Static task
static1
Behavioral task
behavioral1
Sample
a4f57ee5519fc35ab50f8f473385fdd6c5b418280c7a4be54000f0c4501caf3f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
a4f57ee5519fc35ab50f8f473385fdd6c5b418280c7a4be54000f0c4501caf3f.exe
Resource
win10v2004-20231025-en
General
-
Target
a4f57ee5519fc35ab50f8f473385fdd6c5b418280c7a4be54000f0c4501caf3f
-
Size
625KB
-
MD5
9f254b8a4442e718230964bd2d8007e4
-
SHA1
0cca49a1c453df4ab84ecf15063c65e887b36468
-
SHA256
a4f57ee5519fc35ab50f8f473385fdd6c5b418280c7a4be54000f0c4501caf3f
-
SHA512
55fad5d33d4aa27c3958811590298f8eaca7309bbc774fcb63cb2184897ec2baba97013491784270912a6beab717804e44e394b439a54855bed284ab1bca6b78
-
SSDEEP
12288:QX6HorhLtBRRjG/kXzZiMIv2S1f2HWHdmhY6VMt4xviU1:arG/kXzZiMIv2S1bHdm+vG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a4f57ee5519fc35ab50f8f473385fdd6c5b418280c7a4be54000f0c4501caf3f
Files
-
a4f57ee5519fc35ab50f8f473385fdd6c5b418280c7a4be54000f0c4501caf3f.exe windows:6 windows x86
bb42f47e4986725f27ad46ffd9253784
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
pdh
PdhOpenQueryW
PdhValidatePathW
PdhCloseQuery
PdhAddCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
ws2_32
InetPtonW
kernel32
AcquireSRWLockExclusive
WriteConsoleW
HeapSize
CreateFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
CreateMutexW
WaitForSingleObject
ReleaseMutex
ResumeThread
UnmapViewOfFile
MultiByteToWideChar
GetExitCodeThread
Sleep
FormatMessageW
GetLastError
SetEvent
CloseHandle
GetSystemInfo
LoadLibraryW
ResetEvent
GetProcAddress
CreateFileMappingA
LocalFree
GetCurrentProcessId
CreateProcessW
SetThreadExecutionState
FreeLibrary
WideCharToMultiByte
CreateEventA
MapViewOfFile
GetExitCodeProcess
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
RtlCaptureContext
GetCurrentProcess
GetCurrentThread
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleOutputCP
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
HeapAlloc
HeapFree
WriteFile
GetStdHandle
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetLocalTime
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
CompareStringEx
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
RaiseException
GetCurrentThreadId
ReleaseSRWLockExclusive
SetEndOfFile
TryAcquireSRWLockExclusive
GetStringTypeW
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceBeginInitialize
InitOnceComplete
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
user32
EnableWindow
GetParent
SetDlgItemInt
InvalidateRect
DialogBoxParamW
GetCursorPos
GetDlgItemTextW
GetDesktopWindow
GetWindowTextLengthW
GetMessageW
CreateDialogParamW
GetWindowRect
DestroyWindow
IsWindowVisible
SetWindowPos
MessageBoxW
MonitorFromWindow
ScreenToClient
SendMessageW
EndDialog
CreatePopupMenu
TrackPopupMenu
ShowWindow
DispatchMessageW
SetTimer
IsDialogMessageW
GetMonitorInfoW
SetDlgItemTextW
PostQuitMessage
SendDlgItemMessageW
MessageBoxA
IsWindowEnabled
MoveWindow
IsDlgButtonChecked
TranslateMessage
wsprintfW
GetDlgItemInt
GetClientRect
GetDlgItem
AppendMenuW
KillTimer
CheckDlgButton
shell32
CommandLineToArgvW
SHFileOperationW
dbghelp
SymFunctionTableAccess64
StackWalk64
SymGetLineFromAddr64
SymInitialize
SymFromAddr
SymGetModuleBase64
SymCleanup
Sections
.text Size: 389KB - Virtual size: 389KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ