Static task
static1
Behavioral task
behavioral1
Sample
b0c78b4cd6e85d9603c210546093bb72ddc15d53139e70a6ed5b377b34859efb.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
b0c78b4cd6e85d9603c210546093bb72ddc15d53139e70a6ed5b377b34859efb.exe
Resource
win10v2004-20231130-en
General
-
Target
b0c78b4cd6e85d9603c210546093bb72ddc15d53139e70a6ed5b377b34859efb
-
Size
539KB
-
MD5
6c885a44ab4448e10f6063b3ec06572b
-
SHA1
ae96371d2f339e05cc8eda8ca412eddf9ab0ab44
-
SHA256
b0c78b4cd6e85d9603c210546093bb72ddc15d53139e70a6ed5b377b34859efb
-
SHA512
689867a3b0c8828ccf370b13e05b1ba63cf4b41a4de7f85477d406f1375fc77ffec1def4da60787beebd8f5a5b7afd13059e7aab7e209102a1a0794e909075b6
-
SSDEEP
12288:nGJ4XolV1PzaGMcI78rJttBvJt6auY27Xm:nF+1PWGMcO8rJHA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b0c78b4cd6e85d9603c210546093bb72ddc15d53139e70a6ed5b377b34859efb
Files
-
b0c78b4cd6e85d9603c210546093bb72ddc15d53139e70a6ed5b377b34859efb.exe windows:6 windows x86 arch:x86
ca55a27ffcaee833c6f008355ceef278
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imm32
ImmInstallIMEW
kernel32
GetSystemDirectoryW
GetThreadUILanguage
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
WaitForSingleObject
CloseHandle
GetFileAttributesW
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
InitializeCriticalSectionEx
DecodePointer
DeleteCriticalSection
MultiByteToWideChar
lstrcmpiW
FreeLibrary
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
GetCurrentThreadId
GetUserDefaultLCID
SetThreadUILanguage
SetThreadLocale
Sleep
SetLastError
CreateFileW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
GetModuleFileNameW
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetFileSizeEx
SetConsoleCtrlHandler
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
ExitProcess
GetLastError
GetSystemWow64DirectoryW
DeleteFileW
MoveFileExW
CopyFileW
HeapDestroy
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
RaiseException
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetCurrentThread
WriteFile
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
TlsFree
GetModuleHandleW
FlushFileBuffers
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
LocalFree
GetLocaleInfoEx
SetFileInformationByHandle
GetTempPathW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeSRWLock
InitOnceExecuteOnce
SleepConditionVariableCS
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
RtlUnwind
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
WriteConsoleW
user32
CheckRadioButton
GetDlgItem
UnloadKeyboardLayout
MessageBoxExW
GetWindowTextW
SetWindowTextW
DialogBoxParamW
GetActiveWindow
DestroyWindow
CharNextW
UnregisterClassW
SetWindowLongW
EndDialog
EnableWindow
GetWindowTextLengthW
SetFocus
IsDlgButtonChecked
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
advapi32
RegDeleteValueW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegOpenKeyW
RegDeleteKeyW
RegEnumKeyW
RegSetValueExW
RegCreateKeyW
shell32
ShellExecuteW
ShellExecuteExW
ole32
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoUninitialize
oleaut32
SysFreeString
VarUI4FromStr
comctl32
InitCommonControlsEx
Sections
.text Size: 431KB - Virtual size: 431KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ