Static task
static1
Behavioral task
behavioral1
Sample
53e1ab8171a5ae7431f936b1e935d27da910a6543b29ed65e1016653c60d3397.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
53e1ab8171a5ae7431f936b1e935d27da910a6543b29ed65e1016653c60d3397.exe
Resource
win10v2004-20231020-en
General
-
Target
53e1ab8171a5ae7431f936b1e935d27da910a6543b29ed65e1016653c60d3397
-
Size
1.2MB
-
MD5
67707d215593f16a5008992ac2c295b7
-
SHA1
2c7cf84874963601a05f8992f21c904be88cc5e3
-
SHA256
53e1ab8171a5ae7431f936b1e935d27da910a6543b29ed65e1016653c60d3397
-
SHA512
7ff477af69ba391c10093f662329d2249ed0478eb5e7c6d51951ca006abc94ce7214be8f56a8d9b8174953398d8f82790af6cc164b4318556d56656389bf0c34
-
SSDEEP
24576:69miQIlurjnHM4hJ1SNV7tjfE3wZvI0KZGJmZxwiEcWKoEMPOwzU:6USKHM4BMVpfmw1EGJ0CPOwzU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 53e1ab8171a5ae7431f936b1e935d27da910a6543b29ed65e1016653c60d3397
Files
-
53e1ab8171a5ae7431f936b1e935d27da910a6543b29ed65e1016653c60d3397.exe windows:6 windows x86 arch:x86
80e07f1ad3a1f44aafdcff5490a5724c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
OutputDebugStringW
WideCharToMultiByte
CopyFileW
OpenProcess
RemoveDirectoryW
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileStringW
LoadLibraryW
WaitForMultipleObjects
CreateEventW
WaitForSingleObject
SetEvent
InitializeCriticalSection
CloseHandle
GetFileSizeEx
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
GetCommandLineW
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
DecodePointer
MultiByteToWideChar
LocalFree
FindResourceW
WriteConsoleW
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SizeofResource
LockResource
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
ReadConsoleW
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapAlloc
HeapDestroy
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
ReadFile
SetFilePointer
GetStringTypeW
FormatMessageW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetFileSize
WriteFile
FlushFileBuffers
Sleep
InitializeCriticalSectionEx
GetSystemWindowsDirectoryW
FreeResource
DeviceIoControl
lstrcmpA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
LocalAlloc
GetExitCodeProcess
lstrlenW
CreateProcessW
FindFirstFileA
FindNextFileA
GetTempPathW
SetEndOfFile
GetFileTime
SetFileTime
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetTempFileNameW
GetShortPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
SetFileAttributesW
SearchPathW
MoveFileW
GetLogicalDriveStringsW
FindFirstChangeNotificationW
FindCloseChangeNotification
CompareFileTime
GetFileInformationByHandle
GetStdHandle
ReleaseMutex
CreateMutexW
RtlUnwind
InterlockedFlushSList
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetCurrentThread
GetDateFormatW
GetTimeFormatW
user32
SetTimer
GetWindowLongW
PostQuitMessage
PostMessageW
LoadCursorW
SetWindowLongW
CharNextW
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
wsprintfW
KillTimer
WaitForInputIdle
GetWindowThreadProcessId
CallWindowProcW
GetShellWindow
advapi32
DeleteService
StartServiceW
UnlockServiceDatabase
QueryServiceStatus
QueryServiceLockStatusW
QueryServiceConfig2W
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
LockServiceDatabase
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenRandom
CryptImportKey
CryptEncrypt
CryptDecrypt
CryptContextAddRef
OpenProcessToken
GetTokenInformation
SetTokenInformation
CreateServiceW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
CreateWellKnownSid
GetLengthSid
LookupPrivilegeValueW
DuplicateTokenEx
RegGetValueW
ChangeServiceConfigW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
QueryServiceStatusEx
shell32
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
CommandLineToArgvW
ord165
ole32
CoCreateGuid
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
oleaut32
SysAllocStringLen
VarUI4FromStr
VariantCopy
SysFreeString
SysAllocString
SysStringLen
VariantClear
SysAllocStringByteLen
shlwapi
PathIsRelativeW
PathIsDirectoryW
wnsprintfW
PathAppendW
PathFileExistsW
StrTrimA
StrCmpNIW
StrStrIA
PathRemoveFileSpecW
PathRenameExtensionW
PathAppendA
PathCombineW
PathFindFileNameW
StrStrIW
StrCmpIW
AssocQueryStringW
PathIsRootW
comctl32
InitCommonControlsEx
psapi
GetModuleFileNameExW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
crypt32
CertGetNameStringW
CryptStringToBinaryA
CryptBinaryToStringW
CryptBinaryToStringA
CryptStringToBinaryW
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
urlmon
URLDownloadToCacheFileW
iphlpapi
GetAdaptersInfo
Sections
.text Size: 950KB - Virtual size: 949KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ