Static task
static1
Behavioral task
behavioral1
Sample
21fba63754c31e4d2743ec8af5439885.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
21fba63754c31e4d2743ec8af5439885.exe
Resource
win10v2004-20231215-en
General
-
Target
21fba63754c31e4d2743ec8af5439885
-
Size
300KB
-
MD5
21fba63754c31e4d2743ec8af5439885
-
SHA1
d10699a86e7810558b40934ae4cf36d72ff1731d
-
SHA256
404113ddb1ea80ad90044b421d9835e0de6186f298fbef215593843918c8da9e
-
SHA512
0120393b4bd27f765e6e14ed0d20efced197966d76db6d4ad17f11d5dbb6b007ce4b8221ae2af4b9267413cc4e674962496ea711fbc3919820727c36cb092fcd
-
SSDEEP
3072:dfGrpvXWJyzHqyYB4fGT3uctPhha50wjVJabrIYONqu6Hqo:dfGrpvBYB4OTeuh050wjHgIHqdK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 21fba63754c31e4d2743ec8af5439885
Files
-
21fba63754c31e4d2743ec8af5439885.exe windows:4 windows x86 arch:x86
988aefaa709d592451f1efd698fe20a5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
kernel32
EnterCriticalSection
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetDriveTypeA
GetCurrentDirectoryA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualProtect
InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetModuleHandleW
GetCurrentThreadId
SetEvent
CloseHandle
CreateEventW
AddAtomW
DeleteCriticalSection
FindFirstFileW
FindClose
FindNextFileW
RaiseException
SetLastError
FlushInstructionCache
GetCurrentProcess
lstrlenW
LeaveCriticalSection
GetModuleHandleA
InterlockedExchange
GetLastError
LocalAlloc
FreeLibrary
LoadLibraryA
GetVersionExA
InterlockedCompareExchange
HeapFree
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
HeapReAlloc
GetFullPathNameW
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
Sleep
user32
LoadImageW
RegisterWindowMessageW
GetClassNameW
PostMessageW
GetDlgItem
ShowWindow
GetWindow
SetFocus
SendMessageW
EnableWindow
GetDC
ReleaseDC
SetWindowTextW
PostQuitMessage
LoadBitmapW
MessageBoxW
IsDialogMessageW
DestroyWindow
GetWindowPlacement
SetWindowPlacement
SetCursor
CreateDialogParamW
LoadCursorW
SetWindowLongW
SetDlgItemTextW
GetWindowTextLengthW
GetWindowTextW
IsWindow
UpdateWindow
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
UnregisterClassA
gdi32
DeleteDC
CreateCompatibleDC
GetTextExtentPoint32W
comdlg32
CommDlgExtendedError
GetOpenFileNameW
shell32
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ole32
OleUninitialize
OleInitialize
CoCreateInstance
groovenew
?GrooveNew@@YAPAXI@Z
?GrooveDelete@@YAXPAX@Z
grooveutil
??0GCSmartExceptionFilter@@QAE@_N@Z
?Uninit@GCMso@@SGX_N@Z
?Init@GCMso@@SGXXZ
??1GCSmartInvalidParameterHandler@@QAE@XZ
??0GCSmartInvalidParameterHandler@@QAE@_N@Z
??1GCSmartTerminateHandler@@QAE@XZ
??0GCSmartTerminateHandler@@QAE@_N@Z
??1GCSmartExceptionTranslator@@UAE@XZ
??0GCSmartExceptionTranslator@@QAE@_N0@Z
?InitThread@GCMso@@SGXXZ
?Initialize@GCErrorServices@@SGXJJ@Z
?HandleAllErrorCatch@@YGXXZ
?Append@GCStackStrBase@@QAEX_W@Z
?ms_GlobalPointersInitializationSemaphore@GCUtilDLL@@2VGCReentrantSemaphore@@A
?FindOneOf@raw_GCStr@@SG_NPB_W0AAKPA_W@Z
?First@raw_GCStr@@SG?AVGCStrRetVal@@PB_WK@Z
?Format@GCStr@@QAAJPB_WZZ
?AllocateHashTable@@YGPAXK@Z
?ToPowerOf2@@YGKK@Z
?Compare@GCStr@@QBEJPB_W@Z
?Hash@@YGKPBEKK@Z
?DeallocateHashTable@@YGXPAXK@Z
?SetFromResource@GCStackStrBase@@QAEXKQAUHINSTANCE__@@@Z
?CompareNoCase@raw_GCStr@@SGJPB_W0@Z
?CreateInstanceNoRelease@GCIPtrBase@@IAEXABU_GUID@@0K@Z
?QueryInterfaceNoRelease@GCIPtrBase@@IAEXABU_GUID@@PAUIUnknown@@@Z
??1GCSmartExceptionFilter@@QAE@XZ
?int_RawError@GCError@@CG?AV1@KJ@Z
?LongToString@raw_GCStr@@SGXJPAVGCStackStrBase@@J@Z
??0GCStr@@QAE@PB_W@Z
?MessageFormat@GCStackStrBase@@QAEJKQB_W000ABVGCLocale@@QAUHINSTANCE__@@@Z
??1GCLocale@@QAE@XZ
?GetDefault@GCLocale@@SG?BV1@XZ
?_Release@GCStr@@AAEXXZ
?Equals@GCStr@@QBE_NPB_W@Z
?Set@GCStr@@QAEXPB_W@Z
?int_Win32Error@GCError@@CG?AV1@KK@Z
?int_DeallocateBufferIfNecessary@GCStackStrBase@@AAEXAAPA_W@Z
?Append@GCStackStrBase@@QAEXQB_WK@Z
?Equals@raw_GCStr@@SG_NPB_W0@Z
?Last@raw_GCStr@@SGXPB_WKPAVGCStackStrBase@@@Z
?Length@raw_GCStr@@SGKABVGCStackStrBase@@@Z
?SetFromResource@GCStr@@QAEXKQAUHINSTANCE__@@@Z
?GetWorkAreaRect@GCWindowHelpers@@SG_NAAUtagRECT@@_NQAUHWND__@@PBU2@PBUtagPOINT@@@Z
?FindLastChar@raw_GCStr@@SG_NPB_W_WAAK@Z
?GetBrandedApplicationName@GCMso@@SGPB_WXZ
?GetHandle@GCGrooveResourceModule@@SGPAUHINSTANCE__@@XZ
?Set@GCStackStrBase@@QAEXQB_WK@Z
?HandleMessageMapErrorCatch@@YGXKIJ@Z
?Empty@GCIPtrBase@@QAEXXZ
??1GCError@@QAE@XZ
??0GCError@@QAE@XZ
?Set@GCError@@QAEXJPAUIUnknown@@ABU_GUID@@@Z
?int_COMError@GCError@@CG?AV1@JPAUIUnknown@@ABU_GUID@@11@Z
?EndErrorBlock@GCCriticalErrorInfo@@SGXXZ
?StartErrorBlock@GCCriticalErrorInfo@@SGX_N@Z
?InitCOM@GCMso@@SGXXZ
?UninitCOM@GCMso@@SGXXZ
?HandleAllCriticalErrorCatch@@YGXXZ
?TraceShutDown@GCCSM@@SGXXZ
?TerminateGrooveProcess@GCError@@SGXPBV1@K_NJPBU_EXCEPTION_POINTERS@@@Z
??1GCAnyIPtr@@QAE@XZ
?Append@GCStr@@QAEXPB_W@Z
?Set@GCErrorInfo@@SGXPAUIErrorInfo@@@Z
?Throw@GCError@@QBEXXZ
atl80
ord44
ord64
ord43
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.trdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE