Static task
static1
Behavioral task
behavioral1
Sample
4b56344afe870ab14aeb6c2d136942ef.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4b56344afe870ab14aeb6c2d136942ef.exe
Resource
win10v2004-20231215-en
General
-
Target
4b56344afe870ab14aeb6c2d136942ef
-
Size
137KB
-
MD5
4b56344afe870ab14aeb6c2d136942ef
-
SHA1
91dea465ce8d4ed893058f9abfb617eb3d9209fa
-
SHA256
e727db9d24baa20a57122ecf4935dce6ee7e2f47b905bff66922cf124fdfdc8d
-
SHA512
6a3ec591cfb1fa124bf9637e44aaa12479e1e59d17596414843fdc248432cba5d6b83cbe2c87f325f16f21ddcd6f10b5974028d8e4f2fb58247d097ec9ccad83
-
SSDEEP
3072:3zSz6WhpyndlVVhnIktaibfe362Qa7RjIC6bD81+QZyyy4DI9Uc+:DSzadh1Db23fQwRjp0yy4MCc+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4b56344afe870ab14aeb6c2d136942ef
Files
-
4b56344afe870ab14aeb6c2d136942ef.exe windows:4 windows x86 arch:x86
8c2c8e0d09f3e041880f81239b2569b7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtQueryVirtualMemory
wcslen
wcscpy
memmove
_vsnwprintf
_wcsicmp
wcscat
swprintf
RtlUnwind
rpcrt4
RpcBindingFromStringBindingW
NdrClientCall2
RpcBindingSetAuthInfoExW
RpcBindingFree
userenv
ExpandEnvironmentStringsForUserW
CreateEnvironmentBlock
DestroyEnvironmentBlock
winsta
WinStationQueryInformationW
WinStationEnumerateW
WinStationFreeMemory
kernel32
SetEnvironmentVariableW
DeleteCriticalSection
GetUserDefaultUILanguage
DisconnectNamedPipe
GetConsoleCommandHistoryW
GetConsoleCharType
CreateProcessInternalA
ConnectNamedPipe
LZCreateFileW
ReadFile
DeleteFileA
UnregisterWaitEx
SetUnhandledExceptionFilter
CreateDirectoryW
ResetEvent
LocalAlloc
LCMapStringA
WriteConsoleOutputW
GetVersionExA
SystemTimeToFileTime
GetVolumePathNameW
AddAtomA
OpenEventW
SetConsoleHardwareState
CompareStringA
GetOverlappedResult
GetWriteWatch
GetWindowsDirectoryA
GetConsoleNlsMode
GetCurrentThread
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
SetLastError
FileTimeToSystemTime
GetUserGeoID
DuplicateHandle
CloseHandle
GetConsoleProcessList
lstrcat
CallNamedPipeW
WaitForMultipleObjectsEx
EscapeCommFunction
RestoreLastError
EnumSystemLocalesW
GetLastError
CreateMutexW
GetSystemTimeAsFileTime
SetEvent
UnhandledExceptionFilter
VerSetConditionMask
FindNextChangeNotification
ProcessIdToSessionId
LZDone
ExitVDM
QueryPerformanceCounter
GetPrivateProfileSectionNamesW
CreateFileA
LocalFree
VirtualAlloc
EnterCriticalSection
SetComputerNameA
GetProcessHeap
Heap32First
GetThreadContext
SetDefaultCommConfigW
IsBadHugeWritePtr
WaitForMultipleObjects
GetConsoleWindow
CreateEventW
SetFileApisToANSI
GetGeoInfoA
HeapAlloc
OpenProcess
TerminateProcess
GlobalUnWire
GetCurrentProcess
GetStringTypeExW
CreateNamedPipeW
WaitForSingleObject
GetSystemWindowsDirectoryW
GetVersionExW
SetHandleContext
HeapFree
GetVDMCurrentDirectories
GetTickCount
GetCurrentProcessId
FatalExit
FreeLibrary
GetConsoleCursorInfo
ExpungeConsoleCommandHistoryA
GetDriveTypeA
CallNamedPipeA
GetStringTypeExA
GetTempPathW
GetConsoleKeyboardLayoutNameA
LeaveCriticalSection
CreateWaitableTimerW
GetVolumePathNamesForVolumeNameA
user32
GetClassInfoExW
RegisterClassExA
SetSysColors
SetLayeredWindowAttributes
MessageBoxTimeoutA
GetMenuItemID
AllowForegroundActivation
SetCaretBlinkTime
MonitorFromRect
DdeFreeDataHandle
ClientToScreen
SetDeskWallpaper
CloseWindowStation
EndTask
DestroyCursor
UnlockWindowStation
TrackMouseEvent
GetNextDlgGroupItem
SetWindowLongA
GetIconInfo
SetWindowTextW
ResolveDesktopForWOW
keybd_event
TileWindows
GetMessageExtraInfo
SendNotifyMessageW
GetWindowTextLengthW
CharNextExA
ModifyMenuA
DeviceEventWorker
DestroyIcon
DrawIcon
UserClientDllInitialize
RegisterServicesProcess
EnumPropsA
DdeQueryStringW
DialogBoxParamW
RealGetWindowClass
ChangeDisplaySettingsExW
MapWindowPoints
GetKBCodePage
DlgDirSelectComboBoxExA
SetProcessDefaultLayout
AllowSetForegroundWindow
PrivateExtractIconExW
UserRegisterWowHandlers
DeleteMenu
GetWindowModuleFileNameW
MapVirtualKeyA
UnregisterClassA
SetSystemCursor
DdeConnect
SetWindowWord
DefMDIChildProcA
BlockInput
RegisterClassA
wvsprintfW
EnumDisplaySettingsExW
IsWindowUnicode
VkKeyScanExA
SetMenuDefaultItem
GetWindowInfo
EnumWindows
SetClassWord
IsCharLowerA
InvertRect
GetGUIThreadInfo
OpenDesktopA
User32InitializeImmEntryTable
LoadStringW
DlgDirListW
UnregisterDeviceNotification
GrayStringW
mouse_event
GetKeyboardLayoutNameA
DdeKeepStringHandle
ReleaseCapture
MonitorFromPoint
CharLowerW
SetPropW
CreateDialogParamA
GetClassInfoExA
MoveWindow
ShowOwnedPopups
EnumDisplaySettingsExA
DrawTextW
SetWindowsHookExA
ShowCaret
CreateDialogIndirectParamAorW
DdeClientTransaction
IsWindow
CharToOemBuffW
IsCharLowerW
DestroyAcceleratorTable
MapVirtualKeyExA
GetClipboardFormatNameA
DdeEnableCallback
SetDlgItemInt
WINNLSEnableIME
EnumWindowStationsW
CreateDialogIndirectParamA
IsZoomed
EmptyClipboard
TranslateAcceleratorA
DrawCaption
CharLowerBuffW
SystemParametersInfoA
GetInputState
GetWinStationInfo
DdeSetUserHandle
IsHungAppWindow
DispatchMessageA
CreateAcceleratorTableA
CharToOemBuffA
ShowWindow
SetScrollInfo
RemovePropA
RealGetWindowClassW
PostMessageA
ChangeClipboardChain
DestroyReasons
GetMenuContextHelpId
DrawCaptionTempW
UnloadKeyboardLayout
CheckMenuRadioItem
AnimateWindow
UnhookWindowsHookEx
BroadcastSystemMessageExW
wvsprintfA
UserLpkPSMTextOut
DdeUnaccessData
GetDialogBaseUnits
ChangeMenuA
GetKeyboardType
SetSystemMenu
SetDoubleClickTime
ReleaseDC
AppendMenuW
EnumDisplayDevicesA
CheckDlgButton
IsCharAlphaA
SetScrollPos
InitializeLpkHooks
IsWinEventHookInstalled
SetProgmanWindow
CharPrevExA
GetMenuStringW
SoftModalMessageBox
CharLowerBuffA
BroadcastSystemMessageA
UnpackDDElParam
EnumWindowStationsA
GetDC
GetAltTabInfoA
CloseClipboard
DlgDirListComboBoxW
DdeFreeStringHandle
CreateAcceleratorTableW
GetTitleBarInfo
SetRectEmpty
ShowWindowAsync
DdeAddData
DdeGetQualityOfService
SetWindowRgn
MB_GetString
DefWindowProcA
EnumPropsExW
WindowFromPoint
ScrollChildren
LoadCursorFromFileW
GetNextDlgTabItem
GetReasonTitleFromReasonCode
EndPaint
DisableProcessWindowsGhosting
WINNLSGetIMEHotkey
GetLastInputInfo
InflateRect
GetKeyboardLayoutList
RegisterClipboardFormatA
GetDlgItemTextA
EnableWindow
GetCursorFrameInfo
ChangeDisplaySettingsW
IsGUIThread
GetClassNameA
GetProcessWindowStation
SetClipboardViewer
ArrangeIconicWindows
CallMsgFilter
MenuWindowProcW
InSendMessageEx
IsWindowInDestroy
DdeQueryConvInfo
LoadKeyboardLayoutEx
IsDialogMessageA
GetGuiResources
SetLastErrorEx
PaintMenuBar
LoadMenuW
SetUserObjectSecurity
LoadIconA
TranslateMDISysAccel
GetWindowTextLengthA
DrawCaptionTempA
SetForegroundWindow
KillTimer
CloseDesktop
EndMenu
CharPrevW
FlashWindow
RegisterDeviceNotificationA
GetUserObjectInformationW
DragObject
ScrollWindowEx
GetAltTabInfoW
RegisterClassW
GetWindowWord
FlashWindowEx
DialogBoxIndirectParamAorW
GetClassLongA
CreateDesktopW
MessageBoxExW
UnregisterHotKey
wsprintfW
SetActiveWindow
WaitForInputIdle
CharUpperW
UpdateLayeredWindow
SendMessageTimeoutW
IsRectEmpty
GetAppCompatFlags2
ReasonCodeNeedsComment
IMPGetIMEA
GetDlgItemTextW
GetScrollRange
CharUpperBuffA
PackDDElParam
CreateCursor
PrintWindow
SendMessageW
DdeCreateStringHandleA
DragDetect
CloseWindowStation
SetClassLongA
LockWorkStation
CreateIconIndirect
RemoveMenu
CheckMenuItem
RealChildWindowFromPoint
ActivateKeyboardLayout
ScrollWindow
SubtractRect
MsgWaitForMultipleObjectsEx
BringWindowToTop
DeferWindowPos
GetMenuItemInfoA
SetScrollRange
ClientThreadSetup
SendDlgItemMessageA
PostThreadMessageW
SendMessageTimeoutA
OemKeyScan
FindWindowExA
BeginDeferWindowPos
ShowCursor
GetWindowThreadProcessId
RedrawWindow
SetPropA
ClipCursor
DrawStateA
SetSysColorsTemp
BeginPaint
VkKeyScanExW
OffsetRect
FrameRect
SendIMEMessageExA
DrawFocusRect
SetWindowPlacement
LoadMenuA
DialogBoxParamA
SendMessageCallbackW
MenuWindowProcA
SetWindowStationUser
GetOpenClipboardWindow
CharNextW
CreateIcon
IntersectRect
DefMDIChildProcW
UnhookWinEvent
IsCharAlphaNumericA
ScreenToClient
DdeCmpStringHandles
PrivateExtractIconsW
ShowScrollBar
GetClassWord
WinHelpA
IsCharUpperA
LoadMenuIndirectA
GetWindowPlacement
GetParent
GetAltTabInfo
GetRawInputDeviceList
QuerySendMessage
GetPropW
BroadcastSystemMessageExA
ToAsciiEx
LoadCursorA
GetClipboardOwner
SetMessageQueue
GetAppCompatFlags
GetMessageTime
DefDlgProcA
GetWindowLongW
GetQueueStatus
LoadAcceleratorsW
EqualRect
DefWindowProcW
GetRawInputData
IMPQueryIMEA
DlgDirListA
IMPGetIMEW
DefRawInputProc
IsIconic
GetTaskmanWindow
GetClipboardSequenceNumber
GetMenuItemCount
GetUserObjectInformationW
RegisterDeviceNotificationW
DdePostAdvise
GetClipCursor
RecordShutdownReason
LoadImageW
EnableMenuItem
GetForegroundWindow
BuildReasonArray
GetWindowRgn
IsWindowVisible
SetWindowTextA
OpenWindowStationW
DlgDirSelectComboBoxExW
GetClientRect
CountClipboardFormats
InSendMessage
CreateDesktopA
SetKeyboardState
CreateSystemThreads
GetMonitorInfoW
MapVirtualKeyExW
DialogBoxIndirectParamW
ValidateRgn
GetFocus
OemToCharA
LoadIconW
ExcludeUpdateRgn
GetMessageW
AlignRects
WINNLSGetEnableStatus
GetThreadDesktop
wsprintfA
ModifyMenuW
GetWindowRgnBox
RegisterWindowMessageW
GetInternalWindowPos
SetUserObjectInformationW
advapi32
RegCloseKey
AllocateAndInitializeSid
FreeSid
ImpersonateNamedPipeClient
RegQueryValueExW
GetSecurityInfo
InitializeSecurityDescriptor
GetLengthSid
AccessCheck
AddAccessDeniedAce
RegisterServiceCtrlHandlerExW
SetSecurityDescriptorDacl
RegOpenKeyExW
OpenThreadToken
GetSecurityDescriptorDacl
AddAccessAllowedAce
CreateProcessAsUserW
DuplicateToken
SetSecurityDescriptorOwner
RevertToSelf
InitializeAcl
SetNamedSecurityInfoW
SetServiceStatus
SetSecurityDescriptorGroup
ntmarta
AccTreeResetNamedSecurityInfo
AccFreeIndexArray
EventGuidToName
AccProvGrantAccessRights
Sections
.qoNygL Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.PCBVqQ Size: 1024B - Virtual size: 548B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.KZi Size: 1KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ