Static task
static1
Behavioral task
behavioral1
Sample
23b17ea7beabc5917f5664d863c51683b7b25bb47b98984878eb7f65d2017034.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
23b17ea7beabc5917f5664d863c51683b7b25bb47b98984878eb7f65d2017034.exe
Resource
win10v2004-20230915-en
General
-
Target
23b17ea7beabc5917f5664d863c51683b7b25bb47b98984878eb7f65d2017034
-
Size
4.8MB
-
MD5
3c6c7af374fc721b58a31dba54aff4e6
-
SHA1
5082145218b87d7432e87426478083d47f53c84b
-
SHA256
23b17ea7beabc5917f5664d863c51683b7b25bb47b98984878eb7f65d2017034
-
SHA512
a1ef14e07e307a410bd1fce8526dc8842573a79ed496db5aefdfe2d690159b99050671932cd7824173b18e21efee8f14b80f03bbcc32f4352e3a4420b58da599
-
SSDEEP
98304:6vBSvMCviQa7IKsJUzyGhUUk3P6uwAmmr3vLgj9HMSzkIankCRznPImrz:+BSvGQa7gJUm+uwANrfA+NVRDPImrz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23b17ea7beabc5917f5664d863c51683b7b25bb47b98984878eb7f65d2017034
Files
-
23b17ea7beabc5917f5664d863c51683b7b25bb47b98984878eb7f65d2017034.exe windows:5 windows x86
a88f8d2749aa1cc78a21d4a5363d05af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
lstrlenA
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
GetCurrentDirectoryA
PeekNamedPipe
GetFullPathNameA
GetDriveTypeA
QueryDosDeviceW
GetVolumeNameForVolumeMountPointW
GetDiskFreeSpaceExW
GlobalAddAtomW
FindAtomW
GetSystemTime
TerminateProcess
GetCurrentThread
GetLogicalDriveStringsW
GetCurrentThreadId
GetWindowsDirectoryW
GetDriveTypeW
GlobalAlloc
GlobalFree
GetTickCount
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
LeaveCriticalSection
EnterCriticalSection
GetFullPathNameW
SetLastError
FormatMessageA
ExpandEnvironmentStringsA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
FreeResource
GetSystemWindowsDirectoryW
lstrcmpiA
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetLocaleInfoW
lstrlenW
GetConsoleOutputCP
WriteConsoleA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
HeapCreate
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
GetStartupInfoW
ExitProcess
CreateProcessW
GlobalDeleteAtom
CreateMutexW
PostQueuedCompletionStatus
GetCurrentProcess
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateThread
TerminateThread
MulDiv
OutputDebugStringW
GetFileSizeEx
CompareFileTime
OpenProcess
GetVolumeInformationW
GetLocalTime
lstrcpyW
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FindFirstFileW
FindNextFileW
FindClose
LocalAlloc
CopyFileW
MoveFileW
MoveFileExW
GetPrivateProfileStringW
GlobalFindAtomW
GetFileAttributesW
WriteFile
CreateDirectoryW
GetTempPathW
GetTempFileNameW
WritePrivateProfileStringW
SetFileAttributesW
InterlockedDecrement
RemoveDirectoryW
DeleteFileW
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
GetSystemDirectoryW
GlobalMemoryStatusEx
GetModuleHandleA
GetSystemInfo
InterlockedCompareExchange
Sleep
GetVersionExW
GetVersion
GetModuleHandleW
GetProcAddress
InterlockedExchange
ReadFile
SetFilePointer
GetCurrentProcessId
CreateFileW
DeviceIoControl
LoadLibraryW
InterlockedIncrement
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
WaitForSingleObject
FreeLibrary
LocalFree
FindResourceExW
FindResourceW
LoadResource
LockResource
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
ExitThread
TlsFree
ReleaseMutex
HeapWalk
HeapLock
OpenThread
HeapUnlock
SetFilePointerEx
GetSystemTimeAsFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapSize
HeapReAlloc
HeapDestroy
TlsAlloc
LockFile
GetStdHandle
SetConsoleTextAttribute
GetFileInformationByHandle
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileAttributesA
TlsGetValue
TlsSetValue
ResetEvent
SetEvent
CreateEventW
ReadProcessMemory
OpenMutexW
GetExitCodeProcess
GetLongPathNameW
MapViewOfFile
LockFileEx
GetFileAttributesExW
UnlockFile
FindNextFileA
FindFirstFileA
FormatMessageW
SetFileTime
SetEndOfFile
FlushInstructionCache
WideCharToMultiByte
UnmapViewOfFile
GetFileSize
CreateFileMappingW
GetEnvironmentVariableW
WriteConsoleW
SizeofResource
user32
wvsprintfW
PostMessageW
GetActiveWindow
SendMessageW
SendMessageTimeoutW
FindWindowW
CharNextW
IsWindow
EnableWindow
GetDlgItem
IsWindowEnabled
ShowWindow
SetDlgItemTextW
IsWindowVisible
SetForegroundWindow
EndDialog
GetWindowLongW
SetWindowTextW
MoveWindow
SetWindowPos
GetClientRect
ScreenToClient
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindowRect
GetWindow
GetParent
GetDC
ReleaseDC
UnregisterClassA
ExitWindowsEx
wsprintfW
SetWindowLongW
GetWindowTextW
FindWindowExW
BringWindowToTop
SetTimer
KillTimer
IsDialogMessageW
OffsetRect
SetFocus
GetWindowTextLengthW
SetWindowRgn
RedrawWindow
CopyRect
DefWindowProcW
CallWindowProcW
BeginPaint
EndPaint
DialogBoxParamW
EnableMenuItem
DestroyWindow
GetSystemMenu
GetClassInfoExW
LoadCursorW
InflateRect
PostQuitMessage
IsIconic
SystemParametersInfoW
InvalidateRect
LoadIconW
RegisterClassExW
CreateWindowExW
LoadImageW
GetSystemMetrics
CreateDialogParamW
DispatchMessageW
TranslateMessage
GetShellWindow
GetWindowThreadProcessId
PostThreadMessageW
UpdateLayeredWindow
UpdateWindow
PeekMessageW
GetMessageW
MessageBoxW
gdi32
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteDC
CombineRgn
CreateRectRgn
SetViewportOrgEx
DeleteObject
advapi32
RegCloseKey
ImpersonateLoggedOnUser
RevertToSelf
OpenProcessToken
DuplicateTokenEx
GetSecurityDescriptorSacl
IsValidSid
CopySid
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenThreadToken
ImpersonateSelf
AllocateAndInitializeSid
FreeSid
GetSecurityInfo
SetSecurityInfo
RegQueryValueExW
RegQueryInfoKeyW
GetExplicitEntriesFromAclW
GetTrusteeNameW
DeleteAce
LookupAccountSidW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW
CryptCreateHash
RegDeleteKeyW
GetUserNameW
LookupAccountNameW
GetFileSecurityW
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityW
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetEntriesInAclW
SetNamedSecurityInfoW
CryptHashData
RegOpenKeyExA
RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumValueA
ChangeServiceConfigW
ControlService
GetTokenInformation
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptDestroyHash
CryptGetHashParam
shell32
SHGetSpecialFolderPathA
CommandLineToArgvW
ShellExecuteW
ord680
SHFileOperationW
SHChangeNotify
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHCreateDirectoryExW
ord165
SHBrowseForFolderW
ole32
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
CoTaskMemFree
OleRun
oleaut32
VariantChangeType
SysAllocStringLen
VarUI4FromStr
SysStringByteLen
VariantClear
VariantInit
SysFreeString
SysStringLen
SysAllocString
SysAllocStringByteLen
shlwapi
PathAddBackslashW
PathIsDirectoryW
PathCommonPrefixW
StrStrIA
StrCmpNIW
PathRemoveArgsW
PathFindFileNameW
PathRemoveExtensionW
StrCatW
StrCpyW
PathIsPrefixW
PathIsDirectoryEmptyW
PathIsSameRootW
PathCombineA
PathUnquoteSpacesW
SHSetValueW
PathFileExistsW
SHGetValueW
SHDeleteValueW
PathFileExistsA
SHGetValueA
PathCombineW
PathAppendW
PathIsRelativeW
SHDeleteKeyW
StrStrIW
PathRemoveFileSpecW
SHSetValueA
wnsprintfW
PathAppendA
StrTrimA
StrCmpIW
PathFindExtensionW
comctl32
InitCommonControlsEx
crypt32
CertDeleteCertificateFromStore
CertCompareCertificate
CertDuplicateCertificateContext
CertCloseStore
CertGetNameStringW
CertEnumCertificatesInStore
CertOpenStore
CryptStringToBinaryA
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CertGetNameStringA
CryptQueryObject
CertAddCertificateContextToStore
CertFindCertificateInStore
CertCreateCertificateChainEngine
CertFreeCertificateContext
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
psapi
EnumProcesses
GetProcessImageFileNameW
GetModuleFileNameExW
rpcrt4
RpcBindingFree
RpcStringFreeW
RpcBindingFromStringBindingW
NdrServerCall2
RpcStringBindingComposeW
NdrAsyncServerCall
NdrClientCall2
NdrAsyncClientCall
gdiplus
GdiplusStartup
GdiplusShutdown
GdipDrawImageRectRectI
GdipDrawImagePointRectI
GdipCreateFromHDC
GdipDeleteGraphics
GdipCloneImage
GdipDrawImageRectRect
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipAlloc
GdipFree
urlmon
URLDownloadToFileW
URLDownloadToCacheFileW
iphlpapi
GetAdaptersInfo
wininet
InternetGetConnectedState
InternetCrackUrlW
InternetOpenW
HttpSendRequestW
InternetConnectW
InternetQueryOptionW
InternetSetOptionW
HttpQueryInfoW
InternetCloseHandle
HttpOpenRequestW
netapi32
NetApiBufferFree
NetWkstaGetInfo
setupapi
SetupIterateCabinetW
ws2_32
__WSAFDIsSet
WSAGetLastError
select
recv
WSASetLastError
send
closesocket
Sections
.text Size: 706KB - Virtual size: 706KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 54KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8.0MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ