Static task
static1
Behavioral task
behavioral1
Sample
dvcfgrtegen.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
dvcfgrtegen.exe
Resource
win10v2004-20230915-en
General
-
Target
dvcfgrtegen.exe
-
Size
651KB
-
MD5
00400c2c7931afd8638eb7285679378d
-
SHA1
a39f128fc6d71f695e4f9df0e1b02837ea551230
-
SHA256
2e5d427b092310e2ec2de8c60c35062862ed9897d97834fa68e00fddb9e70eb0
-
SHA512
ce27d0852c08ceb0b828e4d3668e243ac387da62517de7bd68b1ab74ca473ef0d1726f37d2e0b8a02307643042f33645e336e35f32944089051d5b166385d9f2
-
SSDEEP
12288:xPwf808lEWaHntG2+YFL/MZPCNYHTSzbbm:WCXgGMtE/HUbbm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dvcfgrtegen.exe
Files
-
dvcfgrtegen.exe.exe windows:5 windows x86
9378c7864c05cfb21eddb242f9480ad2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
urlmon
CoInternetParseUrl
kernel32
WideCharToMultiByte
GetLastError
InterlockedIncrement
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetProcAddress
GetModuleHandleA
lstrlenA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
FindResourceA
LoadLibraryExA
GetModuleFileNameA
GetCurrentThreadId
LocalFree
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GlobalFree
GetExitCodeProcess
CreateProcessA
GlobalAlloc
GetVersion
GetStdHandle
GetEnvironmentVariableA
DeleteFileA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetFullPathNameW
GetFullPathNameA
GetPrivateProfileStringA
WaitForSingleObject
FindResourceExW
LocalAlloc
FormatMessageA
FindClose
FindFirstFileA
GetFileAttributesA
CreateDirectoryA
CreateFileA
GetTempPathA
GetTempFileNameA
SetEndOfFile
SetFilePointer
SetStdHandle
LoadLibraryW
GetStartupInfoW
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetModuleFileNameW
WriteFile
GetStringTypeW
IsValidCodePage
GetOEMCP
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedDecrement
MultiByteToWideChar
lstrlenW
ReadFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateFileW
GetACP
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
SetEnvironmentVariableA
QueryPerformanceCounter
WriteConsoleW
UnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
GetCurrentProcess
TerminateProcess
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LCMapStringW
GetCPInfo
CompareStringW
HeapSetInformation
GetCommandLineA
GetFileType
Sleep
InitializeCriticalSection
EncodePointer
DecodePointer
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
ExitProcess
user32
CharToOemBuffA
LoadStringA
MsgWaitForMultipleObjects
PeekMessageA
TranslateMessage
DispatchMessageA
CharNextA
CharToOemA
advapi32
SetSecurityDescriptorDacl
RegOpenKeyA
RegQueryValueExA
GetUserNameA
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA
InitializeSecurityDescriptor
ole32
CLSIDFromString
StringFromCLSID
CoUninitialize
OleRun
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoRevokeClassObject
CoInitializeEx
oleaut32
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
VariantInit
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
VariantClear
GetErrorInfo
VarBstrCmp
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
VarBstrCat
SysStringLen
SysFreeString
Sections
.text Size: 238KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 295KB - Virtual size: 294KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ