Static task
static1
Behavioral task
behavioral1
Sample
AdFind.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
AdFind.exe
Resource
win10v2004-20231023-en
General
-
Target
AdFind.exe
-
Size
1.5MB
-
MD5
12011c44955fd6631113f68a99447515
-
SHA1
4f4f8cf0f9b47d0ad95d159201fe7e72fbc8448d
-
SHA256
c92c158d7c37fea795114fa6491fe5f145ad2f8c08776b18ae79db811e8e36a3
-
SHA512
61469d638d71e85ece24a0c1d7e7badd4e9e869815f99987dbdc1ae847d1b509cd53e992335b7fbdd1d771f774ee34b88ae386bdb55a2da8c8e21f8b1e194e02
-
SSDEEP
49152:R8/N+FV3giuequoTWmyjegvtYSN2NYwsmeMcx:RWN29gDeqzHCtYS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AdFind.exe
Files
-
AdFind.exe.exe windows:6 windows x86 arch:x86
12ce1c0f3f5837ecc18a3782408fa975
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertNameToStrA
CertFreeCertificateContext
CryptDecodeObjectEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
advapi32
ConvertStringSidToSidA
ConvertSecurityDescriptorToStringSecurityDescriptorA
LsaLookupSids
ConvertSidToStringSidA
ConvertStringSidToSidW
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
LsaOpenPolicy
GetLengthSid
LookupAccountSidA
IsValidSecurityDescriptor
IsValidSid
wldap32
ord309
ord215
ord139
ord132
ord12
ord178
ord77
ord141
ord207
ord96
ord146
ord223
ord310
ord41
ord135
ord72
ord304
ord191
ord14
ord147
ord166
ord79
ord36
ord27
ord121
ord13
ord54
ord55
ord205
ord26
ord117
ord119
ord126
ord301
ord93
ord196
ord218
ws2_32
ntohs
kernel32
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadFile
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
CreateFileW
GetConsoleMode
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
HeapFree
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameW
GetConsoleCP
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RaiseException
RtlUnwind
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
GetFileAttributesExA
lstrlenW
GetStdHandle
MultiByteToWideChar
FormatMessageW
GetTimeZoneInformation
LocalFileTimeToFileTime
GetLastError
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
SystemTimeToFileTime
WideCharToMultiByte
GetFileType
CreateDirectoryA
GetSystemTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
FreeLibrary
LoadLibraryA
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
SetEvent
ResetEvent
ole32
CLSIDFromString
StringFromGUID2
user32
LoadStringA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 294KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ