Static task
static1
Behavioral task
behavioral1
Sample
f11e3bd6f675ddb97f5f83afd5dd2de80f7a575b2bda9b3d9a566ab1aac0cb97.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
f11e3bd6f675ddb97f5f83afd5dd2de80f7a575b2bda9b3d9a566ab1aac0cb97.exe
Resource
win10v2004-20231023-en
General
-
Target
f11e3bd6f675ddb97f5f83afd5dd2de80f7a575b2bda9b3d9a566ab1aac0cb97
-
Size
1.1MB
-
MD5
5ba4e19d26428c43fa09f45325a83f7b
-
SHA1
d0f6a720dfcdc421b22d99b4008f12d6b592c04f
-
SHA256
f11e3bd6f675ddb97f5f83afd5dd2de80f7a575b2bda9b3d9a566ab1aac0cb97
-
SHA512
416740c9b0a802beec47225a6918d5e37f83765c411c8fbe924b3319da4e5facb3ed305839605edebca4171902b251b35fa5cfc48cca45901f646e5bbb1f1361
-
SSDEEP
24576:ZdWDhTkQ4U8D2OgNwaJt6whcs0KGWc4M52ysYIU8wYTWl4g:f9U8DUOsgw6W9jKYTWOg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f11e3bd6f675ddb97f5f83afd5dd2de80f7a575b2bda9b3d9a566ab1aac0cb97
Files
-
f11e3bd6f675ddb97f5f83afd5dd2de80f7a575b2bda9b3d9a566ab1aac0cb97.exe windows:6 windows x86 arch:x86
387dcd15c90b104fe9b18404b1ff079d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcessId
WideCharToMultiByte
CopyFileW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
FindClose
WritePrivateProfileStringW
DeleteFileW
GetCommandLineW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetPrivateProfileStringW
LoadLibraryW
ReadProcessMemory
GetVersionExW
OpenProcess
TerminateProcess
InitializeCriticalSection
CloseHandle
OutputDebugStringW
CreateFileW
CreateDirectoryW
lstrcmpiW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetLastError
RaiseException
DecodePointer
MultiByteToWideChar
LocalFree
FindResourceW
WriteConsoleW
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
SizeofResource
LockResource
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
SetConsoleCtrlHandler
SetStdHandle
ReadConsoleW
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapDestroy
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetFileSizeEx
ReadFile
SetFilePointer
GetStringTypeW
FormatMessageW
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetFileSize
WriteFile
FlushFileBuffers
Sleep
InitializeCriticalSectionEx
GetSystemWindowsDirectoryW
FreeResource
DeviceIoControl
lstrcmpA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetEvent
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
LocalAlloc
GetExitCodeProcess
WaitForSingleObject
lstrlenW
CreateProcessW
FindFirstFileA
FindNextFileA
GetTempPathW
SetEndOfFile
GetFileTime
SetFileTime
GetSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetTempFileNameW
ReleaseMutex
CreateMutexW
RtlUnwind
InterlockedFlushSList
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
GetCurrentThread
user32
GetWindowThreadProcessId
GetShellWindow
WaitForInputIdle
SendMessageW
GetWindowLongW
KillTimer
CallWindowProcW
PostQuitMessage
PostMessageW
wsprintfW
LoadCursorW
SetWindowLongW
CharNextW
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
IsWindow
advapi32
DeleteService
UnlockServiceDatabase
QueryServiceStatusEx
QueryServiceStatus
QueryServiceLockStatusW
QueryServiceConfig2W
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
LockServiceDatabase
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
CryptGenRandom
CryptImportKey
CryptEncrypt
CryptDecrypt
CryptContextAddRef
OpenProcessToken
GetTokenInformation
CreateServiceW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
SetTokenInformation
AdjustTokenPrivileges
CreateWellKnownSid
GetLengthSid
LookupPrivilegeValueW
DuplicateTokenEx
RegGetValueW
ChangeServiceConfigW
ChangeServiceConfig2W
CloseServiceHandle
ControlService
StartServiceW
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
CommandLineToArgvW
ShellExecuteW
SHCreateDirectoryExW
ord165
ole32
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoCreateGuid
CoTaskMemAlloc
CoInitialize
CoTaskMemRealloc
oleaut32
SysAllocStringLen
VarUI4FromStr
SysStringLen
SysFreeString
shlwapi
PathFindFileNameW
PathFileExistsW
wnsprintfW
PathRemoveFileSpecW
PathIsRootW
PathIsRelativeW
PathIsDirectoryW
PathRenameExtensionW
PathAppendW
StrTrimA
StrCmpNIW
StrStrIA
PathCombineW
StrStrIW
StrCmpIW
AssocQueryStringW
PathAppendA
comctl32
InitCommonControlsEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
psapi
GetModuleFileNameExW
crypt32
CertGetNameStringW
CryptStringToBinaryA
CryptBinaryToStringW
CryptBinaryToStringA
CryptStringToBinaryW
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
urlmon
URLDownloadToCacheFileW
iphlpapi
GetAdaptersInfo
Sections
.text Size: 936KB - Virtual size: 936KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 175KB - Virtual size: 174KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ