Static task
static1
Behavioral task
behavioral1
Sample
1c89ee32cd2127a1abf853c050f95254.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1c89ee32cd2127a1abf853c050f95254.exe
Resource
win10v2004-20231215-en
General
-
Target
1c89ee32cd2127a1abf853c050f95254
-
Size
835KB
-
MD5
1c89ee32cd2127a1abf853c050f95254
-
SHA1
de1e8afb9475205b90e3f747bd57e8921dca7124
-
SHA256
75ea2486602c8f6478f5ab3800951b4513058360bdde4963bd915b2e10d2a42d
-
SHA512
e4c454706f16e418ffa03fa55840dfa45fbf7370e0d9672fc6807d27c5f96f44428fd064343802abceebab2427f0794152b4a7ea8a172c02daebeb3a8fe4acef
-
SSDEEP
24576:IS0EjtdXknwpdYesDuw50YzOJhzC/xagO705T3WnpT:l0EjtdXknwpdYEI0YzIzCJaH05T+T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1c89ee32cd2127a1abf853c050f95254
Files
-
1c89ee32cd2127a1abf853c050f95254.exe windows:4 windows x86 arch:x86
e878cb4683ce438c7b64a6d0b68002c5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shfolder
SHGetFolderPathA
wsock32
gethostbyaddr
WSAStartup
WSACleanup
wininet
InternetGetCookieA
InternetReadFile
HttpAddRequestHeadersA
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetOpenA
InternetOpenUrlA
InternetSetCookieA
iphlpapi
GetIpAddrTable
netapi32
Netbios
kernel32
SetEnvironmentVariableA
SetEndOfFile
GetLocaleInfoW
IsBadCodePtr
IsBadReadPtr
GetTickCount
QueryPerformanceCounter
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetEnvironmentStringsW
HeapSize
GetProcessHeap
GetSystemTime
GetLastError
InterlockedExchange
GetVersionExA
GetACP
GetLocaleInfoA
GetThreadLocale
MultiByteToWideChar
lstrlenA
CloseHandle
GetFileSize
CreateFileA
lstrcatA
lstrcpynA
ReleaseMutex
WaitForSingleObject
SetFileAttributesA
MoveFileA
DeleteFileA
GetVolumeInformationA
CopyFileA
GetModuleFileNameA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateMutexA
Sleep
InterlockedIncrement
InterlockedDecrement
CreateEventA
GetCurrentThreadId
LocalFree
LocalAlloc
FormatMessageA
CreateThread
ExitProcess
ReadFile
GetModuleHandleA
SetEvent
SetWaitableTimer
CreateWaitableTimerA
GetTempPathA
SetUnhandledExceptionFilter
OpenMutexA
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryA
SetErrorMode
OutputDebugStringA
TerminateProcess
HeapReAlloc
FindClose
FindNextFileA
FindFirstFileA
WriteFile
SizeofResource
FreeResource
LockResource
LoadResource
FindResourceA
FindCloseChangeNotification
FindNextChangeNotification
WaitForMultipleObjects
FindFirstChangeNotificationA
ExpandEnvironmentStringsA
GlobalAlloc
WideCharToMultiByte
FindResourceExA
CreateDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryA
CompareStringW
CompareStringA
InitializeCriticalSection
DeleteCriticalSection
RaiseException
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetStdHandle
GetOEMCP
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
RtlUnwind
IsBadWritePtr
VirtualFree
HeapCreate
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
LCMapStringW
LCMapStringA
GetCPInfo
GetCommandLineA
GetStartupInfoA
GetCurrentProcess
VirtualQuery
GetSystemInfo
VirtualAlloc
HeapFree
HeapAlloc
HeapDestroy
GetCurrentDirectoryA
SetCurrentDirectoryA
GetDriveTypeA
LeaveCriticalSection
GetFullPathNameA
GetSystemTimeAsFileTime
GetTimeZoneInformation
VirtualProtect
GetDateFormatA
GetTimeFormatA
EnterCriticalSection
user32
GetKeyboardLayoutNameA
ActivateKeyboardLayout
GetKeyboardLayout
GetKeyboardLayoutList
wsprintfA
GetForegroundWindow
SetActiveWindow
GetFocus
GetActiveWindow
AttachThreadInput
LoadStringA
SetPropA
SetWindowPos
FindWindowExA
GetDlgItem
GetPropA
RemovePropA
GetMessageA
CreateWindowExA
SetWindowLongA
MsgWaitForMultipleObjects
DefWindowProcA
PeekMessageA
DispatchMessageA
GetSystemMetrics
GetWindowThreadProcessId
TranslateMessage
advapi32
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
shell32
ShellExecuteA
ole32
CoUnmarshalInterface
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoCreateInstance
CoMarshalInterface
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
OleRun
oleaut32
GetErrorInfo
SysFreeString
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VariantInit
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
shlwapi
StrRChrA
StrChrA
Sections
.text Size: 643KB - Virtual size: 642KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ