Static task
static1
Behavioral task
behavioral1
Sample
gwhtcjuo0pl2ubwr.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
gwhtcjuo0pl2ubwr.exe
Resource
win10v2004-20230915-en
General
-
Target
gwhtcjuo0pl2ubwr.exe
-
Size
8.1MB
-
MD5
5794ee2d32154087a4a00bf6bd860fe4
-
SHA1
4f198fb1008e7b8e689defed21035275fa2a4279
-
SHA256
394802e57b4fd3ba7ceeb6b8c96db968eccce230228ee07cb97b1acac64af85a
-
SHA512
84a4b4a15d29ae64dd626699d468db791f6179567ec6779620591f3e38dba02674a4ff007cb92320d610917e98996d7e8b6e0aaf8b927978bfc8a25103451432
-
SSDEEP
196608:zFymDKy4FKmxtbiP9g84QRH31V6YuciOl96ZHNqh1Qcf2Z:1LmPeZ4QRHFUaX5+c+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource gwhtcjuo0pl2ubwr.exe
Files
-
gwhtcjuo0pl2ubwr.exe.exe windows:6 windows x64
9ac18b41406e7280d31763eb7b823289
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d9
Direct3DCreate9
d3dx9_43
D3DXCreateTextureFromFileInMemory
kernel32
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFullPathNameW
GetCurrentDirectoryW
SetEndOfFile
SetStdHandle
HeapReAlloc
FlushFileBuffers
EnumSystemLocalesW
FreeEnvironmentStringsW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
SetEnvironmentVariableW
GetProcessHeap
CreateFileW
DeleteFileW
GetConsoleMode
GetModuleFileNameW
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetTimeZoneInformation
HeapSize
WriteConsoleW
CloseHandle
GetUserDefaultLCID
GetDriveTypeW
GetFileAttributesExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
GetStringTypeW
GetTempPathW
WriteFile
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetModuleHandleA
ExitProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetSystemDirectoryW
GetModuleHandleW
LoadLibraryW
Sleep
GetLastError
SetLastError
FormatMessageW
MoveFileExW
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx
VerifyVersionInfoW
GetFileSizeEx
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InitOnceComplete
InitOnceBeginInitialize
EncodePointer
DecodePointer
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
SetCapture
GetForegroundWindow
TrackMouseEvent
ClientToScreen
GetCapture
ScreenToClient
LoadCursorA
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
UpdateWindow
SetCursor
PeekMessageA
TranslateMessage
DefWindowProcA
MoveWindow
MessageBoxA
ShowWindow
RegisterClassExW
UnregisterClassW
GetSystemMetrics
CreateWindowExW
SetWindowRgn
MessageBoxW
DestroyWindow
GetWindowRect
DispatchMessageA
GetClientRect
PostQuitMessage
SetWindowPos
GetCursorPos
SetCursorPos
ReleaseCapture
IsWindowUnicode
gdi32
CreateRoundRectRgn
shell32
ShellExecuteW
imm32
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow
bcrypt
BCryptGenRandom
ws2_32
send
gethostname
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
inet_ntop
WSAStartup
WSACleanup
setsockopt
WSAIoctl
htons
socket
inet_pton
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
ioctlsocket
getsockopt
crypt32
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertGetNameStringW
CryptStringToBinaryW
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
PFXImportCertStore
advapi32
CryptGetHashParam
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
CryptAcquireContextW
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 479KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lPz Size: 512B - Virtual size: 256B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.c.; Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.nQB Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.;VE Size: 8.1MB - Virtual size: 8.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ