Static task
static1
Behavioral task
behavioral1
Sample
579621410f15fe54601a41733ad8548df2aaa4d539bb208b7fc44395189d975b.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
579621410f15fe54601a41733ad8548df2aaa4d539bb208b7fc44395189d975b.exe
Resource
win10v2004-20231020-en
General
-
Target
579621410f15fe54601a41733ad8548df2aaa4d539bb208b7fc44395189d975b
-
Size
1.2MB
-
MD5
2408cccf9bf165e3c401e3036a733ab3
-
SHA1
dfe97748828f6989afb2e2ce5353d368783f2ba8
-
SHA256
579621410f15fe54601a41733ad8548df2aaa4d539bb208b7fc44395189d975b
-
SHA512
b182099c05e3ff465fa955e388f3748e1188ab3ae732dcee9ce50e61c15f2de58b0fa048f26d6956412ea738d496a8f03b860e909d82097b3629c791db31e78a
-
SSDEEP
24576:Ingeg3QoWOqSqWC7ChDw0ET+U90KCO2y2Nlwy6BPDFzZwy3+RgE95ayHB:IpOqSnCmdw7T52y7BPDEg+Rg25ayHB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 579621410f15fe54601a41733ad8548df2aaa4d539bb208b7fc44395189d975b
Files
-
579621410f15fe54601a41733ad8548df2aaa4d539bb208b7fc44395189d975b.exe windows:6 windows x86 arch:x86
19fc83a38c96037a5316cf0d224f971f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
GetCurrentProcessId
CopyFileW
RemoveDirectoryW
WritePrivateProfileStringW
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
SetEvent
GetFileSizeEx
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
GetCommandLineW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetPrivateProfileStringW
LoadLibraryW
ReadProcessMemory
GetVersionExW
OpenProcess
InitializeCriticalSection
CloseHandle
OutputDebugStringW
CreateFileW
CreateDirectoryW
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
DecodePointer
MultiByteToWideChar
LocalFree
FindResourceW
WriteConsoleW
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
SizeofResource
LockResource
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
SetStdHandle
ReadConsoleW
EnumSystemLocalesW
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCurrentThread
HeapAlloc
HeapDestroy
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
ReadFile
SetFilePointer
GetStringTypeW
FormatMessageW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetFileSize
WriteFile
FlushFileBuffers
Sleep
InitializeCriticalSectionEx
GetSystemWindowsDirectoryW
FreeResource
DeviceIoControl
lstrcmpA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
LocalAlloc
GetExitCodeProcess
lstrlenW
CreateProcessW
FindFirstFileA
FindNextFileA
GetTempPathW
SetEndOfFile
GetFileTime
SetFileTime
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetTempFileNameW
GetShortPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
SetFileAttributesW
SearchPathW
MoveFileW
GetLogicalDriveStringsW
FindFirstChangeNotificationW
FindCloseChangeNotification
CompareFileTime
GetFileInformationByHandle
GetStdHandle
ReleaseMutex
CreateMutexW
RtlUnwind
InterlockedFlushSList
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
user32
GetWindowLongW
KillTimer
SetTimer
IsWindow
PostQuitMessage
PostMessageW
wsprintfW
LoadCursorW
SetWindowLongW
CharNextW
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SendMessageW
GetWindowThreadProcessId
GetShellWindow
WaitForInputIdle
CallWindowProcW
advapi32
LockServiceDatabase
StartServiceW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceLockStatusW
QueryServiceConfig2W
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenRandom
CryptImportKey
CryptEncrypt
CryptDecrypt
CryptContextAddRef
OpenProcessToken
CreateServiceW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
SetTokenInformation
AdjustTokenPrivileges
CreateWellKnownSid
GetLengthSid
LookupPrivilegeValueW
DuplicateTokenEx
RegGetValueW
ChangeServiceConfigW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
UnlockServiceDatabase
shell32
ord165
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
CommandLineToArgvW
ole32
CoTaskMemFree
CoUninitialize
CoCreateGuid
CoTaskMemRealloc
CoCreateInstance
CoInitialize
CoTaskMemAlloc
oleaut32
SysFreeString
SysAllocStringLen
VarUI4FromStr
SysStringLen
VariantCopy
VariantClear
SysAllocStringByteLen
SysAllocString
shlwapi
PathFileExistsW
PathIsRelativeW
PathIsDirectoryW
PathAppendA
PathFindFileNameW
PathAppendW
StrCmpNIW
StrStrIA
PathRemoveFileSpecW
PathRenameExtensionW
AssocQueryStringW
StrTrimA
PathCombineW
wnsprintfW
StrStrIW
StrCmpIW
PathIsRootW
comctl32
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
psapi
GetModuleFileNameExW
crypt32
CryptStringToBinaryA
CertGetNameStringW
CryptBinaryToStringA
CryptStringToBinaryW
CryptBinaryToStringW
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
urlmon
URLDownloadToCacheFileW
iphlpapi
GetAdaptersInfo
Sections
.text Size: 973KB - Virtual size: 972KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 183KB - Virtual size: 182KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ