Behavioral task
behavioral1
Sample
542299a8a09bfef488f08a3f44b849f8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
542299a8a09bfef488f08a3f44b849f8.exe
Resource
win10v2004-20231215-en
General
-
Target
542299a8a09bfef488f08a3f44b849f8
-
Size
116KB
-
MD5
542299a8a09bfef488f08a3f44b849f8
-
SHA1
4361841edbb3b08ab424bd16e54b012ef15a23f8
-
SHA256
cb8b766f217b3f24ff8d547496d38275fdffc1286c88a9e17357cea5ba2fcdf9
-
SHA512
155c1aa4755e462fddc6b2e16ba11eebae0d8b588dc323205e8bc81107e47606e0904013c8289a5d7fe83696d732718524b601c7b00a3beb29729f9513a2293a
-
SSDEEP
1536:MEAQH8iFNJOnKDf2uXmK2tyWkdFpI8+K46DNETjAcO4GZpGdFyc1I+CRyX1WHq:MZriF6WOuX72tnkdoK/ETksG3EF/
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 542299a8a09bfef488f08a3f44b849f8
Files
-
542299a8a09bfef488f08a3f44b849f8.exe windows:4 windows x86 arch:x86
9d093cc972e78a56ffdd19b3307f29b4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
lstrcpyA
HeapAlloc
GetProcessHeap
lstrcmpiA
lstrcmpA
lstrcatA
lstrcpynA
GlobalFree
HeapFree
CreateThread
Sleep
ExitThread
InterlockedDecrement
InterlockedIncrement
DeleteFileA
GlobalAlloc
GetFileSize
CreateFileA
GetModuleFileNameA
GetTempFileNameA
GetTempPathA
ReadFile
GetEnvironmentVariableA
GetWindowsDirectoryA
FindClose
LoadLibraryA
FindFirstFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetDriveTypeA
GetSystemDirectoryA
SetThreadPriority
GetCurrentThread
SetFilePointer
WriteFile
GetSystemTime
WinExec
GetLastError
TerminateThread
ExitProcess
CreateMutexA
GetVersionExA
GlobalMemoryStatus
Module32First
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
GetStartupInfoA
GetProcAddress
WideCharToMultiByte
lstrlenA
CreateProcessA
WaitForSingleObject
CloseHandle
GetTickCount
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
GetTimeZoneInformation
user32
wsprintfA
wvsprintfA
CharUpperBuffA
CharUpperA
CharLowerA
advapi32
RegCreateKeyExA
RegSetValueExA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyA
shell32
ShellExecuteA
ws2_32
WSAStartup
WSACleanup
connect
inet_addr
gethostbyname
sendto
socket
htons
select
recv
ntohs
closesocket
send
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
msvcrt
??2@YAPAXI@Z
__CxxFrameHandler
rand
srand
strlen
??3@YAXPAX@Z
_purecall
free
malloc
exit
_ftol
strstr
fread
fclose
ftell
fseek
fopen
fwrite
fprintf
sprintf
strncat
strcmp
__dllonexit
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strtok
toupper
__mb_cur_max
_isctype
_pctype
memcpy
tolower
memset
_vsnprintf
fgets
msvcp60
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE