Static task
static1
Behavioral task
behavioral1
Sample
87715c2487765488d72919a3720f11806592fe1018aa5c95aaf9fd13fb041f20.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
87715c2487765488d72919a3720f11806592fe1018aa5c95aaf9fd13fb041f20.exe
Resource
win10v2004-20230915-en
General
-
Target
0bff47833c0ddb262bc2152e040381e2.bin
-
Size
151KB
-
MD5
44ce1a08529c0940bbfcfe0178b16e3b
-
SHA1
9d993fda945b027e78e3030039fed3b10d78544f
-
SHA256
c8f14ed0dd3ef5f083be31ea2af0b114789cb64b5b70a4d840086bc49eb0c92e
-
SHA512
ad66078db6d647bfa2b4f58e82fadfd5cd053356a16f1d0d168c79da2edc18ebe849b50947e8477e2134d41e64b9dde260ef73070248a8d00248b801efa671b7
-
SSDEEP
3072:uUw4toUcLset9fR4bCgYloZj3OIC3n+qnzmpwQRqAWSdYN4:uUroU49fR4+gYElC3j2hRs0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/87715c2487765488d72919a3720f11806592fe1018aa5c95aaf9fd13fb041f20.bin
Files
-
0bff47833c0ddb262bc2152e040381e2.bin.zip
Password: infected
-
87715c2487765488d72919a3720f11806592fe1018aa5c95aaf9fd13fb041f20.bin.exe windows:4 windows x86
Password: infected
6aeb12dc8e948afbc175025940c8c872
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI
Imports
rpcrt4
RpcStringFreeA
RpcBindingFromStringBindingA
RpcStringBindingComposeA
NdrClientCall
RpcBindingSetAuthInfoA
shell32
SHGetPathFromIDListW
SHGetMalloc
SHChangeNotify
SHGetFolderPathW
SHFileOperationW
SHGetDesktopFolder
ShellExecuteExW
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteExA
SHGetSpecialFolderLocation
shlwapi
SHDeleteEmptyKeyW
ord195
StrRetToBufA
SHDeleteKeyW
PathRemoveBackslashW
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
kernel32
GetVersionExW
HeapSize
HeapReAlloc
HeapFree
GetModuleHandleW
HeapAlloc
HeapDestroy
GetThreadLocale
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GlobalFree
WaitForMultipleObjects
CreateEventA
GetCurrentProcess
GetVolumeInformationA
GetDriveTypeW
VirtualAlloc
VirtualFree
CreateFileW
ReadFile
WriteFile
GetCurrentProcessId
GetModuleFileNameW
GetSystemTime
GetStdHandle
user32
SetWindowLongA
SetWindowTextA
SendMessageA
GetDlgItem
wsprintfA
WaitForInputIdle
CharUpperA
MessageBoxA
DialogBoxIndirectParamA
SetDlgItemTextA
MsgWaitForMultipleObjects
CharLowerBuffA
SetFocus
BeginPaint
EndPaint
LoadStringA
FillRect
ScreenToClient
GetWindowTextLengthA
GetWindowTextA
GetWindowPlacement
SendDlgItemMessageA
GetMessageA
DefWindowProcA
GetParent
GetWindow
SystemParametersInfoA
MapWindowPoints
SetWindowPos
GetPropA
EnableMenuItem
SetPropA
RemovePropA
ShowWindow
IsWindow
GetSysColor
LoadImageA
CreateDialogParamA
GetDC
ReleaseDC
SetActiveWindow
PeekMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
CreateDialogIndirectParamA
SetForegroundWindow
GetDesktopWindow
GetClientRect
EnableWindow
IsWindowEnabled
GetWindowDC
UpdateWindow
InvalidateRect
DrawIcon
MapDialogRect
GetClassNameA
CallWindowProcA
DrawFocusRect
InflateRect
DrawTextA
CopyRect
EnumChildWindows
CreateWindowExA
RegisterClassExA
IntersectRect
GetDlgItemTextA
GetWindowLongA
GetWindowRect
MoveWindow
EndDialog
LoadIconA
gdi32
CreateCompatibleBitmap
CreateDCA
GetStockObject
GetTextExtentPoint32A
CreatePatternBrush
DeleteMetaFile
SetMetaFileBitsEx
SetStretchBltMode
SelectClipRgn
SetPixel
PatBlt
PlayMetaFile
StretchBlt
CreateBitmap
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
CreateDIBitmap
SaveDC
SetBkMode
SetTextColor
TextOutA
RestoreDC
GetTextExtentPointA
CreateFontIndirectA
SetBkColor
CreateRectRgn
DeleteObject
CreateSolidBrush
GetDIBColorTable
GetSystemPaletteEntries
CreatePalette
CreateHalftonePalette
GetDeviceCaps
GetObjectA
CreateCompatibleDC
UnrealizeObject
SelectPalette
RealizePalette
SelectObject
BitBlt
DeleteDC
SetMapMode
advapi32
RegCloseKey
RegQueryValueA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegEnumKeyA
RegOpenKeyA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
ole32
CoInitialize
CoUninitialize
setupapi
CM_Get_DevNode_Status
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
lz32
LZOpenFileA
LZCopy
LZClose
oleacc
CreateStdAccessibleObject
LresultFromObject
Sections
.text Size: 155KB - Virtual size: 155KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 254B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ