Static task
static1
Behavioral task
behavioral1
Sample
d539e1dc228361b21bb886bee2d89be0aaed904fa27f938e170d58144ab0d7bf.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
d539e1dc228361b21bb886bee2d89be0aaed904fa27f938e170d58144ab0d7bf.exe
Resource
win10v2004-20231023-en
General
-
Target
d539e1dc228361b21bb886bee2d89be0aaed904fa27f938e170d58144ab0d7bf.exe
-
Size
1.7MB
-
MD5
66094d5990d657469fac89fe482de37a
-
SHA1
bcfb52bbc361e4414f807800f1cadc1b94c4a497
-
SHA256
d539e1dc228361b21bb886bee2d89be0aaed904fa27f938e170d58144ab0d7bf
-
SHA512
48dc402813ee6503499e8ceeaf2916821ab79276e21ee4b54bf4aea46274ca25e8ff52a3570c273c80645ac1ee71563d25be7f9041f84a0a4fac62930045bcb5
-
SSDEEP
24576:EfwrGID2rJO7LYlRrZtZAGtJF4Aq9UjfBBcjFtDxo:swrRElhZL5DbBBEvDxo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d539e1dc228361b21bb886bee2d89be0aaed904fa27f938e170d58144ab0d7bf.exe
Files
-
d539e1dc228361b21bb886bee2d89be0aaed904fa27f938e170d58144ab0d7bf.exe.exe windows:5 windows x86
bbd010668e3412e62a07e288c355502c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceA
lstrlenA
FindClose
CreateMutexA
GetVolumeInformationA
GetModuleHandleA
HeapSize
GetVersion
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
GetLastError
OpenMutexA
GetFileAttributesA
CreateFileA
LoadLibraryA
LockResource
DeleteFileA
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
SetFileAttributesA
GetLogicalDriveStringsA
DecodePointer
HeapDestroy
GetProcAddress
GetFileSize
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
UpdateResourceA
CreateProcessA
CreateDirectoryA
EndUpdateResourceA
GetComputerNameA
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
GetVersionExA
DeleteFileW
LeaveCriticalSection
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
FindNextFileA
GetDriveTypeA
TerminateProcess
InterlockedDecrement
WriteFile
EnterCriticalSection
SetLastError
HeapFree
FindFirstFileA
BeginUpdateResourceA
VirtualFree
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
FindFirstFileExA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
GetCurrentDirectoryW
MoveFileExW
HeapQueryInformation
SetEnvironmentVariableA
GetConsoleCP
SizeofResource
GetModuleFileNameA
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadConsoleW
GetConsoleMode
GetACP
GetSystemInfo
ReadFile
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
TryEnterCriticalSection
DuplicateHandle
GetCurrentThread
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
GetModuleFileNameW
RtlUnwind
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
WriteConsoleW
GetCommandLineA
GetCommandLineW
user32
GetDC
GetDesktopWindow
wsprintfA
ReleaseDC
GetSystemMetrics
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
GetObjectA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SystemFunction036
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ole32
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoInitialize
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
shlwapi
PathFindExtensionA
PathFindExtensionW
gdiplus
GdiplusStartup
GdipCloneImage
GdiplusShutdown
GdipGetImageEncoders
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
wininet
InternetConnectA
InternetCloseHandle
HttpSendRequestA
InternetReadFile
HttpOpenRequestA
InternetCheckConnectionA
InternetOpenA
urlmon
URLDownloadToFileA
ObtainUserAgentString
iphlpapi
GetAdaptersInfo
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 261KB - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ