Static task
static1
Behavioral task
behavioral1
Sample
96e91a8449f8eee97a083e4175a87ec7822fdcc11b77b5b03450805457349d8f.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
96e91a8449f8eee97a083e4175a87ec7822fdcc11b77b5b03450805457349d8f.exe
Resource
win10v2004-20230915-en
General
-
Target
96e91a8449f8eee97a083e4175a87ec7822fdcc11b77b5b03450805457349d8f
-
Size
368KB
-
MD5
e6e6d9a14599f3164b7a6568f56cb269
-
SHA1
ceb5c718f5f0eb57528a1759cad5b0a787aad1cb
-
SHA256
96e91a8449f8eee97a083e4175a87ec7822fdcc11b77b5b03450805457349d8f
-
SHA512
a7f1fdcfe09de9dd811b25ccfd2dc3212036e843a8872a92bab79410d2a236f987bf2ce2875984eaae12351bc29e0a73471c2df1d29c56d1958fe698e0e14027
-
SSDEEP
3072:804bp8PrsMN3lVX4D2Yy2JAAG1kaZMP6VcJGbpQLffYWVYGjhTPt+rjjM:8HbirsM3l+2wmk9P2nbpufg4Wjo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96e91a8449f8eee97a083e4175a87ec7822fdcc11b77b5b03450805457349d8f
Files
-
96e91a8449f8eee97a083e4175a87ec7822fdcc11b77b5b03450805457349d8f.exe windows:4 windows x86
41bde7e296ed20c37e477bd256a1b6dc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindFileNameW
psapi
EnumProcesses
GetProcessImageFileNameW
msimg32
GradientFill
kernel32
GetLogicalDriveStringsW
CreateProcessA
CreateThread
GetLastError
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
LocalAlloc
GetCurrentProcess
SetLastError
GetEnvironmentVariableW
lstrcatW
lstrcpyW
GetShortPathNameW
GetModuleFileNameW
lstrlenW
Sleep
TerminateProcess
OpenProcess
GetCurrentProcessId
GetModuleHandleW
CreateProcessW
CopyFileW
GetFullPathNameW
LoadLibraryW
AllocConsole
GetVersionExW
CreateMutexW
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GlobalMemoryStatus
FreeLibrary
GetProcAddress
GetDriveTypeW
GetStringTypeW
GetStringTypeA
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryA
InitializeCriticalSection
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
MultiByteToWideChar
InterlockedDecrement
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
ExitThread
FindFirstFileW
FindNextFileW
FindClose
DeleteFileW
CreateFileW
GetFileSize
CloseHandle
ReadFile
SetFilePointer
WriteFile
MoveFileW
GetSystemTimeAsFileTime
GetLocalTime
CreateFileA
SetEndOfFile
GetLocaleInfoA
TlsAlloc
TlsGetValue
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoW
HeapFree
HeapAlloc
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
GetProcessHeap
user32
CloseClipboard
PostMessageW
SetClipboardData
EmptyClipboard
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
RegisterClassExW
ShowWindow
PostQuitMessage
EnableWindow
DefWindowProcW
UpdateWindow
SendMessageW
PtInRect
SetCursor
DrawIconEx
OpenClipboard
EnableMenuItem
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
DialogBoxIndirectParamW
BeginPaint
EndPaint
DestroyWindow
EndDialog
GetWindowTextA
MessageBoxW
CreateWindowExW
GetDC
ReleaseDC
SystemParametersInfoW
GetClientRect
DrawTextW
GetSystemMenu
gdi32
RoundRect
GetDIBits
CreateCompatibleDC
SetBkMode
SetTextColor
DeleteDC
CreateFontW
SelectObject
GetStockObject
DeleteObject
CreateCompatibleBitmap
advapi32
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
shell32
SHGetFolderPathW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
ole32
CoInitializeEx
CoCreateInstance
wininet
InternetCloseHandle
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetSetCookieW
InternetOpenA
Sections
.text Size: 216KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 804B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ