Static task
static1
Behavioral task
behavioral1
Sample
42c976bbcc7327a8a6342a1758489f9b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
42c976bbcc7327a8a6342a1758489f9b.exe
Resource
win10v2004-20231215-en
General
-
Target
42c976bbcc7327a8a6342a1758489f9b
-
Size
150KB
-
MD5
42c976bbcc7327a8a6342a1758489f9b
-
SHA1
2a1e38ba73cf6bd5ea7c9bf265b77fa643a951a5
-
SHA256
32f45d6b5020af637aad46fa1fa52c0f0dad208d16fb2fc1181941c3b7d11b98
-
SHA512
335958c4522e7d9c84f0497aa2efd22032c24785dc7dc485b4a0af7f53ff0b7b917d9a8d1198e729d99e9f6029c93fbce44c476705916ff6bc9aebe757242a22
-
SSDEEP
3072:x5dK/xA+S1S6r4GB2gvSJIOOFYLilGblYJG:xs++GSOFBZOnt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42c976bbcc7327a8a6342a1758489f9b
Files
-
42c976bbcc7327a8a6342a1758489f9b.exe windows:6 windows x86 arch:x86
8fccedf3099f8df74b73bc7dc0cfc0d1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
kernel32
LoadResource
FindResourceW
GetLastError
CloseHandle
WaitForSingleObject
LoadLibraryW
GetProcAddress
GetModuleHandleW
lstrcmpiW
FlushInstructionCache
GetCurrentProcess
Sleep
CreateThread
CreateEventW
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
DeleteFileW
SetEvent
SetLastError
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
LockResource
GetLocaleInfoW
GetCommandLineW
HeapSetInformation
FindResourceExW
SetFilePointer
CreateFileW
WriteFile
RegisterApplicationRestart
CreateProcessW
GetSystemDirectoryW
ResetEvent
GetTempFileNameW
GetTempPathW
LocalFree
FormatMessageW
GetCurrentDirectoryW
MoveFileExW
EnumUILanguagesW
GetUserDefaultUILanguage
GetTimeFormatW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
SizeofResource
GetModuleFileNameW
DeleteCriticalSection
RaiseException
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetVersionExA
InterlockedExchange
LoadLibraryA
VirtualFree
VirtualAlloc
GetStartupInfoW
InitializeCriticalSection
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
lstrlenW
UnhandledExceptionFilter
OutputDebugStringA
gdi32
GetObjectW
DeleteObject
user32
PostQuitMessage
FindWindowW
MessageBoxW
AdjustWindowRect
BringWindowToTop
CreateWindowExW
RegisterClassExW
GetDesktopWindow
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
SetCursor
LoadCursorW
GetClassInfoExW
IsWindow
SetFocus
ShowWindow
GetClientRect
GetWindowRect
MoveWindow
PostMessageW
SetWindowLongW
CharUpperW
GetWindow
GetTopWindow
SetWindowPos
GetWindowLongW
DefWindowProcW
CallWindowProcW
UnregisterClassA
LoadIconW
GetAncestor
CharNextW
LoadAcceleratorsW
LoadImageW
SetTimer
LoadMenuW
GetSubMenu
TrackPopupMenu
DestroyMenu
MapWindowPoints
TranslateAcceleratorW
KillTimer
LoadStringW
CreateDialogParamW
PostThreadMessageW
DestroyWindow
PeekMessageW
SwitchToThisWindow
msvcrt
malloc
memcpy_s
??_V@YAXPAX@Z
wcsncpy_s
memmove_s
swprintf_s
memset
_controlfp
?terminate@@YAXXZ
_onexit
_lock
free
__p__fmode
__dllonexit
_unlock
_errno
realloc
_except_handler4_common
__set_app_type
??3@YAXPAX@Z
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_wcsicmp
_vsnwprintf
??2@YAPAXI@Z
??_U@YAPAXI@Z
_purecall
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoInitialize
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
VarUI4FromStr
shell32
ord190
SHCreateItemFromIDList
SHCreateItemFromParsingName
ShellAboutW
ord165
Shell_NotifyIconW
SHGetDiskFreeSpaceExW
ord75
ord155
SHGetFolderPathW
comctl32
ImageList_Create
ImageList_Add
ImageList_Destroy
ord17
winmm
timeGetTime
timeSetEvent
waveInGetDevCapsW
waveInGetNumDevs
timeKillEvent
shlwapi
StrToIntW
PathUnquoteSpacesW
PathRemoveBlanksW
StrChrW
PathStripToRootW
PathFindExtensionW
PathIsDirectoryW
PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
PathCombineW
StrStrW
uxtheme
SetWindowTheme
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 30KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mkpaese Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE