Static task
static1
Behavioral task
behavioral1
Sample
4cf2d4ac22579eea218954c0f3dcd1fb.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4cf2d4ac22579eea218954c0f3dcd1fb.exe
Resource
win10v2004-20231215-en
General
-
Target
4cf2d4ac22579eea218954c0f3dcd1fb
-
Size
10.5MB
-
MD5
4cf2d4ac22579eea218954c0f3dcd1fb
-
SHA1
1cc0427b7bb661719b0979ead7baec91c67266d5
-
SHA256
4d708eb199791ff7c2a255be91fd320128595529a5357dd2df14eb4e92c325e5
-
SHA512
84e85451013214f9de45b8468a3361b94048fdc6d4ae20e89a4d2140dea4951f2dba5538c4a4112e84b66fc16fe35497feb82fcea58478c8747f1aa2802f75b0
-
SSDEEP
196608:/1qLn/DmaRfTU3Na1HE0bmRIGtvmewwmDSe485MeVIISGLJgNQpWM:da/DBRfQda9m5bwwGSY5TTSgJgNi
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cf2d4ac22579eea218954c0f3dcd1fb
Files
-
4cf2d4ac22579eea218954c0f3dcd1fb.exe windows:5 windows x86 arch:x86
55f8e466e609e883100b05c6925e87a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidToStringW
RpcStringFreeW
shlwapi
PathFindFileNameW
StrCmpIW
SHDeleteKeyW
SHDeleteValueW
PathRemoveExtensionW
SHGetValueW
SHSetValueW
user32
CreateWindowExW
GetSystemMetrics
LoadIconW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowRect
PostQuitMessage
FindWindowExA
SendMessageW
DefWindowProcW
ShowWindow
MessageBoxW
MessageBoxIndirectW
GetWindowThreadProcessId
GetShellWindow
RegisterClassExW
LoadCursorW
PostMessageW
kernel32
GetConsoleCP
QueryPerformanceCounter
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
IsProcessorFeaturePresent
HeapSize
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedIncrement
GetCPInfo
GetTimeZoneInformation
IsDebuggerPresent
VirtualFree
VirtualAlloc
GetFileSize
FindFirstFileW
SetFilePointer
VirtualQuery
GetCurrentProcess
GetCurrentThread
WriteFile
OpenProcess
WideCharToMultiByte
GetVersionExW
TerminateProcess
ReadFile
CreateFileW
MultiByteToWideChar
GetConsoleMode
SetLastError
FindClose
Process32FirstW
RemoveDirectoryW
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTickCount
GetTempPathW
CreateProcessW
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
GetModuleHandleA
FindResourceA
FreeResource
LoadResource
LoadLibraryW
SizeofResource
LockResource
ExitProcess
CreateMutexW
CreateDirectoryW
GetModuleHandleW
Sleep
CopyFileW
GetModuleFileNameW
FindResourceW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MapViewOfFile
RaiseException
OpenEventA
OpenFileMappingA
LocalFree
InterlockedDecrement
GetVersion
MoveFileExW
GetCurrentThreadId
GetStringTypeW
RtlUnwind
HeapReAlloc
SetStdHandle
WriteConsoleW
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
LoadLibraryA
InterlockedExchange
FreeLibrary
GetLastError
SetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
LocalAlloc
advapi32
SetEntriesInAclW
SetSecurityInfo
AllocateAndInitializeSid
GetSecurityInfo
DuplicateTokenEx
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenThreadToken
OpenProcessToken
FreeSid
shell32
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW
ole32
CoCreateGuid
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantInit
Sections
.text Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13.1MB - Virtual size: 13.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ