Static task
static1
Behavioral task
behavioral1
Sample
2cf1c7b80d8f79acb13d9b2ffbf2f86ba706db04a168a5a0eba6075dd60c2d76.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2cf1c7b80d8f79acb13d9b2ffbf2f86ba706db04a168a5a0eba6075dd60c2d76.exe
Resource
win10v2004-20230915-en
General
-
Target
2cf1c7b80d8f79acb13d9b2ffbf2f86ba706db04a168a5a0eba6075dd60c2d76
-
Size
506KB
-
MD5
e98ef5d393ba4dd76f153ace509934f3
-
SHA1
86cc72ca6c83826dd6f915e81a2b030a786107a0
-
SHA256
2cf1c7b80d8f79acb13d9b2ffbf2f86ba706db04a168a5a0eba6075dd60c2d76
-
SHA512
bcc5cc1a4a92b72ceb99293bafab9e89863f75e7df55f74873c4821b1ac82084c4f72fe5adee58d60305a7535bbb354c009208e4affdd28ee30327e6f8c0c744
-
SSDEEP
6144:7aGdRV34PaKtpsH5aBugRkC5SZ14m9M49AE7Ask+HuIBT6lSlb:BV4NugOC5SZ19iE7AsHuHlc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2cf1c7b80d8f79acb13d9b2ffbf2f86ba706db04a168a5a0eba6075dd60c2d76
Files
-
2cf1c7b80d8f79acb13d9b2ffbf2f86ba706db04a168a5a0eba6075dd60c2d76.exe windows:5 windows x86
ac721e43ef1aaaddc5d6cbbc4b1b207e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentDirectoryA
GetCPInfo
GetOEMCP
RtlUnwind
HeapFree
ExitProcess
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapAlloc
GetCommandLineA
GetStartupInfoA
GetSystemTimeAsFileTime
GetFullPathNameW
HeapReAlloc
HeapSize
HeapCreate
HeapDestroy
VirtualFree
GetStdHandle
InitializeCriticalSectionAndSpinCount
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetTimeZoneInformation
GetTimeFormatA
GetDateFormatA
GetConsoleCP
GetConsoleMode
GetLocaleInfoW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetDriveTypeA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetProcessHeap
GlobalFindAtomA
lstrcmpW
GetVersionExA
GlobalDeleteAtom
GetLocaleInfoA
InterlockedExchange
GlobalFlags
GlobalAddAtomA
CreateFileA
FlushFileBuffers
SetFilePointer
WriteFile
lstrcmpA
GlobalGetAtomNameA
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetModuleHandleW
CompareStringA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
DeleteFileW
GetCurrentProcess
GetCurrentProcessId
CreateDirectoryW
SetUnhandledExceptionFilter
FindClose
FindNextFileW
FindFirstFileW
lstrcpyW
SetLastError
CreateFileW
FindResourceW
GetModuleFileNameW
OpenProcess
Sleep
CreateToolhelp32Snapshot
Process32First
Process32Next
IsDBCSLeadByte
LoadLibraryExA
WideCharToMultiByte
InitializeCriticalSection
lstrlenW
GetModuleFileNameA
GetModuleHandleA
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
RaiseException
InterlockedCompareExchange
DeleteCriticalSection
GetCurrentThreadId
lstrcmpiA
CreateProcessA
CloseHandle
FreeLibrary
LoadLibraryA
GetProcAddress
FindResourceExA
LoadResource
LockResource
SizeofResource
FindResourceA
lstrlenA
GetLastError
GetACP
MultiByteToWideChar
user32
GetMessagePos
MapWindowPoints
SetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
CopyRect
CallWindowProcA
GetMenu
SystemParametersInfoA
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostQuitMessage
SetForegroundWindow
IsIconic
PostMessageA
SetWindowPos
SetWindowLongA
IsWindow
GetDlgItem
GetMessageTime
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
PeekMessageA
ValidateRect
GetFocus
ClientToScreen
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameA
PtInRect
SetWindowTextA
GetWindowTextA
DefWindowProcA
GetWindowThreadProcessId
SendMessageA
GetParent
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxA
UnhookWindowsHookEx
LoadCursorA
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
GetMenuState
GetMenuItemID
GetMenuItemCount
GetSubMenu
wsprintfW
GetTopWindow
GetForegroundWindow
DestroyWindow
CharNextA
RemovePropA
DestroyMenu
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
RegisterWindowMessageA
LoadIconA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
GetClientRect
gdi32
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
SetMapMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
GetDeviceCaps
winspool.drv
OpenPrinterA
ClosePrinter
DocumentPropertiesA
advapi32
GetTokenInformation
OpenProcessToken
DuplicateTokenEx
ImpersonateLoggedOnUser
GetUserNameA
CreateProcessAsUserA
RevertToSelf
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
ole32
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
oleaut32
VariantChangeType
VariantClear
SystemTimeToVariantTime
VarUdateFromDate
VariantTimeToSystemTime
VarUI4FromStr
VariantInit
protectme
AddMe2Protect
netcheckalarm
?IsCurrentAppAlreadyRun@@YAHXZ
comctl32
InitCommonControlsEx
oleacc
CreateStdAccessibleObject
LresultFromObject
dbghelp
MiniDumpWriteDump
Sections
.text Size: 384KB - Virtual size: 384KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ