Behavioral task
behavioral1
Sample
0f2c074541c37a1055b128a8b3d95ec7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0f2c074541c37a1055b128a8b3d95ec7.exe
Resource
win10v2004-20231222-en
General
-
Target
0f2c074541c37a1055b128a8b3d95ec7
-
Size
370KB
-
MD5
0f2c074541c37a1055b128a8b3d95ec7
-
SHA1
3e2db8ec63eba73e038f8eb915f2cda49ec03bd1
-
SHA256
33f3832e9c34b69fce0076345c02e53bfbbcdcd1419e3bbf5444fb5c112fe3b2
-
SHA512
8fc2218b00d3a0b3b08a1fc94c532a71147d7ea67b570a620be2aa9f8c1b735248c35bdfa7a6ccc34d48cfdf4a48c685b03ffa9a3952764fa18d9e88c4a026d9
-
SSDEEP
6144:aSKmnlw34BUqTxOo6fDTcVnfGyTZkp/j9:aSKmnlwIemxOo6fXcVfHkp/B
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f2c074541c37a1055b128a8b3d95ec7
Files
-
0f2c074541c37a1055b128a8b3d95ec7.exe windows:4 windows x86 arch:x86
3a6c3ba951fa63081dd51db0a0861fc7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
WaitForSingleObject
TerminateThread
CreateThread
SetEvent
CreateEventA
lstrlenA
InterlockedIncrement
InterlockedDecrement
WinExec
GetModuleFileNameA
MultiByteToWideChar
RaiseException
GetLastError
DeleteFileA
lstrcmpiA
lstrlenW
lstrcpynA
ReadFile
GetFileSize
CreateFileA
IsDBCSLeadByte
WriteFile
SetEndOfFile
SetFilePointer
Sleep
GetFileAttributesExA
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
SetStdHandle
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
FlushFileBuffers
IsBadWritePtr
VirtualFree
HeapCreate
GetCurrentProcess
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetStringTypeW
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetStringTypeA
GetOEMCP
SetUnhandledExceptionFilter
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetLocaleInfoW
GetCPInfo
LCMapStringW
LCMapStringA
GetCommandLineA
GetStartupInfoA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
ExitProcess
GetProcessHeap
HeapSize
FreeLibrary
GetProcAddress
LoadLibraryA
SetFileAttributesA
CreateDirectoryA
FindClose
FindNextFileA
FindFirstFileA
RemoveDirectoryA
GetSystemTimeAsFileTime
GetSystemDirectoryA
GetWindowsDirectoryA
GetFileAttributesA
CreateProcessA
QueryPerformanceFrequency
QueryPerformanceCounter
DeviceIoControl
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
gdi32
SetBkColor
CreateFontA
CreateSolidBrush
DeleteObject
SetTextColor
netapi32
Netbios
ole32
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
oleaut32
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHGetSpecialFolderLocation
shlwapi
SHDeleteKeyA
user32
SetWindowTextA
GetWindowLongA
SendMessageA
GetDlgItem
MessageBoxA
GetWindowTextA
PostMessageA
GetWindowRect
ScreenToClient
SetWindowPos
InvalidateRect
EnableWindow
IsDlgButtonChecked
SetWindowLongA
LoadCursorA
SetCursor
EndDialog
CharNextA
CreateDialogParamA
ShowWindow
UpdateWindow
DestroyWindow
DialogBoxParamA
CheckRadioButton
CheckDlgButton
wininet
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
InternetCanonicalizeUrlA
Sections
UPX0 Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE