Static task
static1
Behavioral task
behavioral1
Sample
c3ff92a739e0f96ea2bb3fb1f0f58cd56936d57cb8de43f5b795b0eafc21b7e8.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
c3ff92a739e0f96ea2bb3fb1f0f58cd56936d57cb8de43f5b795b0eafc21b7e8.exe
Resource
win10v2004-20230915-en
General
-
Target
c3ff92a739e0f96ea2bb3fb1f0f58cd56936d57cb8de43f5b795b0eafc21b7e8
-
Size
9.7MB
-
MD5
9f050170f60914086640540971db4ab9
-
SHA1
258c9554db1573d2ab977cc71a8f28c930382afb
-
SHA256
c3ff92a739e0f96ea2bb3fb1f0f58cd56936d57cb8de43f5b795b0eafc21b7e8
-
SHA512
abff823e353ef8933763da3417ed508f8f9762f9deb520b7906de9610edff37defa9f1b517ff5907592abf068c2c0f0f6592aee69e74965840626cdc12fd42d9
-
SSDEEP
196608:2/hm6fsilA4BEF4WWRxwJgMTLMIj1KLogJF4DDggbQc:OHfsiO4BEFh0dIQMWWDDggbx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c3ff92a739e0f96ea2bb3fb1f0f58cd56936d57cb8de43f5b795b0eafc21b7e8
Files
-
c3ff92a739e0f96ea2bb3fb1f0f58cd56936d57cb8de43f5b795b0eafc21b7e8.exe windows:6 windows x86
107d76bbf9c17cf9582aa17a3d63f0a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoCreateGuid
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize
IIDFromString
StringFromGUID2
CoTaskMemAlloc
OleRun
OleSetContainedObject
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
shell32
FindExecutableA
SHGetFolderPathA
SHGetFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
CommandLineToArgvW
SHGetFolderPathW
wininet
HttpQueryInfoA
InternetErrorDlg
InternetCrackUrlA
HttpOpenRequestA
InternetOpenA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetReadFile
user32
EnumWindows
PostMessageA
MessageBoxW
IsWindowUnicode
GetMessageA
DispatchMessageA
SetWindowLongA
GetWindowLongA
DefWindowProcA
CreateWindowExA
TranslateMessage
PostQuitMessage
RegisterClassExA
GetAncestor
CharNextA
wsprintfA
ReleaseDC
GetParent
PeekMessageA
MsgWaitForMultipleObjectsEx
DispatchMessageW
GetMessageW
LoadStringA
MessageBoxA
AdjustWindowRectEx
GetClassInfoExW
EnableMenuItem
GetDesktopWindow
GetClientRect
SetWindowLongW
SendMessageA
ShowWindow
RegisterClassExW
SetWindowTextW
CreateWindowExW
GetWindowThreadProcessId
GetFocus
IsChild
SetFocus
SetRect
GetWindowLongW
DefWindowProcW
GetSystemMenu
SetWindowPos
GetWindowRect
LoadCursorA
DestroyWindow
GetDC
comctl32
InitCommonControlsEx
kernel32
VirtualProtect
VirtualAlloc
GetSystemInfo
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetModuleFileNameW
LCMapStringW
GetStdHandle
EncodePointer
GetModuleHandleW
CreateDirectoryW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
GetStringTypeW
WriteConsoleW
GetConsoleCP
GetConsoleMode
CreateThread
ExitThread
VirtualQuery
CompareStringW
GetFileType
GetLocaleInfoW
FreeLibraryAndExitThread
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
SetStdHandle
IsValidLocale
EnumSystemLocalesW
HeapAlloc
HeapSize
DeleteFileW
GetSystemTimeAsFileTime
HeapReAlloc
HeapFree
GetModuleFileNameA
SizeofResource
GetCommandLineW
LoadLibraryExA
InitializeCriticalSectionAndSpinCount
FindResourceA
lstrcmpA
GetModuleHandleA
GetCommandLineA
MultiByteToWideChar
GetLastError
SetDllDirectoryA
RaiseException
IsDBCSLeadByte
LoadResource
DecodePointer
DeleteCriticalSection
FreeLibrary
WideCharToMultiByte
lstrcmpiA
Process32First
WriteFile
lstrlenA
lstrcatA
CreateToolhelp32Snapshot
GetTempPathA
CreateFileA
GetSystemDirectoryA
LockResource
DeleteFileA
Process32Next
lstrcpyA
CloseHandle
FindResourceW
lstrcpynA
CreateDirectoryA
LocalFree
ReadFile
MulDiv
LocalAlloc
GetCurrentThreadId
FormatMessageA
Sleep
GetUserDefaultLCID
SetEvent
CreateEventA
FileTimeToSystemTime
SetEndOfFile
SetFilePointerEx
FindFirstFileA
TerminateProcess
FindClose
WaitForSingleObject
GetLocaleInfoA
OpenProcess
GetWindowsDirectoryA
ExitProcess
SetLastError
GetDriveTypeA
FindNextFileA
GetFileAttributesA
MoveFileExA
SetFileAttributesA
RemoveDirectoryA
GetTickCount
OpenMutexA
LoadLibraryExW
GetCurrentProcess
GetModuleHandleExW
GetNativeSystemInfo
GetSystemWow64DirectoryA
FormatMessageW
GetLocalTime
GetCurrentProcessId
GetSystemDefaultUILanguage
GetThreadLocale
QueryPerformanceFrequency
QueryPerformanceCounter
UnmapViewOfFile
FlushViewOfFile
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
GetExitCodeThread
OpenThread
SetHandleInformation
CreatePipe
PeekNamedPipe
CreateProcessA
GetExitCodeProcess
GetModuleHandleExA
LoadLibraryW
CreateMutexA
ReleaseMutex
CreateFileW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
IsDebuggerPresent
OutputDebugStringW
GetFileSizeEx
FlushFileBuffers
ReadConsoleW
GetCurrentDirectoryW
GetTimeZoneInformation
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetProcAddress
GetUserDefaultUILanguage
advapi32
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegQueryValueExA
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegEnumKeyExA
CryptAcquireContextA
CryptCreateHash
ConvertSidToStringSidA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
OpenProcessToken
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorA
oleaut32
VarUI4FromStr
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
SysAllocString
VariantInit
SysStringByteLen
GetErrorInfo
VariantCopy
shlwapi
ord12
SHDeleteKeyA
PathIsDirectoryEmptyA
PathAppendA
gdi32
GetDeviceCaps
iphlpapi
GetAdaptersAddresses
crypt32
CryptProtectData
CryptStringToBinaryA
CryptBinaryToStringA
CryptUnprotectData
version
VerQueryValueW
GetFileVersionInfoA
GetFileVersionInfoSizeA
msi
ord158
ord204
ord44
ord141
ord115
ord159
ord189
ord137
ord117
ord168
ord31
ord160
ord91
ord87
ord67
ord8
Sections
.text Size: 586KB - Virtual size: 585KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 221KB - Virtual size: 220KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 55.2MB - Virtual size: 55.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ