Static task
static1
Behavioral task
behavioral1
Sample
27c929b0fdc2163805dbcecedbe058a69b34c266c1d76d0e38034800aef997e3.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
27c929b0fdc2163805dbcecedbe058a69b34c266c1d76d0e38034800aef997e3.exe
Resource
win10v2004-20231020-en
General
-
Target
27c929b0fdc2163805dbcecedbe058a69b34c266c1d76d0e38034800aef997e3
-
Size
1.2MB
-
MD5
4869cecf2b7a189feb373752dcc26a29
-
SHA1
ecaba1eedfd55ce53d250b1d9d9277c125ea4457
-
SHA256
27c929b0fdc2163805dbcecedbe058a69b34c266c1d76d0e38034800aef997e3
-
SHA512
baa62c59d5c0fc4c639f1f1a99c31cb2d781a9070c0e9a83e401dc90ca777a2901151d6053bc75fbafaa013ab465e96eccfcb92d975be9250f22b20d08b5e95b
-
SSDEEP
24576:bL1QL7nlkchqZfO0ewt1RVc/mu0KfrVHp/sD5bBTJ/B+ady:bKlkcs5CwvumAcb5J/B+ady
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27c929b0fdc2163805dbcecedbe058a69b34c266c1d76d0e38034800aef997e3
Files
-
27c929b0fdc2163805dbcecedbe058a69b34c266c1d76d0e38034800aef997e3.exe windows:6 windows x86 arch:x86
01a7346fd182ca130deadb0d035563ee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventW
WaitForMultipleObjects
RemoveDirectoryW
CopyFileW
GetCurrentProcessId
WaitForSingleObject
SetEvent
GetFileSizeEx
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
GetCommandLineW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ReadProcessMemory
GetVersionExW
OpenProcess
TerminateProcess
InitializeCriticalSection
CloseHandle
OutputDebugStringW
CreateFileW
CreateDirectoryW
lstrcmpiW
LoadLibraryExW
GetModuleFileNameW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
DecodePointer
MultiByteToWideChar
LocalFree
WideCharToMultiByte
WritePrivateProfileStringW
GetPrivateProfileStringW
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleExW
GetModuleHandleW
WriteConsoleW
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
FreeLibrary
FindResourceExW
FindFirstFileExA
SetConsoleCtrlHandler
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetDateFormatW
GetCurrentThread
FreeLibraryAndExitThread
ResumeThread
ExitThread
HeapDestroy
GetLastError
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
ReadFile
SetFilePointer
GetStringTypeW
FormatMessageW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetFileSize
WriteFile
FlushFileBuffers
Sleep
InitializeCriticalSectionEx
GetSystemWindowsDirectoryW
FreeResource
DeviceIoControl
lstrcmpA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
LocalAlloc
GetExitCodeProcess
lstrlenW
CreateProcessW
FindFirstFileA
FindNextFileA
GetTempPathW
SetEndOfFile
GetFileTime
SetFileTime
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetTempFileNameW
GetShortPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
SetFileAttributesW
SearchPathW
MoveFileW
GetLogicalDriveStringsW
FindFirstChangeNotificationW
FindCloseChangeNotification
CompareFileTime
GetFileInformationByHandle
GetStdHandle
ReleaseMutex
CreateMutexW
RtlUnwind
InterlockedFlushSList
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleFileNameA
GetACP
CreateThread
user32
GetWindowThreadProcessId
IsWindow
SendMessageW
GetShellWindow
KillTimer
SetTimer
CallWindowProcW
PostQuitMessage
PostMessageW
wsprintfW
LoadCursorW
SetWindowLongW
CharNextW
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
WaitForInputIdle
GetWindowLongW
advapi32
LockServiceDatabase
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceLockStatusW
QueryServiceConfig2W
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenRandom
CryptImportKey
CryptEncrypt
CryptDecrypt
CryptContextAddRef
OpenProcessToken
CreateServiceW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
SetTokenInformation
AdjustTokenPrivileges
CreateWellKnownSid
GetLengthSid
LookupPrivilegeValueW
DuplicateTokenEx
RegGetValueW
ChangeServiceConfigW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
UnlockServiceDatabase
shell32
SHCreateDirectoryExW
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
ord165
ole32
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CoCreateGuid
CoInitialize
CoTaskMemRealloc
CoCreateInstance
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
VarUI4FromStr
VariantCopy
VariantClear
SysAllocStringByteLen
SysAllocString
shlwapi
PathFindFileNameW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW
PathIsRelativeW
PathIsRootW
PathIsDirectoryW
PathRenameExtensionW
PathAppendA
StrStrIA
StrCmpNIW
StrTrimA
PathCombineW
StrStrIW
StrCmpIW
wnsprintfW
AssocQueryStringW
comctl32
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
psapi
GetModuleFileNameExW
dbghelp
MakeSureDirectoryPathExists
crypt32
CryptStringToBinaryA
CertGetNameStringW
CryptBinaryToStringA
CryptStringToBinaryW
CryptBinaryToStringW
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
urlmon
URLDownloadToCacheFileW
iphlpapi
GetAdaptersInfo
Sections
.text Size: 978KB - Virtual size: 977KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 183KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ