Static task
static1
Behavioral task
behavioral1
Sample
44db8442c2c89ec84cb4b6d3712f79399cba4b1530ad2afa95ae38aa9d6165d6.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
44db8442c2c89ec84cb4b6d3712f79399cba4b1530ad2afa95ae38aa9d6165d6.exe
Resource
win10v2004-20231023-en
General
-
Target
44db8442c2c89ec84cb4b6d3712f79399cba4b1530ad2afa95ae38aa9d6165d6.exe
-
Size
4.0MB
-
MD5
5614500771a42b393212dfe60d28ee08
-
SHA1
e38af6dc85ae1c42c398ef2d29f5ea05a45b9836
-
SHA256
44db8442c2c89ec84cb4b6d3712f79399cba4b1530ad2afa95ae38aa9d6165d6
-
SHA512
6450c6369008980686689b2333d7d2d546451d73921907352b541d6d191a362c6efc229946db7e9d2b47c66475b259c4cd712751e8189ae15bcc77bf5865e4e4
-
SSDEEP
49152:nctar2G5D6OZgeihsiPBZGugXX37tv/iaSeGDEDnfs5haXIMg2hyg/mWc2LbG/kJ:Sa6yD6etih5PBZGrf+qIsorru
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44db8442c2c89ec84cb4b6d3712f79399cba4b1530ad2afa95ae38aa9d6165d6.exe
Files
-
44db8442c2c89ec84cb4b6d3712f79399cba4b1530ad2afa95ae38aa9d6165d6.exe.exe windows:5 windows x86 arch:x86
63e572d14d0e7fedd3c065c38ec545e3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetEnvironmentStrings
CompareStringW
SetEnvironmentVariableA
FreeEnvironmentStringsA
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
VirtualFree
HeapCreate
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
HeapSize
CreateThread
ExitThread
GetFileType
SetStdHandle
HeapReAlloc
VirtualQuery
VirtualAlloc
VirtualProtect
GetStartupInfoA
GetCommandLineA
HeapAlloc
ExitProcess
GetSystemTimeAsFileTime
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
SetErrorMode
GetCurrentDirectoryA
GetSystemDirectoryW
LoadLibraryW
GetFileSizeEx
LocalFileTimeToFileTime
GetFileAttributesExA
GetShortPathNameA
GetVolumeInformationA
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
GetStringTypeExA
SystemTimeToFileTime
GetThreadLocale
GetOEMCP
PeekNamedPipe
GetFileInformationByHandle
GetOverlappedResult
ResetEvent
GetLogicalDriveStringsA
GetVersion
IsBadWritePtr
WriteProfileStringA
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetCPInfo
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GlobalFlags
ReleaseMutex
CreateMutexA
FileTimeToLocalFileTime
FileTimeToSystemTime
RaiseException
GetProfileIntA
GetTickCount
GetDiskFreeSpaceA
GetFullPathNameA
GetTempFileNameA
GetFileTime
SetFileTime
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
LoadLibraryExA
InterlockedExchange
lstrcmpA
CreateEventA
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GetModuleFileNameA
GlobalSize
GlobalAlloc
MulDiv
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
FreeLibrary
CompareStringA
lstrcmpW
GlobalLock
GlobalUnlock
GlobalFree
FreeResource
WaitForSingleObject
lstrcatA
GetFileSize
ReadFile
GetDriveTypeA
DeviceIoControl
FindResourceA
FormatMessageA
LocalFree
lstrlenW
lstrcmpiA
GetACP
lstrcpynA
Sleep
GetLocaleInfoA
MultiByteToWideChar
lstrcpyA
MoveFileA
DeleteFileA
FindFirstFileA
SetFileAttributesA
FindNextFileA
FindClose
GetFileAttributesA
SetCurrentDirectoryA
RemoveDirectoryA
CreateDirectoryA
GetModuleHandleW
MoveFileExA
GetTempPathA
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetLastError
SetLastError
GetWindowsDirectoryA
GetPrivateProfileStringA
CloseHandle
GetShortPathNameW
CreateFileA
QueueUserWorkItem
CopyFileA
lstrlenA
WritePrivateProfileStringA
GetSystemDirectoryA
GetSystemInfo
GetVersionExA
GetPrivateProfileIntA
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
GetProcessHeap
user32
CheckMenuItem
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetFocus
SetFocus
GetWindowTextLengthA
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetNextDlgGroupItem
PostThreadMessageA
EnableMenuItem
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
GetMenuItemID
RemoveMenu
InsertMenuA
GetMenuStringA
GetDC
ReleaseDC
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GetMenuState
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
SetDlgItemTextA
IsDialogMessageA
SetWindowTextA
MoveWindow
GetDCEx
ShowWindow
EnableWindow
SendMessageA
PostMessageA
MessageBoxA
wsprintfA
GetClientRect
LoadIconA
GetWindowRect
InvalidateRect
GrayStringA
GetParent
GetSystemMetrics
OffsetRect
IsWindowVisible
MessageBeep
UpdateWindow
GetCursorPos
LoadBitmapA
GetDlgCtrlID
GetSubMenu
ModifyMenuA
DrawMenuBar
LockWindowUpdate
RedrawWindow
SetWindowPos
PostQuitMessage
ClientToScreen
CreatePopupMenu
AppendMenuA
GetMenuItemCount
GetSysColor
GetKeyState
InflateRect
IsWindow
PtInRect
SetTimer
KillTimer
DrawIcon
IsIconic
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetWindowDC
BeginPaint
EndPaint
GetWindowThreadProcessId
SetRect
WindowFromPoint
TranslateAcceleratorA
BringWindowToTop
SetRectEmpty
InsertMenuItemA
LoadAcceleratorsA
ReleaseCapture
SetCursor
DestroyMenu
LoadMenuA
ReuseDDElParam
UnpackDDElParam
ValidateRect
TranslateMessage
GetMessageA
ShowOwnedPopups
IsRectEmpty
SetWindowRgn
SetCapture
LoadCursorA
GetMenuItemInfoA
IsZoomed
GetSysColorBrush
CharUpperA
DeleteMenu
GetSystemMenu
SetParent
UnionRect
UnregisterClassA
DestroyIcon
IsClipboardFormatAvailable
CopyAcceleratorTableA
InvalidateRgn
CharNextA
MapDialogRect
SetWindowContextHelpId
GetDlgItem
GetWindowLongA
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
GetActiveWindow
GetDesktopWindow
GetWindow
GetWindowPlacement
SystemParametersInfoA
IntersectRect
SetWindowLongA
GetMenu
CallWindowProcA
DefWindowProcA
DestroyCursor
DefMDIChildProcA
DefFrameProcA
CreateMenu
RegisterClipboardFormatA
GetMenuDefaultItem
MonitorFromRect
GetMonitorInfoA
GetKeyboardState
DrawFrameControl
DrawEdge
DrawStateA
DrawIconEx
GetUpdateRect
TranslateMDISysAccel
GetAsyncKeyState
EnumWindows
DrawFocusRect
FrameRect
CopyRect
SetScrollInfo
GetScrollInfo
DeferWindowPos
EqualRect
ScreenToClient
AdjustWindowRectEx
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
gdi32
PtVisible
RectVisible
TextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
GetStockObject
CreatePen
ExtCreatePen
CreateSolidBrush
GetBkColor
CreateCompatibleBitmap
CreateFontIndirectA
SetRectRgn
CombineRgn
GetMapMode
DPtoLP
CreateEllipticRgn
LPtoDP
GetViewportExtEx
GetTextExtentPoint32A
GetTextMetricsA
GetCharWidthA
CreateFontA
StretchDIBits
GetRgnBox
GetTextColor
GetPixel
GetWindowExtEx
CreateRectRgn
SelectClipRgn
DeleteObject
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
UnrealizeObject
GetTextExtentPointA
StretchBlt
Polygon
Rectangle
SetPixelV
GetCurrentObject
SetPixel
CreateDIBitmap
SetDIBColorTable
SetBrushOrgEx
CreateDIBSection
GetViewportOrgEx
GetTextFaceA
GetWindowOrgEx
SetMapMode
SetStretchBltMode
SetBkMode
RestoreDC
SaveDC
BitBlt
CreateCompatibleDC
PatBlt
CreateRectRgnIndirect
CopyMetaFileA
GetDeviceCaps
CreateBitmap
SetBkColor
SetTextColor
GetClipBox
Ellipse
ExtTextOutA
GetObjectA
comdlg32
GetOpenFileNameW
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
SetSecurityDescriptorOwner
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
GetUserNameA
RegSetValueA
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA
OpenThreadToken
OpenProcessToken
DuplicateToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
RegCloseKey
IsValidSecurityDescriptor
AccessCheck
FreeSid
RegCreateKeyA
GetFileSecurityA
SetFileSecurityA
RegDeleteValueA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
shell32
SHGetMalloc
ExtractIconA
SHGetFileInfoA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetDesktopFolder
SHGetFolderPathW
ShellExecuteA
DragAcceptFiles
DragQueryFileA
DragFinish
shlwapi
PathFindExtensionW
PathIsUNCA
PathStripToRootA
PathRemoveFileSpecW
PathFindFileNameA
PathIsDirectoryA
PathAddBackslashA
PathIsSystemFolderA
PathFindExtensionA
PathAppendA
PathRemoveFileSpecA
PathStripPathA
PathFileExistsA
oledlg
ord8
ole32
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateStreamOnHGlobal
CLSIDFromProgID
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleIsCurrentClipboard
OleGetClipboard
CLSIDFromString
CoDisconnectObject
CoInitializeEx
CoCreateInstance
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
OleFlushClipboard
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CoUninitialize
CoInitialize
DoDragDrop
OleTranslateAccelerator
IsAccelerator
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoRegisterMessageFilter
oleaut32
DispGetIDsOfNames
DispInvoke
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadTypeLi
LoadRegTypeLi
SysAllocString
DispCallFunc
VariantCopy
SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString
urlmon
URLDownloadToFileA
wsock32
closesocket
htons
connect
htonl
bind
getsockopt
setsockopt
accept
getsockname
getpeername
ntohs
socket
gethostname
inet_ntoa
recv
recvfrom
ioctlsocket
inet_addr
WSAGetLastError
WSAStartup
WSACleanup
WSASetLastError
select
gethostbyname
shutdown
listen
sendto
send
winmm
waveOutGetNumDevs
waveOutGetVolume
waveOutGetDevCapsA
waveOutGetPosition
waveOutReset
waveOutPrepareHeader
waveOutWrite
waveOutRestart
waveOutClose
mciGetErrorStringA
waveOutOpen
waveOutPause
waveOutUnprepareHeader
PlaySoundA
mciSendCommandA
waveOutSetVolume
ws2_32
WSACloseEvent
freeaddrinfo
WSACreateEvent
WSAEventSelect
getnameinfo
WSAEnumNetworkEvents
getaddrinfo
gdiplus
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipSaveImageToFile
GdipFree
GdipGetImageWidth
wininet
HttpOpenRequestA
InternetReadFile
InternetSetOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenUrlA
HttpQueryInfoA
comctl32
ImageList_Destroy
ImageList_AddMasked
ImageList_Create
ImageList_GetIcon
ImageList_GetImageInfo
_TrackMouseEvent
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 387KB - Virtual size: 387KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1016KB - Virtual size: 5.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ