Static task
static1
Behavioral task
behavioral1
Sample
58f5848718872ffeb163ea46eadc2192.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
58f5848718872ffeb163ea46eadc2192.exe
Resource
win10v2004-20231222-en
General
-
Target
58f5848718872ffeb163ea46eadc2192
-
Size
1.3MB
-
MD5
58f5848718872ffeb163ea46eadc2192
-
SHA1
defc4a1d743c168bd002500edfaea5c7e0f49f89
-
SHA256
e58550d2c48b21b48f911ec502353d0a9be51a01e36d72728b27a600fd452b42
-
SHA512
9521120c5decf75bd7f10bf4f188da6b613831c2618d4d9966d3e46604d2a74a86436702808666363acf688642e29bdd3e80d2b1d7d131d1b17fe14c17263074
-
SSDEEP
12288:qdYtbaTAM9fXWLMR2j92XzgkemMqTQUBj3K:qRfX+M292XzZMO6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 58f5848718872ffeb163ea46eadc2192
Files
-
58f5848718872ffeb163ea46eadc2192.exe windows:4 windows x86 arch:x86
883b103d0d95b2c63829b158719c57e1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
listen
closesocket
WSAGetLastError
bind
recvfrom
WSASendTo
recv
inet_addr
gethostbyname
connect
shutdown
socket
WSAStartup
WSAAsyncSelect
WSASend
WSAAccept
WSARecv
WSASocketA
send
accept
inet_ntoa
setsockopt
htonl
htons
kernel32
GetACP
LCMapStringW
LCMapStringA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
SetFilePointer
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
FlushFileBuffers
SetStdHandle
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateThread
CloseHandle
WaitForSingleObject
Sleep
InterlockedIncrement
GetLastError
TerminateThread
PostQueuedCompletionStatus
CreateIoCompletionPort
GetSystemInfo
GetQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
HeapFree
HeapAlloc
GetProcessHeap
GlobalFree
GlobalAlloc
GetOEMCP
GetFileSize
SetEnvironmentVariableA
OutputDebugStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
CreateMutexA
FreeEnvironmentStringsA
InterlockedDecrement
FatalAppExitA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
RaiseException
WideCharToMultiByte
UnhandledExceptionFilter
FreeEnvironmentStringsW
HeapSize
HeapReAlloc
GetCurrentProcess
TerminateProcess
GetProcAddress
GetCurrentThread
TlsGetValue
SetLastError
TlsFree
TlsAlloc
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
GetLocalTime
GetSystemTime
GetTimeZoneInformation
LoadLibraryA
SetConsoleCtrlHandler
SetEndOfFile
CompareStringA
ReadFile
CompareStringW
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
CreateFileA
GetLocaleInfoW
WriteFile
RtlUnwind
GetCurrentThreadId
TlsSetValue
ExitThread
user32
DialogBoxParamA
DefWindowProcA
KillTimer
GetClientRect
DestroyWindow
PostQuitMessage
CreateWindowExA
UpdateWindow
LoadIconA
LoadCursorA
RegisterClassExA
SetTimer
LoadStringA
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
SetWindowTextA
FillRect
GetDC
ReleaseDC
SetRect
MessageBoxA
IsWindow
CreateDialogParamA
ShowWindow
GetDlgItem
EndDialog
SetDlgItemTextA
SendMessageA
wsprintfA
DispatchMessageA
gdi32
CreateSolidBrush
DeleteObject
SetTextColor
TextOutA
GetStockObject
mumsg
??0CMsg@@QAE@XZ
??1CMsg@@QAE@XZ
?LoadWTF@CMsg@@QAEXPAD@Z
?Get@CMsg@@QAEPADH@Z
comctl32
ord17
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 110.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 176KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ