Static task
static1
Behavioral task
behavioral1
Sample
0d588d3c00aefbe24ce5553c73822334f54e7b8e51dc8e5fd470d3516440984f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
0d588d3c00aefbe24ce5553c73822334f54e7b8e51dc8e5fd470d3516440984f.exe
Resource
win10v2004-20231023-en
General
-
Target
0d588d3c00aefbe24ce5553c73822334f54e7b8e51dc8e5fd470d3516440984f
-
Size
706KB
-
MD5
a6cae9b358e4420235a6fc9104352150
-
SHA1
29bcf5044ffe5cb3fdbc375178666c1ffd492014
-
SHA256
0d588d3c00aefbe24ce5553c73822334f54e7b8e51dc8e5fd470d3516440984f
-
SHA512
4f72192cf6cde4e04939bce0b14457a570257224431d0bff420c4bfe17f3cdaa172d34357572e07b3f45e6dbad9676a721b35fd7edc0f549e72bfb333c6b818c
-
SSDEEP
12288:aSUVyJaKRQT4vPq3y0OKRfRLcMfAbq9aYfafd/B4OYdMzZx:EyxWxyezQ92a1/B4IzZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d588d3c00aefbe24ce5553c73822334f54e7b8e51dc8e5fd470d3516440984f
Files
-
0d588d3c00aefbe24ce5553c73822334f54e7b8e51dc8e5fd470d3516440984f.exe windows:6 windows x86
6941aa35c3f14b5c7521dc01cc517374
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetThreadTimes
LoadLibraryExW
GetCommandLineW
lstrcmpiW
LocalFree
GetStartupInfoW
Sleep
SetEndOfFile
GetFileSize
DeleteFileW
CreateFileA
GetCurrentThread
WriteFile
ReadFile
CreateFileW
CreateMutexW
ReleaseMutex
ResetEvent
CreateEventW
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
RaiseException
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
FreeLibrary
GetCurrentProcess
IsBadReadPtr
GetProcAddress
GetModuleHandleW
VirtualProtect
GetCurrentThreadId
GetCurrentProcessId
WaitForSingleObject
GetLastError
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
SetUnhandledExceptionFilter
CloseHandle
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
ExitThread
CreateThread
HeapAlloc
HeapDestroy
IsDebuggerPresent
OutputDebugStringW
GetStringTypeW
FormatMessageW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetLastError
DeviceIoControl
CopyFileW
EncodePointer
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
SetFilePointer
InterlockedIncrement
InterlockedDecrement
FlushFileBuffers
lstrcmpA
lstrcmpiA
GetSystemDirectoryW
InterlockedCompareExchange
FreeResource
GetSystemWindowsDirectoryW
GetACP
MulDiv
ExitProcess
WaitForSingleObjectEx
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
user32
FindWindowW
CharNextW
SendMessageTimeoutW
wsprintfW
IsWindow
advapi32
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
OpenProcessToken
GetTokenInformation
RegGetValueW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
shell32
ord165
SHGetSpecialFolderPathW
ShellExecuteExW
ole32
OleInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoCreateGuid
CoTaskMemAlloc
oleaut32
VarUI4FromStr
shlwapi
StrStrIW
SHGetValueA
SHSetValueA
StrCmpNIW
StrTrimA
StrCmpIW
PathIsDirectoryW
StrStrIA
PathAppendW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
gdiplus
GdiplusStartup
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
urlmon
URLDownloadToCacheFileW
URLDownloadToFileW
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
crypt32
CertGetNameStringW
wininet
InternetGetConnectedState
iphlpapi
GetAdaptersInfo
Sections
.text Size: 436KB - Virtual size: 436KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ