Static task
static1
Behavioral task
behavioral1
Sample
4544535187d85cf82c00b1918b46cda1afbd248dc7f1fb4339df8eab3e5a1e2f.exe
Resource
win7-20230831-en
General
-
Target
4544535187d85cf82c00b1918b46cda1afbd248dc7f1fb4339df8eab3e5a1e2f
-
Size
1.2MB
-
MD5
e6cced8ca73f4b7140d5f40b8b33cdb7
-
SHA1
55d944b5786ad5ffe58686d16efca7fa048bfca0
-
SHA256
4544535187d85cf82c00b1918b46cda1afbd248dc7f1fb4339df8eab3e5a1e2f
-
SHA512
93333dc1cb75d6f2230f06afe16e2c608d2016d49bc4d9517a861562d273be2e9e36e2f350a310550110151c32805f4cbd3c8ee714b07cc841d3d9f4c687aa2e
-
SSDEEP
24576:E0qmse3wccSqqMj4Z7BYCLVbRmUsDnpEYxky/+oBc63Fc:E0lZqvEnYCLVbYDnpU6d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4544535187d85cf82c00b1918b46cda1afbd248dc7f1fb4339df8eab3e5a1e2f
Files
-
4544535187d85cf82c00b1918b46cda1afbd248dc7f1fb4339df8eab3e5a1e2f.exe windows:6 windows x86
dd2655d36468bc13ed014e028c963a93
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventW
CloseHandle
RaiseException
DecodePointer
SetLastError
DebugBreak
Sleep
IsDebuggerPresent
EnterCriticalSection
GetCurrentProcess
LeaveCriticalSection
GetVersionExW
LocalFree
FormatMessageW
InitializeCriticalSectionEx
GetLastError
DeleteCriticalSection
WideCharToMultiByte
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SetErrorMode
SizeofResource
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryW
FileTimeToSystemTime
MultiByteToWideChar
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindNextFileW
GetFileAttributesW
GetTempPathW
GetCurrentThread
GetTickCount
GetSystemDirectoryW
lstrcmpW
DuplicateHandle
TerminateProcess
ExpandEnvironmentStringsW
LocalAlloc
VerSetConditionMask
CompareFileTime
GetFullPathNameW
OutputDebugStringW
GetModuleHandleA
GetModuleHandleW
LoadLibraryExW
lstrcmpA
VerifyVersionInfoW
GetSystemInfo
TryEnterCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetThreadTimes
FreeLibraryAndExitThread
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
ExitProcess
GetStdHandle
WriteFile
GetACP
GetFileType
LCMapStringW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
user32
MessageBoxW
advapi32
OpenProcessToken
GetTokenInformation
RegOpenCurrentUser
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
LsaNtStatusToWinError
ole32
CoUninitialize
CoInitializeSecurity
CoInitializeEx
oleaut32
SafeArrayGetVartype
SafeArrayCopy
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayCreate
VariantClear
VariantInit
SafeArrayDestroy
SysStringLen
VariantChangeType
SysAllocStringLen
SysAllocString
SysFreeString
Sections
.text Size: 346KB - Virtual size: 346KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 150KB - Virtual size: 149KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 588KB - Virtual size: 592KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE