn
PaintRgn
PtVisible
RectVisible
GetCurrentPositionEx
Arc
Polyline
Chord
Ellipse
Pie
Polygon
PolyPolygon
Rectangle
RoundRect
PatBlt
StretchBlt
GetPixel
SetPixel
FloodFill
ExtFloodFill
TextOutW
ExtTextOutW
GetTextExtentPoint32W
GetTextAlign
GetTextFaceW
GetTextMetricsW
GetTextCharacterExtra
GetCharWidthW
GetFontLanguageInfo
GetCharacterPlacementW
GetAspectRatioFilterEx
Escape
SetBoundsRect
GetBoundsRect
ResetDCW
GetOutlineTextMetricsW
GetCharABCWidthsW
GetFontData
GetKerningPairsW
CreateHalftonePalette
StartDocW
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
MaskBlt
PlgBlt
SetPixelV
AngleArc
GetArcDirection
PolyPolyline
GetColorAdjustment
GetCurrentObject
PolyBezier
DrawEscape
ExtEscape
GetCharABCWidthsFloatW
GetCharWidthFloatW
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetMiterLimit
GetPath
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
GdiComment
PlayEnhMetaFile
CreateMetaFileW
CloseMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
SaveDC
RestoreDC
SelectPalette
SetPolyFillMode
SetROP2
SetStretchBltMode
SetGraphicsMode
SetWorldTransform
ModifyWorldTransform
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
MoveToEx
LineTo
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetLayout
SetLayout
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
PolyBezierTo
GetClipRgn
SelectClipPath
CreatePalette
CreateDiscardableBitmap
GetBitmapDimensionEx
ExtSelectClipRgn
PlayMetaFileRecord
EnumMetaFile
PlayMetaFile
CopyMetaFileW
StretchDIBits
EnumFontFamiliesW
GetTextCharsetInfo
CreateDIBitmap
CreateDIBSection
SetBitmapDimensionEx
GetBitmapBits
SetBitmapBits
CreateBitmapIndirect
CreateBitmap
CreateFontW
CreateFontIndirectW
CreateDIBPatternBrushPt
CreatePatternBrush
CreateBrushIndirect
CreateHatchBrush
CreateSolidBrush
ExtCreatePen
CreatePenIndirect
CreatePen
GetObjectType
DeleteDC
UnrealizeObject
GetStockObject
SetBkColor
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
SetBkMode
SelectObject
GetGlyphOutlineW
GetTextExtentPointW
DeleteMetaFile
SetDIBColorTable
GetDIBits
EnumFontFamiliesExW
GetSystemPaletteEntries
SetTextColor
msimg32
AlphaBlend
GradientFill
TransparentBlt
comdlg32
GetFileTitleW
winspool.drv
GetJobW
OpenPrinterW
DocumentPropertiesW
ClosePrinter
advapi32
RegEnumKeyW
RevertToSelf
RegCloseKey
RegQueryValueExW
RegSetValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueW
SetFileSecurityW
GetFileSecurityW
RegEnumValueW
RegEnumKeyExW
SetThreadToken
OpenThreadToken
shell32
ShellExecuteW
SHBrowseForFolderW
DragAcceptFiles
DragFinish
DragQueryFileW
SHGetFileInfoW
ShellExecuteExW
SHGetMalloc
SHAppBarMessage
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
ExtractIconW
SHAddToRecentDocs
comctl32
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_GetIcon
ImageList_GetImageCount
ImageList_DrawEx
InitCommonControlsEx
ImageList_GetIconSize
shlwapi
PathIsUNCW
PathStripToRootW
PathRemoveExtensionW
PathFindFileNameW
PathFindExtensionW
PathRemoveFileSpecW
ole32
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
StgIsStorageFile
StgOpenStorage
StgCreateDocfile
CoGetMalloc
DoDragDrop
GetClassFile
CreateFileMoniker
CreateGenericComposite
CreateItemMoniker
CreateStreamOnHGlobal
OleFlushClipboard
OleSetClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CoRegisterClassObject
CoRegisterMessageFilter
CreateILockBytesOnHGlobal
CreateOleAdviseHolder
CreateDataAdviseHolder
CoReleaseMarshalData
CoMarshalInterface
CoUnmarshalInterface
CoTaskMemFree
OleDuplicateData
CreateBindCtx
OleTranslateAccelerator
IsAccelerator
OleLockRunning
OleSetMenuDescriptor
OleSetContainedObject
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateFromFile
OleCreateLinkToFile
OleCreate
OleLoad
OleSave
StgIsStorageILockBytes
GetHGlobalFromILockBytes
OleGetIconOfClass
WriteClassStm
OleSaveToStream
OleIsRunning
OleQueryCreateFromData
OleQueryLinkFromData
OleGetClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleRegEnumVerbs
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleRun
CoInitialize
CoUninitialize
CoInitializeEx
PropVariantCopy
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CLSIDFromProgID
CoCreateGuid
CLSIDFromString
StringFromGUID2
OleRegGetMiscStatus
CoCreateInstance
CoDisconnectObject
ReleaseStgMedium
CoTaskMemAlloc
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
GetRunningObjectTable
oleaut32
SysAllocStringLen
SysStringByteLen
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayRedim
SafeArrayCreate
VariantCopy
SysReAllocStringLen
VarCyFromStr
VarBstrFromCy
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetElement
VariantInit
SysStringLen
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
VarBstrFromDec
VarDecFromStr
VarDateFromStr
VarBstrFromDate
RegisterTypeLi
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
DosDateTimeToVariantTime
VarUdateFromDate
VarDateFromUdate
SystemTimeToVariantTime
VariantChangeType
VariantClear
SafeArrayPtrOfIndex
SysFreeString
GetErrorInfo
SetErrorInfo
SysAllocStringByteLen
SysAllocString
SafeArrayPutElement
CreateErrorInfo
VariantTimeToSystemTime
oledlg
OleUIPasteSpecialW
OleUIUpdateLinksW
OleUIEditLinksW
OleUIChangeIconW
OleUIConvertW
OleUIInsertObjectW
OleUIBusyW
gdiplus
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageI
GdipGetImageGraphicsContext
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipCloneImage
GdipFree
GdipDisposeImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
setupapi
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiOpenDevRegKey
oleacc
LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow
imm32
ImmGetOpenStatus
ImmGetContext
ImmReleaseContext
winmm
PlaySoundW
Sections
.textbss Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 818KB - Virtual size: 817KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 669KB - Virtual size: 669KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 278KB - Virtual size: 278KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ