Static task
static1
Behavioral task
behavioral1
Sample
d59e7d5b32dac961eb840d984286883de0772747986bdfc64839b519ef66be9c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d59e7d5b32dac961eb840d984286883de0772747986bdfc64839b519ef66be9c.exe
Resource
win10v2004-20230915-en
General
-
Target
d59e7d5b32dac961eb840d984286883de0772747986bdfc64839b519ef66be9c
-
Size
513KB
-
MD5
c37b203c0f0e68540f33f3ec6de682b4
-
SHA1
e2bb61260efd91d02c39f9fd0a232c5de84c4e14
-
SHA256
d59e7d5b32dac961eb840d984286883de0772747986bdfc64839b519ef66be9c
-
SHA512
3725ce811d98e6f2799aba96cf45b14359ae1134a5739bf395f4458c6aa143bc53c825775100580bf9eb49ccde083fd759ab05a72c81017b0dbfccebefc0be82
-
SSDEEP
12288:ufRE/BxWfHX4hXYtZmXeurt3PQrlNtlldRIBAq74ICS74zE6rVN4higbwQ:IaxFewPQ5lqHCS7eEUYR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d59e7d5b32dac961eb840d984286883de0772747986bdfc64839b519ef66be9c
Files
-
d59e7d5b32dac961eb840d984286883de0772747986bdfc64839b519ef66be9c.exe windows:6 windows x86
573d5d9e5016b9c9a6cc4d75f8df13c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileW
GetLocalTime
LocalFree
FormatMessageA
MoveFileW
FlushFileBuffers
GetModuleFileNameW
CopyFileW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
DeleteCriticalSection
FreeLibrary
QueryPerformanceCounter
LoadLibraryExW
SetHandleInformation
SetLastError
FindNextFileW
GetCurrentProcess
FindClose
SystemTimeToFileTime
CreateProcessW
GetCommandLineW
lstrcmpW
CreateMutexW
CreateThread
GetModuleFileNameA
GetTempPathA
HeapSize
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
SetEndOfFile
SetStdHandle
ReadConsoleW
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapFree
ExitProcess
GetLastError
SetFilePointer
OutputDebugStringA
WriteFile
GetStdHandle
GetFileSize
CloseHandle
CreateFileW
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
CreateEventW
WriteConsoleW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
CreateDirectoryW
ReadFile
user32
GetSubMenu
SetMenuDefaultItem
TrackPopupMenu
DestroyMenu
SetWindowTextW
GetDlgItem
SetWindowPos
SetActiveWindow
BringWindowToTop
LoadImageW
GetSystemMetrics
GetWindowRect
LoadMenuW
RegisterWindowMessageW
FindWindowW
SendMessageW
GetMessageW
TranslateMessage
DispatchMessageW
LoadIconW
LoadCursorW
RegisterClassExW
CreateWindowExW
DefWindowProcW
CreateDialogParamW
PostQuitMessage
GetCursorPos
DestroyWindow
ShowWindow
KillTimer
AnimateWindow
PostMessageW
EndDialog
MessageBoxW
GetForegroundWindow
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
shell32
Shell_NotifyIconW
SHGetPathFromIDListW
ShellExecuteW
CommandLineToArgvW
SHBrowseForFolderW
shlwapi
PathFileExistsW
PathIsDirectoryW
ws2_32
getsockname
send
socket
ntohs
connect
inet_ntoa
recvfrom
recv
getsockopt
listen
htons
freeaddrinfo
sendto
ioctlsocket
setsockopt
WSAGetLastError
ntohl
getpeername
WSAStartup
getaddrinfo
select
closesocket
bind
accept
__WSAFDIsSet
WSACleanup
htonl
libssl-1_1
SSL_free
OPENSSL_init_ssl
SSL_connect
SSL_get_SSL_CTX
SSL_new
SSL_CTX_set_options
SSL_CTX_ctrl
SSL_get_error
TLS_server_method
SSL_CTX_set_psk_client_callback
SSL_CTX_set_ex_data
SSL_shutdown
SSL_CTX_get_ex_data
SSL_CTX_use_certificate_chain_file
SSL_get_fd
SSL_CTX_load_verify_locations
SSL_CTX_set_cipher_list
SSL_read
SSL_accept
SSL_CTX_set_verify
SSL_ctrl
TLS_client_method
SSL_write
SSL_CTX_new
SSL_set_fd
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_certificate_file
SSL_CTX_free
libcrypto-1_1
PEM_read_bio_DHparams
BIO_free
DH_free
BIO_new_file
BIO_new_mem_buf
crypt32
CryptProtectData
Sections
.text Size: 349KB - Virtual size: 349KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 90KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ