Static task
static1
Behavioral task
behavioral1
Sample
3286e8f70a369a5e7cfa9e58378e3bf3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3286e8f70a369a5e7cfa9e58378e3bf3.exe
Resource
win10v2004-20231215-en
General
-
Target
3286e8f70a369a5e7cfa9e58378e3bf3
-
Size
518KB
-
MD5
3286e8f70a369a5e7cfa9e58378e3bf3
-
SHA1
c5541603f1ac8e873333c60b85623188600ac47c
-
SHA256
f019f99a8f9c2b608b3cebf1edbd6950674d66096faf9d8bc370444b491bcd63
-
SHA512
b445c11929e962a6f1493b29c6fe23fda78919434eb9204e75489b12a4bc7e2b8510a4de514b97c8f946f66081dc9476ec1c60637cf2fd6dcd57f22a10c43586
-
SSDEEP
12288:9knm9T/3m4aLEsSIKETBCMCr1TuAmtFMCyvwt:Wm9T24akIKGo5CAmrivwt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3286e8f70a369a5e7cfa9e58378e3bf3
Files
-
3286e8f70a369a5e7cfa9e58378e3bf3.exe windows:4 windows x86 arch:x86
6ca694d34e653e68c0534968b2ec87e6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnumSystemCodePagesW
ReadConsoleOutputAttribute
GetCurrencyFormatW
GetThreadLocale
OpenFile
EnumTimeFormatsW
IsProcessorFeaturePresent
CreatePipe
SetEnvironmentVariableW
GetComputerNameW
FreeEnvironmentStringsA
SetMessageWaitingIndicator
GetTempPathA
VirtualProtect
ReadConsoleInputW
CancelWaitableTimer
WritePrivateProfileStringW
FormatMessageA
MoveFileExA
MapViewOfFile
GetDriveTypeA
FindFirstFileExW
VirtualAlloc
SetProcessWorkingSetSize
GetShortPathNameW
GetPriorityClass
SetConsoleCursorPosition
CreateMailslotW
EnumDateFormatsW
SetWaitableTimer
CancelDeviceWakeupRequest
GetPrivateProfileSectionNamesA
CreateWaitableTimerW
OutputDebugStringW
GetThreadSelectorEntry
BeginUpdateResourceW
lstrcmp
CreateConsoleScreenBuffer
GetShortPathNameA
ScrollConsoleScreenBufferA
IsBadStringPtrA
FoldStringW
FatalExit
OutputDebugStringA
GetBinaryTypeA
GetPrivateProfileIntA
lstrcpynA
SetFileAttributesW
lstrcmpW
GlobalFix
GetPrivateProfileStructW
GlobalFindAtomA
Heap32ListNext
DeleteFileA
ReadConsoleOutputCharacterW
EnumCalendarInfoA
GetThreadTimes
SetProcessShutdownParameters
DuplicateHandle
SetCalendarInfoW
EnumCalendarInfoW
FlushViewOfFile
FoldStringA
CreateDirectoryExW
CreateFileMappingW
WriteConsoleA
CreateRemoteThread
ReadFileScatter
GetDiskFreeSpaceExW
LockFileEx
WriteProfileSectionW
MultiByteToWideChar
SetCommState
EndUpdateResourceA
SetComputerNameW
WaitCommEvent
WritePrivateProfileSectionA
LockFile
SetFileAttributesA
SetCurrentDirectoryW
ConnectNamedPipe
GetAtomNameW
GlobalFindAtomW
SearchPathA
MapViewOfFileEx
GetCPInfoExW
SystemTimeToFileTime
GetThreadPriorityBoost
SetPriorityClass
GetProcessHeaps
lstrcpyA
GetVolumeInformationA
GlobalGetAtomNameA
Module32Next
EnumResourceNamesW
GetPrivateProfileIntW
FillConsoleOutputCharacterA
SetFileTime
CopyFileExW
WaitForMultipleObjects
CreateWaitableTimerA
FindFirstChangeNotificationW
WriteConsoleW
GetDriveTypeW
WaitNamedPipeA
OpenSemaphoreA
LoadLibraryExW
SetLastError
SetVolumeLabelA
SetProcessAffinityMask
TlsFree
GetLocaleInfoW
SwitchToFiber
GetHandleInformation
GetProfileIntW
AreFileApisANSI
SetCommBreak
GetPrivateProfileStringW
ReadProcessMemory
WaitForSingleObjectEx
IsDebuggerPresent
OpenMutexA
GetCurrentProcessId
GetCurrencyFormatA
ReleaseSemaphore
ole32
CreateDataAdviseHolder
ReadOleStg
CoSwitchCallContext
CoUnmarshalHresult
OleLoad
IsAccelerator
OleGetIconOfClass
CoImpersonateClient
OleInitialize
PropVariantCopy
CoLoadLibrary
CreateDataCache
StgCreateStorageEx
CoCreateInstanceEx
CoReleaseServerProcess
CoMarshalInterThreadInterfaceInStream
OleIsRunning
CoDosDateTimeToFileTime
OleConvertIStorageToOLESTREAMEx
ProgIDFromCLSID
CoRevokeClassObject
SetConvertStg
CoInitialize
OleCreateDefaultHandler
MkParseDisplayName
UtConvertDvtd32toDvtd16
OleConvertOLESTREAMToIStorageEx
CoGetCallContext
RegisterDragDrop
CoGetObject
CoReleaseMarshalData
OleLoadFromStream
GetHGlobalFromStream
StringFromIID
ReleaseStgMedium
OleBuildVersion
StgIsStorageILockBytes
CoSetProxyBlanket
CoBuildVersion
CoRegisterMallocSpy
OleCreateEx
OleGetAutoConvert
OleSaveToStream
OleRegGetMiscStatus
WriteClassStg
ReadFmtUserTypeStg
OleGetClipboard
CoRegisterSurrogate
OleGetIconOfFile
StringFromCLSID
CreateOleAdviseHolder
CoFreeLibrary
CoResumeClassObjects
FreePropVariantArray
DllDebugObjectRPCHook
ReadStringStream
CoGetStandardMarshal
CoUnmarshalInterface
OleDoAutoConvert
CoGetCurrentProcess
CreateAntiMoniker
OleCreateLinkFromData
CoGetClassObject
CoGetInterfaceAndReleaseStream
OleCreateMenuDescriptor
WriteClassStm
CLSIDFromString
CoGetInstanceFromIStorage
CoGetMalloc
OleCreateFromData
BindMoniker
CoIsOle1Class
OleIsCurrentClipboard
CreateBindCtx
CoQueryClientBlanket
UtGetDvtd32Info
OleNoteObjectVisible
CoInitializeSecurity
OleCreateLink
StgCreateDocfile
CreateItemMoniker
OleCreateLinkToFile
CoTaskMemFree
OleFlushClipboard
CoRevertToSelf
OleSetAutoConvert
OleCreateEmbeddingHelper
OleDestroyMenuDescriptor
CoDisconnectObject
OleRegEnumVerbs
GetDocumentBitStg
GetClassFile
CoTaskMemRealloc
WriteOleStg
DoDragDrop
CoCreateGuid
CoQueryAuthenticationServices
OleRegEnumFormatEtc
OleSave
IsEqualGUID
CoIsHandlerConnected
GetHGlobalFromILockBytes
OleRegGetUserType
CoGetCallerTID
CoFreeAllLibraries
GetConvertStg
CoGetCurrentLogicalThreadId
OleTranslateAccelerator
shlwapi
PathAddExtensionW
SHRegDeleteUSValueW
PathFindExtensionW
SHIsLowMemoryMachine
StrCmpIW
UrlCompareW
PathFindFileNameA
SHEnumKeyExA
SHRegSetUSValueW
PathFindSuffixArrayA
PathFindNextComponentA
ChrCmpIW
PathRemoveFileSpecW
StrRChrW
SHRegCreateUSKeyW
StrRetToStrA
StrStrIA
StrCmpNA
PathAppendA
PathQuoteSpacesA
PathMakePrettyW
PathRemoveFileSpecA
PathIsSystemFolderA
StrCatBuffW
wvnsprintfA
PathSearchAndQualifyW
PathIsSameRootW
SHQueryInfoKeyA
SHRegEnumUSValueA
PathFileExistsA
PathMakePrettyA
StrPBrkW
SHEnumKeyExW
UrlCombineA
UrlApplySchemeA
StrCSpnIA
PathCompactPathW
UrlGetPartW
PathGetCharTypeW
PathIsDirectoryEmptyA
SHRegQueryInfoUSKeyW
PathRenameExtensionA
PathUnmakeSystemFolderW
wvnsprintfW
StrCatW
PathRemoveBlanksA
UrlCanonicalizeA
StrCSpnIW
StrCmpNW
PathUnquoteSpacesA
PathIsContentTypeW
UrlHashW
PathCompactPathExW
PathGetDriveNumberA
PathAppendW
StrCpyNW
SHRegOpenUSKeyA
SHStrDupW
PathIsDirectoryA
PathUndecorateW
UrlEscapeW
StrFromTimeIntervalW
PathBuildRootA
PathFindExtensionA
PathRemoveBackslashW
SHCopyKeyW
UrlIsNoHistoryW
StrRChrIA
StrFormatByteSizeA
PathFileExistsW
SHRegWriteUSValueW
PathRemoveExtensionW
SHSetThreadRef
PathAddBackslashA
SHRegGetBoolUSValueA
ColorHLSToRGB
SHGetInverseCMAP
PathIsRootA
UrlCombineW
StrIsIntlEqualW
PathSearchAndQualifyA
PathFindFileNameW
PathCreateFromUrlW
SHDeleteKeyA
SHCreateStreamOnFileW
PathRelativePathToW
PathRemoveArgsA
SHSkipJunction
SHGetValueA
PathFindOnPathA
UrlApplySchemeW
SHRegDeleteEmptyUSKeyW
PathSetDlgItemPathA
SHCopyKeyA
PathSetDlgItemPathW
PathAddExtensionA
UrlCreateFromPathW
UrlGetLocationW
StrRChrIW
PathIsPrefixA
SHSetValueA
user32
GetDlgItemTextA
DdeUnaccessData
ScrollWindowEx
ChildWindowFromPoint
DispatchMessageW
EnumDesktopsA
EnumDesktopWindows
NotifyWinEvent
MessageBoxA
SetWindowsHookA
GetKeyboardLayoutNameA
SetShellWindow
CallMsgFilterW
DestroyCursor
EnumClipboardFormats
SetRect
DrawIconEx
SetMenuItemInfoA
IsDialogMessageW
SwitchDesktop
LoadIconW
GetDlgCtrlID
DdeImpersonateClient
CharLowerBuffA
CallMsgFilter
DragDetect
DestroyAcceleratorTable
GetWindowRect
OpenIcon
CharPrevW
IntersectRect
MapWindowPoints
FlashWindowEx
InvalidateRgn
CreateWindowStationW
SetUserObjectInformationA
IsWindow
CreateWindowExA
FindWindowExW
FreeDDElParam
GetClassInfoExA
CloseWindowStation
UnregisterHotKey
DefMDIChildProcW
TranslateAcceleratorW
SetMessageQueue
CopyIcon
GetDC
SetWindowPlacement
LoadMenuIndirectA
EndTask
DialogBoxIndirectParamW
MessageBoxIndirectW
SendDlgItemMessageA
CopyRect
CharUpperBuffA
GetKeyboardLayout
GetWindowModuleFileNameA
DlgDirListComboBoxW
GetMenuItemID
OpenInputDesktop
CharUpperW
GetScrollBarInfo
DdeQueryStringW
RegisterClassExW
LoadBitmapW
DdeSetQualityOfService
GetMenuBarInfo
SetWindowLongA
SetParent
SetMenuItemBitmaps
DialogBoxParamW
ReuseDDElParam
RegisterHotKey
GetInputDesktop
BeginDeferWindowPos
GetClassNameW
DefDlgProcW
UpdateWindow
HideCaret
DefFrameProcA
GetPriorityClipboardFormat
SetDebugErrorLevel
DdeDisconnect
DdeDisconnectList
SetSystemCursor
CharNextExA
SetMenuContextHelpId
DdeConnect
AnimateWindow
DdeGetLastError
GetMenuDefaultItem
IsCharLowerW
CharUpperA
OemToCharBuffA
CreateMenu
DdeQueryConvInfo
GetWindowThreadProcessId
PaintDesktop
GetClipCursor
MapVirtualKeyA
DrawAnimatedRects
ShowScrollBar
DestroyWindow
GetMenuCheckMarkDimensions
GetMonitorInfoA
GetSubMenu
GetAsyncKeyState
OpenClipboard
ToAscii
DlgDirSelectExA
CreateDesktopW
CheckRadioButton
CreateWindowStationA
SendIMEMessageExW
DlgDirListComboBoxA
DispatchMessageA
EnumDisplayMonitors
KillTimer
LoadCursorFromFileW
UnloadKeyboardLayout
EnumDisplaySettingsExA
LoadStringA
DdeConnectList
VkKeyScanA
RealChildWindowFromPoint
CreateIconIndirect
FindWindowExA
GetClassInfoExW
AdjustWindowRect
GetWindowTextA
GetDlgItemInt
GetMenuStringW
DdeClientTransaction
CreateIcon
SetCapture
DdeQueryNextServer
SetLastErrorEx
UnregisterClassA
CheckMenuRadioItem
SetWindowsHookExA
advapi32
CryptSetProviderW
SetServiceStatus
SetServiceObjectSecurity
GetTrusteeNameW
RegReplaceKeyA
RegOpenKeyA
DeleteAce
ObjectOpenAuditAlarmA
ChangeServiceConfigW
SetPrivateObjectSecurity
CryptSignHashA
GetSecurityDescriptorLength
GetOverlappedAccessResults
ChangeServiceConfigA
GetSidIdentifierAuthority
SetSecurityDescriptorDacl
GetSecurityInfoExA
SetThreadToken
GetSecurityDescriptorGroup
MapGenericMask
AreAnyAccessesGranted
SetSecurityDescriptorSacl
CryptCreateHash
RegDeleteValueA
RegUnLoadKeyA
QueryServiceObjectSecurity
LookupPrivilegeNameA
RegNotifyChangeKeyValue
EnumServicesStatusW
CryptVerifySignatureW
ImpersonateSelf
GetEffectiveRightsFromAclA
RegSetValueExW
RegCreateKeyExA
CryptImportKey
RegCloseKey
GetServiceDisplayNameW
PrivilegeCheck
NotifyChangeEventLog
SetEntriesInAuditListA
RegisterEventSourceA
CryptGetUserKey
ConvertAccessToSecurityDescriptorW
QueryServiceLockStatusW
GetTrusteeNameA
BuildExplicitAccessWithNameW
GetSecurityInfo
BackupEventLogA
MakeSelfRelativeSD
SetKernelObjectSecurity
LookupPrivilegeValueW
CryptAcquireContextW
RegRestoreKeyA
RegisterServiceCtrlHandlerA
RegDeleteKeyW
ConvertSecurityDescriptorToAccessA
CryptHashData
LookupPrivilegeDisplayNameA
CryptSignHashW
FindFirstFreeAce
OpenEventLogW
RegSetValueA
CryptDuplicateHash
RegisterServiceCtrlHandlerW
OpenEventLogA
AdjustTokenPrivileges
GetCurrentHwProfileW
LookupAccountNameA
GetSecurityDescriptorOwner
CryptDestroyHash
ConvertSecurityDescriptorToAccessW
AdjustTokenGroups
AbortSystemShutdownW
CryptSetProvParam
UnlockServiceDatabase
GetAce
OpenServiceW
BuildTrusteeWithNameW
CryptReleaseContext
GetTokenInformation
SetFileSecurityA
TrusteeAccessToObjectA
CryptSetHashParam
DeleteService
StartServiceA
ConvertSecurityDescriptorToAccessNamedW
CreateServiceA
RegQueryValueExA
CreateServiceW
GetUserNameW
RegSetValueExA
GetMultipleTrusteeA
InitializeSid
GetSecurityDescriptorControl
GetServiceDisplayNameA
SetTokenInformation
IsTextUnicode
GetCurrentHwProfileA
CryptEnumProvidersA
LogonUserA
GetAccessPermissionsForObjectW
CryptGetHashParam
OpenProcessToken
LookupAccountSidA
InitializeAcl
CryptGenRandom
RegReplaceKeyW
StartServiceCtrlDispatcherW
SetEntriesInAccessListA
ImpersonateLoggedOnUser
Sections
.text Size: 69KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 105B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE