Behavioral task
behavioral1
Sample
WINDOW~2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
WINDOW~2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
WR-1-1~1.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
WR-1-1~1.exe
Resource
win10v2004-20231222-en
General
-
Target
0bd32cc38488beac5dd83182771e1667
-
Size
216KB
-
MD5
0bd32cc38488beac5dd83182771e1667
-
SHA1
fc7f7a23d406542cb20cbf6a75e40af4fb2510a3
-
SHA256
3f7e7127795d8f679076787a5892666d252b9c3829a4883b008a470bf2af6356
-
SHA512
23c1fbbfce1477af0c279eba2fca3982f8d5604bf1f6087364da1168568d51aac1115e9516d794503d8ca6fcfd1db29e3bb5812eef2cdc94aec4e47378a2edb9
-
SSDEEP
6144:1Ql4zCOgme1CYgQ/mr9OhAZgwn2y1SeYo:1Ql4zJrQepO+gwN1+o
Malware Config
Signatures
-
resource yara_rule static1/unpack001/WR-1-1~1.EXE upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/WINDOW~2.EXE unpack001/WR-1-1~1.EXE unpack002/out.upx
Files
-
0bd32cc38488beac5dd83182771e1667.cab
-
WINDOW~2.EXE.exe windows:4 windows x86 arch:x86
2708fa830210c1b38320724db051ad7c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualQuery
FlushFileBuffers
lstrlenA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
CompareStringA
ReadFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidCodePage
IsValidLocale
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
CompareStringW
CreateFileA
GetLastError
GetFileSize
SetFilePointer
WriteFile
CloseHandle
GetLocaleInfoW
GetModuleHandleA
RaiseException
HeapValidate
IsBadReadPtr
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleFileNameW
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetModuleFileNameA
HeapReAlloc
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
ExitProcess
GetACP
GetOEMCP
GetCPInfo
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
MultiByteToWideChar
DebugBreak
OutputDebugStringA
WriteConsoleW
OutputDebugStringW
SetConsoleCtrlHandler
LoadLibraryW
InitializeCriticalSection
RtlUnwind
LoadLibraryA
FreeLibrary
InterlockedExchange
LCMapStringA
LCMapStringW
SetEnvironmentVariableA
user32
GetSystemMetrics
MoveWindow
GetDlgItemTextA
SetDlgItemTextA
LoadIconA
LoadCursorA
RegisterClassExA
GetMessageA
TranslateMessage
DispatchMessageA
BeginPaint
LoadBitmapA
GetClientRect
EndPaint
DefWindowProcA
CreateWindowExA
SendMessageA
PostQuitMessage
GetWindowRect
GetCursorPos
MessageBoxA
gdi32
CreateSolidBrush
CreateCompatibleDC
SelectObject
BitBlt
CreateFontA
SetTextColor
SetBkColor
SetBkMode
GetStockObject
Sections
.text Size: 408KB - Virtual size: 407KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 156KB - Virtual size: 152KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
WR-1-1~1.EXE.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
FGkn Size: - Virtual size: 52KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
FGkn Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ