Static task
static1
Behavioral task
behavioral1
Sample
matedit2_w32.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
matedit2_w32.exe
Resource
win10v2004-20231023-en
General
-
Target
matedit2_w32.exe
-
Size
466KB
-
MD5
2bd73184a222be39d5fe3a2e73183672
-
SHA1
438ca1c70c13d062e55b607cb50fbffc8b7f18ea
-
SHA256
1ccb3cba6b8cbc9b28b53561a25d543168db99d05c0d83d7ae7930e262bdef94
-
SHA512
7d5eeb08a138ff398c2f6624782ff5fe57ae7aac4f46035a057b278179a691419865ca2bf0f093f88e064f151aded4f5e4cac9e35ae40d13d7240033e47491e7
-
SSDEEP
6144:QFagUvRHBmzB4RJYF44EFgR1ZIixn9b374mMYLAaAObkvBM0:IavpHB+4RqSgBjnZ3EmMeFkvBD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource matedit2_w32.exe
Files
-
matedit2_w32.exe.exe windows:5 windows x86
e49c635bfb36e7af5b2a7a96eb3372e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
expat
XML_ParserCreate
XML_SetUserData
XML_SetElementHandler
XML_Parse
XML_GetErrorCode
XML_ErrorString
XML_GetCurrentLineNumber
XML_ParserFree
kernel32
Sleep
CreateThread
CreateMutexA
InitializeCriticalSection
GetCurrentThread
DeleteCriticalSection
ExitThread
ExitProcess
LeaveCriticalSection
EnterCriticalSection
CompareStringA
GetLocaleInfoW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetModuleHandleA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
SetFilePointer
ReadFile
SetCurrentDirectoryA
GetCurrentDirectoryA
CreateFileA
PeekNamedPipe
GetFileInformationByHandle
CloseHandle
GetFullPathNameA
IsValidCodePage
GetOEMCP
GetACP
HeapSize
InitializeCriticalSectionAndSpinCount
LoadLibraryA
WaitForSingleObject
GetLastError
ReleaseMutex
SetEnvironmentVariableA
SetStdHandle
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapFree
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
MultiByteToWideChar
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA
GetModuleHandleW
GetProcAddress
HeapReAlloc
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
FindFirstFileA
FindNextFileA
LCMapStringA
LCMapStringW
GetCPInfo
VirtualFree
VirtualAlloc
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
CompareStringW
user32
GetKeyState
DefWindowProcA
ShowCursor
MessageBoxA
DestroyWindow
PostQuitMessage
BeginPaint
EndPaint
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
PostMessageA
GetForegroundWindow
GetSystemMetrics
LoadIconA
LoadCursorA
RegisterClassExA
AdjustWindowRect
SetWindowPos
SetRect
FillRect
UpdateWindow
SetForegroundWindow
ShowWindow
InvalidateRect
GetDC
ReleaseDC
SetCursorPos
gdi32
GetStockObject
CreateDIBSection
DeleteObject
CreateCompatibleDC
SelectObject
CreateSolidBrush
BitBlt
GdiFlush
SetDIBColorTable
GetPixel
SetPixelV
DeleteDC
Sections
.text Size: 379KB - Virtual size: 379KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 170KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ