Static task
static1
Behavioral task
behavioral1
Sample
0643c81f154f7293a766e767b9b77de5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0643c81f154f7293a766e767b9b77de5.exe
Resource
win10v2004-20231222-en
General
-
Target
0643c81f154f7293a766e767b9b77de5
-
Size
544KB
-
MD5
0643c81f154f7293a766e767b9b77de5
-
SHA1
c69bbf7009e0af1ebdfd144f1e58cf630e9ac916
-
SHA256
2b5d01f87ec4b117625a129d608e4df6bef9b3abb419bef05cfe80e3c8ea3866
-
SHA512
c37289601b254b3e0f775d0137ea066547c3afd10ec013165c1dbd2cd5286112fca0f859b66dd13d20b42f575b9266c7aeb1975cda53169f72ede5b5707c9017
-
SSDEEP
12288:kptZoFnBiwbzWkfXL22HSGnH0rppKcmG/jjHBK:kptZoFBFbzWcXL2+SGnUrbKGPhK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0643c81f154f7293a766e767b9b77de5
Files
-
0643c81f154f7293a766e767b9b77de5.exe windows:4 windows x86 arch:x86
9d1bcd63ed637f573fd4ea860eb1d1c9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
UnlockUrlCacheEntryStream
SetUrlCacheEntryInfoA
InternetConfirmZoneCrossingA
InternetCloseHandle
InternetWriteFileExA
GetUrlCacheGroupAttributeW
CreateUrlCacheEntryA
GopherGetAttributeW
ReadUrlCacheEntryStream
InternetTimeFromSystemTime
LoadUrlCacheContent
InternetGetConnectedStateExA
InternetConfirmZoneCrossingW
InternetTimeToSystemTimeW
InternetTimeFromSystemTimeW
InternetSetCookieA
FtpGetFileA
FtpDeleteFileW
InternetShowSecurityInfoByURLA
InternetUnlockRequestFile
HttpQueryInfoW
InternetReadFileExA
GopherCreateLocatorA
UnlockUrlCacheEntryFile
FtpCommandA
UpdateUrlCacheContentPath
FtpGetCurrentDirectoryA
DeleteUrlCacheEntry
InternetDialA
SetUrlCacheGroupAttributeW
SetUrlCacheEntryInfoW
HttpSendRequestA
DeleteUrlCacheEntryW
CreateUrlCacheEntryW
HttpAddRequestHeadersA
DeleteUrlCacheContainerA
GetUrlCacheEntryInfoW
InternetAutodial
RunOnceUrlCache
InternetCanonicalizeUrlW
SetUrlCacheEntryGroupW
GetUrlCacheEntryInfoA
UnlockUrlCacheEntryFileW
FtpRenameFileA
FindNextUrlCacheEntryExW
GetUrlCacheEntryInfoExA
InternetOpenW
FtpSetCurrentDirectoryA
InternetAttemptConnect
InternetErrorDlg
FtpRenameFileW
InternetGetLastResponseInfoA
HttpSendRequestExA
RetrieveUrlCacheEntryStreamA
GopherOpenFileW
CommitUrlCacheEntryW
InternetQueryDataAvailable
FindFirstUrlCacheEntryExW
FtpCommandW
InternetQueryOptionW
FindFirstUrlCacheEntryA
ShowSecurityInfo
FtpRemoveDirectoryA
FtpOpenFileW
RetrieveUrlCacheEntryFileW
InternetGoOnlineW
FtpPutFileA
InternetGetConnectedStateEx
RetrieveUrlCacheEntryStreamW
GopherOpenFileA
FindFirstUrlCacheGroup
ShowClientAuthCerts
InternetDialW
CreateUrlCacheContainerA
InternetHangUp
InternetGetConnectedStateExW
InternetDial
InternetQueryOptionA
InternetGetConnectedState
GopherFindFirstFileA
FreeUrlCacheSpaceW
FtpPutFileEx
FtpOpenFileA
InternetInitializeAutoProxyDll
InternetCrackUrlA
HttpAddRequestHeadersW
GopherCreateLocatorW
InternetSetOptionA
FtpDeleteFileA
HttpOpenRequestA
GopherGetAttributeA
FtpPutFileW
RetrieveUrlCacheEntryFileA
InternetSecurityProtocolToStringA
InternetTimeFromSystemTimeA
FtpGetFileEx
InternetWriteFile
FtpRemoveDirectoryW
InternetSetOptionExW
InternetCrackUrlW
InternetCheckConnectionA
InternetGetCertByURLA
CreateUrlCacheGroup
DetectAutoProxyUrl
DeleteUrlCacheGroup
DeleteUrlCacheContainerW
FindNextUrlCacheEntryW
InternetSetDialStateW
InternetReadFile
FreeUrlCacheSpaceA
SetUrlCacheHeaderData
UrlZonesDetach
InternetSecurityProtocolToStringW
SetUrlCacheEntryGroup
InternetFindNextFileA
FindNextUrlCacheGroup
InternetConfirmZoneCrossing
GetUrlCacheConfigInfoA
InternetSetDialStateA
FindNextUrlCacheContainerW
IsUrlCacheEntryExpiredW
FtpCreateDirectoryA
InternetCombineUrlA
FindFirstUrlCacheContainerA
InternetSetDialState
InternetFindNextFileW
SetUrlCacheConfigInfoW
InternetCheckConnectionW
IsUrlCacheEntryExpiredA
InternetSetFilePointer
InternetShowSecurityInfoByURL
FtpGetFileW
FindCloseUrlCache
GopherGetLocatorTypeA
InternetGoOnline
InternetFortezzaCommand
HttpEndRequestW
HttpQueryInfoA
IsHostInProxyBypassList
RegisterUrlCacheNotification
CreateUrlCacheContainerW
HttpSendRequestW
InternetWriteFileExW
InternetLockRequestFile
InternetAlgIdToStringA
IncrementUrlCacheHeaderData
ShowX509EncodedCertificate
FtpFindFirstFileA
HttpEndRequestA
InternetCreateUrlA
GopherFindFirstFileW
FtpFindFirstFileW
InternetGetLastResponseInfoW
GetUrlCacheEntryInfoExW
ResumeSuspendedDownload
FindNextUrlCacheEntryExA
InternetAutodialHangup
FindFirstUrlCacheContainerW
GetUrlCacheHeaderData
InternetConnectW
GopherGetLocatorTypeW
FindFirstUrlCacheEntryExA
InternetGetCookieA
GetUrlCacheConfigInfoW
InternetShowSecurityInfoByURLW
InternetOpenA
InternetSetCookieW
InternetQueryFortezzaStatus
FtpSetCurrentDirectoryW
InternetGetCertByURL
InternetCanonicalizeUrlA
DeleteUrlCacheEntryA
SetUrlCacheGroupAttributeA
InternetConnectA
DeleteIE3Cache
InternetGoOnlineA
InternetCreateUrlW
HttpCheckDavCompliance
FtpGetFileSize
InternetReadFileExW
InternetCombineUrlW
FindNextUrlCacheContainerA
InternetSetOptionExA
InternetTimeToSystemTime
InternetSetOptionW
SetUrlCacheConfigInfoA
UnlockUrlCacheEntryFileA
kernel32
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
LoadLibraryA
RtlUnwind
InterlockedExchange
VirtualQuery
HeapReAlloc
HeapAlloc
HeapFree
VirtualAlloc
HeapUnlock
GetConsoleScreenBufferInfo
WritePrivateProfileStructW
PeekNamedPipe
MulDiv
GetProfileSectionW
FlushConsoleInputBuffer
FillConsoleOutputCharacterW
WritePrivateProfileStructA
lstrcpynA
EnumDateFormatsW
CreateWaitableTimerW
GlobalFlags
DeleteFiber
GetPrivateProfileIntW
CreateEventA
DisableThreadLibraryCalls
GetDateFormatW
GlobalAddAtomW
UpdateResourceW
ReadConsoleInputW
ConvertDefaultLocale
TransactNamedPipe
UnmapViewOfFile
SetCriticalSectionSpinCount
SetVolumeLabelW
FindResourceExA
CreateProcessA
ReadConsoleInputA
OpenFileMappingA
GetCurrencyFormatW
GlobalFix
CompareFileTime
FindCloseChangeNotification
lstrcpy
SetComputerNameA
SetCurrentDirectoryW
DefineDosDeviceW
GetConsoleTitleA
SetWaitableTimer
FileTimeToSystemTime
ExpandEnvironmentStringsA
GetSystemTimeAdjustment
GetEnvironmentVariableA
GetSystemInfo
GetFullPathNameA
VirtualFreeEx
GetSystemDirectoryA
GetVolumeInformationW
FreeEnvironmentStringsA
CreateMailslotW
WriteFileGather
LocalFree
SetEnvironmentVariableA
TlsSetValue
WriteProfileSectionA
SetConsoleMode
GetFileAttributesA
GetNumberFormatW
GetNamedPipeInfo
VirtualQueryEx
OpenWaitableTimerA
EnumSystemCodePagesW
GetCurrentDirectoryA
SetCurrentDirectoryA
GetThreadLocale
EnumDateFormatsExW
TryEnterCriticalSection
CreateSemaphoreA
FindNextFileW
WriteConsoleOutputW
GetLogicalDrives
CommConfigDialogA
GetCalendarInfoA
LocalLock
LoadLibraryExW
WaitForSingleObject
GlobalGetAtomNameA
SystemTimeToTzSpecificLocalTime
SetConsoleCP
CreateWaitableTimerA
CopyFileExA
EnumResourceNamesW
CreateFileW
DeleteAtom
ExpandEnvironmentStringsW
WaitCommEvent
GetWindowsDirectoryW
GetProcessAffinityMask
LoadModule
SetSystemTimeAdjustment
GetSystemDefaultLangID
GetStartupInfoA
LocalUnlock
GetThreadPriorityBoost
GetThreadPriority
GetShortPathNameW
WriteConsoleOutputCharacterW
GetDiskFreeSpaceExW
GetComputerNameA
GetLogicalDriveStringsW
CreateTapePartition
LeaveCriticalSection
SetEndOfFile
SetConsoleCursorPosition
SetConsoleScreenBufferSize
GetProcAddress
GetQueuedCompletionStatus
WaitForDebugEvent
GetSystemDirectoryW
SetThreadLocale
GetVolumeInformationA
CreateDirectoryA
DeviceIoControl
GetPrivateProfileSectionA
WideCharToMultiByte
GetSystemDefaultLCID
GlobalAddAtomA
Heap32Next
WriteFile
FindResourceExW
SetThreadIdealProcessor
WritePrivateProfileSectionA
SleepEx
FindFirstFileExA
ReadConsoleW
IsDebuggerPresent
GetDriveTypeA
EnumResourceLanguagesA
TlsAlloc
FindFirstChangeNotificationA
VirtualUnlock
CreateRemoteThread
GetWindowsDirectoryA
DeleteFileA
FindClose
GetTempFileNameA
ReadConsoleOutputA
EnumSystemLocalesA
GetNumberOfConsoleInputEvents
FreeLibraryAndExitThread
Heap32ListNext
GlobalWire
GetModuleHandleW
SetConsoleTextAttribute
DeleteCriticalSection
RemoveDirectoryA
EnumTimeFormatsW
lstrlenW
GlobalReAlloc
lstrlen
GetPrivateProfileSectionNamesA
InterlockedIncrement
SetTimeZoneInformation
LocalAlloc
FlushFileBuffers
EnterCriticalSection
EnumDateFormatsA
GetConsoleCursorInfo
SetVolumeLabelA
FindResourceW
CreateMailslotA
GetCurrentDirectoryW
GetFullPathNameW
EnumResourceNamesA
LockFile
RtlFillMemory
ExitThread
GetProfileSectionA
GlobalHandle
lstrcmp
VirtualFree
GetTimeZoneInformation
GetNumberOfConsoleMouseButtons
EnumCalendarInfoExW
GetEnvironmentStringsW
GetDiskFreeSpaceExA
DebugBreak
RemoveDirectoryW
EnumCalendarInfoW
OpenProcess
GetVersion
WaitNamedPipeW
SetFileAttributesA
GlobalLock
GetConsoleOutputCP
InterlockedCompareExchange
LockResource
MoveFileA
lstrcmpA
SetThreadContext
MapViewOfFile
lstrcpyA
FileTimeToLocalFileTime
WriteProcessMemory
ReadFileEx
OpenSemaphoreW
TlsFree
LoadLibraryW
DefineDosDeviceA
SetEnvironmentVariableW
SetLocaleInfoA
CreatePipe
GetProcessHeaps
FindNextChangeNotification
CreateDirectoryW
GetStdHandle
GetWriteWatch
SystemTimeToFileTime
SetConsoleCursorInfo
GetEnvironmentVariableW
WritePrivateProfileStringW
Thread32First
GetStringTypeW
GetCompressedFileSizeA
FlushInstructionCache
VirtualLock
SetFilePointer
GetStringTypeExW
GetProcessShutdownParameters
GetConsoleCP
GetCurrentThread
GetExitCodeThread
lstrcat
WriteProfileStringA
SetLocalTime
InitializeCriticalSectionAndSpinCount
FindResourceA
ContinueDebugEvent
CreateDirectoryExA
HeapDestroy
Heap32ListFirst
GetExitCodeProcess
OutputDebugStringW
GetPrivateProfileStringW
ReadFileScatter
WriteProfileStringW
MoveFileExW
lstrcmpi
VirtualProtect
SetLastError
GetDateFormatA
EnumCalendarInfoA
GetPrivateProfileStructA
GetLogicalDriveStringsA
GetLocaleInfoW
GetEnvironmentStringsA
GetAtomNameA
lstrcmpiA
CreateToolhelp32Snapshot
OpenEventA
ReleaseMutex
WriteFileEx
GetCurrencyFormatA
FindFirstChangeNotificationW
WritePrivateProfileStringA
RtlMoveMemory
TerminateThread
Toolhelp32ReadProcessMemory
FoldStringW
SetFileAttributesW
GetLocaleInfoA
SetConsoleCtrlHandler
EnumTimeFormatsA
DebugActiveProcess
CommConfigDialogW
GlobalMemoryStatus
Sections
.text Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 242KB - Virtual size: 241KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE