Static task
static1
Behavioral task
behavioral1
Sample
423014192e2e9a0bf7dcd5271a8f2d8a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
423014192e2e9a0bf7dcd5271a8f2d8a.exe
Resource
win10v2004-20231215-en
General
-
Target
423014192e2e9a0bf7dcd5271a8f2d8a
-
Size
89KB
-
MD5
423014192e2e9a0bf7dcd5271a8f2d8a
-
SHA1
7438dc96dcb671f7a83f99b458a75295d375f82f
-
SHA256
52d57e1e658bdff49282e7f466ed727d91910c873e2b9d904ed9de56c95bd5b3
-
SHA512
bee1ec7d621b6e2ac514401a67a36f532dab4c248b05857f871fb1178c396de7b48031c486696c8a004ff8d564deb8f23aa67319ea3690ed5dd13577f7319c48
-
SSDEEP
1536:8JoCTE1r5lBYfqf3P62I00a5HsTTx2ORFK7ULAD5:wZY1r5MfiLv5Ha2ORFGULY5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 423014192e2e9a0bf7dcd5271a8f2d8a
Files
-
423014192e2e9a0bf7dcd5271a8f2d8a.exe windows:5 windows x86 arch:x86
a19234b6ae0ec38914acebf111d4c344
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gamevancelib32
?GetExcludedUrlsSeq@@YGKPAD@Z
GetUuid
?HostToIP@@YGHPAD0K@Z
?Base64EncodeFunc@@YGHPAD0H@Z
?CanCheckPopup@@YGHPAU_TSharedStruct@@PAU_tagPopupInfo@@@Z
?GetWindowsProductId@@YGHPADK@Z
?GetDefaultCfgServer@@YGHPADK0@Z
?IsWindowsVista@@YAHXZ
?GetGeoIPCountryCode@@YGHPADH0@Z
?SetLastPopupTimeNT@@YGHU_FILETIME@@PAD@Z
?string_table_delete_all@@YGHPAUst_string_table@@@Z
?SetExcludedUrlsSeq@@YGHKPAD@Z
?SetPopupCountNT@@YGHKPAD@Z
SetAdLocation
?ParsePopupData@@YGHPADPAU_tagPopupData@@@Z
?SetCheckPopServer@@YGHPAD0@Z
?SetClientId@@YGHPAD0@Z
?SaveQoolPopups_T@@YGHPAU_tagQoolPopup@@PAD@Z
?SetLastPopupTimeT@@YGHU_FILETIME@@PAD@Z
?SaveQoolPopups_NT@@YGHPAU_tagQoolPopup@@PAD@Z
?SetPopupInProgress@@YGHH@Z
?SetPopupCountT@@YGHKPAD@Z
?SetGeoIPCountryCode@@YGHPAD0@Z
?ShowPopupInDefaultBrowser@@YGHKPAU_tagPopupData@@@Z
?ShowPopupInDefaultBrowser2@@YGHKPAU_tagPopupData@@@Z
?AddFiredPid@@YGHPAPAU_tagQoolPopup@@HH@Z
?xml_parse_config@@YGHPADPAPAU_tagCONFIG_STRUCT@@PAHPAUst_string_table@@@Z
?SetPopupsStatusDisabled@@YGHKPAD@Z
?string_table_add@@YGHPAUst_string_table@@PAD@Z
?SetDefaultCfgServer@@YGHPAD0@Z
?GetLastPopupTimeNT@@YG?AU_FILETIME@@PAD@Z
?GetLastPopupTimeT@@YG?AU_FILETIME@@PAD@Z
?RemoveOldPopups@@YGHPAPAU_tagQoolPopup@@@Z
?IsPopupInProgress@@YGHXZ
?GetClientId@@YGHPADK0@Z
?DeleteRecoveryModule@@YAXXZ
?GetUniqueClientId@@YGHPADK@Z
GetAdLocation
?GetClientInstallDate@@YG?AU_FILETIME@@XZ
?FindBrowserWindow@@YGPAUHWND__@@K@Z
?IsPopupEngineDisabled@@YGHXZ
?IsHeaderFirstRun@@YGHXZ
?GetCfgFilePath@@YGHPADH@Z
?LoadFiredPopups_T@@YGHPAPAU_tagQoolPopup@@PAD@Z
?GetOSVersionString@@YGHPADK@Z
?string_table_alloc@@YGHPAPAUst_string_table@@@Z
?IsWindowsMe@@YGHXZ
?GetWS2SendFrame@@YGHPADK@Z
?GetIEVersion@@YGXPADK@Z
?ScheduleFileUpdate@@YGXPAD0@Z
?FileTimeSecondsBetween@@YG_JU_FILETIME@@0@Z
?GetHardwareHashCrcHex@@YGHPADH@Z
?GetPopupCountT@@YGKPAD@Z
?GetCrc64@@YGHPADK0@Z
?ParsePacketContent@@YGHPAU_tagHttpData@@PAUHWND__@@PAUst_string_table@@2PAPAU_tagQoolPopup@@3H@Z
?ModuleFromAddress@@YGPAUHINSTANCE__@@PAX@Z
?LoadFiredPopups_NT@@YGHPAPAU_tagQoolPopup@@PAD@Z
?SetClientInstallDate@@YGXU_FILETIME@@@Z
?GetPopupCountNT@@YGKPAD@Z
?GetCheckPopServer@@YGHPADK0@Z
?SetCrc64@@YGHPAD0@Z
shlwapi
StrNCatA
StrStrA
wnsprintfA
StrStrIA
kernel32
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetLocaleInfoA
HeapSize
RtlUnwind
VirtualAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
LeaveCriticalSection
QueryPerformanceCounter
VirtualFree
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
DeleteCriticalSection
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStdHandle
GetModuleHandleW
GetStartupInfoA
GetCommandLineA
EnterCriticalSection
IsBadReadPtr
ReleaseMutex
OpenMutexA
ExitProcess
lstrlenA
MapViewOfFile
lstrcpynA
HeapAlloc
SetUnhandledExceptionFilter
SystemTimeToFileTime
HeapFree
GetTickCount
GetProcessHeap
GetSystemTimeAsFileTime
Sleep
CreateProcessA
IsBadWritePtr
GetLastError
GetProcAddress
GetLocalTime
LoadLibraryA
CreateFileMappingA
GetModuleFileNameA
CreateMutexA
CloseHandle
GetCurrentProcessId
LocalFree
lstrcpyA
lstrcatA
HeapReAlloc
VirtualQuery
WriteFile
HeapDestroy
HeapCreate
GetCurrentThreadId
GetModuleHandleA
WaitForSingleObject
user32
GetLastInputInfo
DefWindowProcA
CreateWindowExA
TranslateMessage
SendMessageA
ShowWindow
PostQuitMessage
RegisterClassExA
SetTimer
GetMessageA
DestroyWindow
RegisterWindowMessageA
PostMessageA
DispatchMessageA
FindWindowA
KillTimer
advapi32
SetNamedSecurityInfoA
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegCloseKey
RegDeleteValueA
ole32
CoInitialize
Sections
.text Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ