Static task
static1
Behavioral task
behavioral1
Sample
5b6b2e56ec216497c336875c522f31b7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5b6b2e56ec216497c336875c522f31b7.exe
Resource
win10v2004-20231215-en
General
-
Target
5b6b2e56ec216497c336875c522f31b7
-
Size
164KB
-
MD5
5b6b2e56ec216497c336875c522f31b7
-
SHA1
f2fbfc72bebcf93b14d5eb4f9612e5805529395d
-
SHA256
d00d56be50b6a0fc210308753a913eb272e2160dfbb5d5574ada4b37b9f7f505
-
SHA512
e6924706bfbe78ec224ddec063e4e6ed09d9bcca7356fb45948ddbd44172ac96da43bc7af42386cc15d78625cd4ddd21df2bdb2d5b66313e40cc53d2f752b9e7
-
SSDEEP
3072:tXKDm5xmnAcNvjOl7QaoyUl1B1adztxGUJhq1k+qg7cdu11FQA9ApyKx7:taCanvOE087adz7ornEG1qmk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b6b2e56ec216497c336875c522f31b7
Files
-
5b6b2e56ec216497c336875c522f31b7.exe windows:5 windows x86 arch:x86
f4c47bf96a971111d1ad25e3f9957869
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathRemoveFileSpecA
PathRelativePathToW
PathQuoteSpacesW
PathIsPrefixW
StrRChrA
PathIsSameRootW
PathIsContentTypeW
PathUnExpandEnvStringsW
SHRegQueryInfoUSKeyW
ColorHLSToRGB
StrTrimW
StrRChrIA
StrFormatByteSizeW
user32
InsertMenuA
TrackPopupMenu
ToUnicodeEx
GetWindow
GetWindowTextA
AllowSetForegroundWindow
ImpersonateDdeClientWindow
OpenWindowStationA
OemKeyScan
ChangeDisplaySettingsA
EqualRect
GetMenuItemRect
MapWindowPoints
GetAsyncKeyState
MsgWaitForMultipleObjects
EnumChildWindows
RemoveMenu
DestroyAcceleratorTable
DialogBoxParamW
SetMessageQueue
IMPGetIMEA
DrawFrameControl
PrivateExtractIconsA
GetTabbedTextExtentA
GetClipboardFormatNameA
LookupIconIdFromDirectory
GetParent
GetWindowModuleFileNameW
EnumPropsW
RealChildWindowFromPoint
ChangeDisplaySettingsExA
MsgWaitForMultipleObjectsEx
CharLowerW
IntersectRect
GetScrollRange
ShowCaret
IsZoomed
MessageBoxExA
CloseDesktop
CreateDialogParamA
advapi32
FileEncryptionStatusA
OpenSCManagerA
CryptSignHashA
LsaFreeMemory
ConvertSecurityDescriptorToAccessNamedA
IsTextUnicode
AbortSystemShutdownW
IsValidSid
ole32
ReadClassStm
CoTaskMemFree
OleCreateLinkFromData
StgOpenStorage
OpenOrCreateStream
UtGetDvtd32Info
kernel32
ExitProcess
DisconnectNamedPipe
GetNamedPipeHandleStateW
lstrlenA
SetDefaultCommConfigW
EnumSystemLanguageGroupsW
GetDefaultCommConfigW
FindResourceW
EnumResourceTypesA
CreateFiber
UpdateResourceW
GetStdHandle
FormatMessageW
OpenWaitableTimerW
FatalExit
CallNamedPipeW
RtlUnwind
DebugBreak
GetCurrentDirectoryW
GetShortPathNameA
BuildCommDCBA
lstrcpyW
GetTimeZoneInformation
SetCommState
IsDBCSLeadByte
DeviceIoControl
GlobalMemoryStatusEx
SetFileApisToANSI
BeginUpdateResourceW
GetCommProperties
SetProcessAffinityMask
GetLargestConsoleWindowSize
GetFileAttributesA
GetFileSizeEx
VerifyVersionInfoA
SignalObjectAndWait
CreateTapePartition
GetSystemDefaultLCID
OpenJobObjectW
MoveFileA
ReadConsoleInputA
GetConsoleFontSize
UnregisterWaitEx
GetEnvironmentStringsA
HeapValidate
PostQueuedCompletionStatus
WaitForDebugEvent
CopyFileW
CompareFileTime
OpenSemaphoreW
ReadConsoleOutputCharacterA
GetDiskFreeSpaceExA
SetSystemTimeAdjustment
Toolhelp32ReadProcessMemory
SetConsoleCursorInfo
GetLogicalDriveStringsW
ContinueDebugEvent
VirtualQueryEx
VirtualQuery
CopyFileExW
CreateHardLinkA
WriteConsoleOutputCharacterA
GetEnvironmentVariableA
FindAtomW
GetThreadSelectorEntry
VirtualAlloc
FindNextFileA
GetConsoleMode
CreateToolhelp32Snapshot
WaitForSingleObjectEx
TlsGetValue
SetConsoleCP
GetProcessPriorityBoost
GetShortPathNameW
FindVolumeMountPointClose
PeekNamedPipe
CreateProcessA
LoadLibraryW
lstrcmpi
GetCompressedFileSizeW
GlobalGetAtomNameA
ReplaceFileW
InitializeCriticalSectionAndSpinCount
SetThreadLocale
IsBadHugeWritePtr
WriteProfileStringA
SetSystemPowerState
lstrcpynA
GetLogicalDrives
lstrcpyn
CreateWaitableTimerA
RequestDeviceWakeup
GetCommConfig
GetTempFileNameW
DnsHostnameToComputerNameW
lstrcatA
SleepEx
SetConsoleTitleW
EnumDateFormatsA
FindCloseChangeNotification
Process32First
FreeEnvironmentStringsA
VerSetConditionMask
WritePrivateProfileSectionW
EndUpdateResourceW
GetLongPathNameW
SetHandleCount
SystemTimeToTzSpecificLocalTime
LoadLibraryA
CancelIo
GetCPInfo
IsBadReadPtr
IsValidLanguageGroup
QueueUserAPC
DeleteFileA
GetCurrencyFormatA
GetProcessAffinityMask
GetCurrentDirectoryA
EnumTimeFormatsW
MoveFileExW
ConnectNamedPipe
LockFile
GetComputerNameExA
FindClose
VirtualProtect
GlobalAddAtomA
EnumResourceNamesW
SetCurrentDirectoryW
CreateJobObjectA
GetCommState
IsSystemResumeAutomatic
Module32Next
GetBinaryTypeA
GetStringTypeA
LocalHandle
FoldStringA
PeekConsoleInputW
QueryPerformanceCounter
GetExitCodeProcess
CallNamedPipeA
CreateTimerQueueTimer
OpenThread
GetSystemTime
RemoveDirectoryA
Module32FirstW
OpenProcess
GetProcessHeaps
GetSystemTimeAdjustment
WriteConsoleOutputAttribute
FindNextChangeNotification
GetSystemDefaultUILanguage
GlobalGetAtomNameW
GetModuleFileNameW
CreateDirectoryExW
EnterCriticalSection
VerifyVersionInfoW
GetVolumeNameForVolumeMountPointW
IsBadHugeReadPtr
GetDefaultCommConfigA
GetPriorityClass
IsDebuggerPresent
LocalFlags
lstrcmp
SetComputerNameExW
TlsSetValue
SetInformationJobObject
CancelTimerQueueTimer
ScrollConsoleScreenBufferW
GetConsoleAliasW
SetErrorMode
GetDateFormatA
SetFilePointer
SetConsoleOutputCP
GetProcessHeap
SetEndOfFile
DefineDosDeviceA
CompareStringA
FillConsoleOutputCharacterA
CreateFileW
IsBadStringPtrW
FindResourceExA
ReplaceFile
AddConsoleAliasW
SetSystemTime
ResetEvent
EnumCalendarInfoExW
SetLastError
CreateEventA
SetThreadPriority
SetMessageWaitingIndicator
GetProcessShutdownParameters
BackupRead
WriteConsoleInputW
CreateFileMappingW
CreateDirectoryExA
FindFirstFileA
GetConsoleAliasA
WriteProcessMemory
SetNamedPipeHandleState
SetTapeParameters
QueueUserWorkItem
lstrlenW
FreeConsole
FindResourceA
GetVolumePathNameA
lstrcmpA
UnmapViewOfFile
GetAtomNameA
ReadConsoleOutputCharacterW
GetDevicePowerState
LocalUnlock
GetCurrencyFormatW
GetNumberFormatA
GetSystemInfo
GetProcAddress
QueryDosDeviceW
ReadProcessMemory
BeginUpdateResourceA
CreateSemaphoreW
RegisterWaitForSingleObject
MapUserPhysicalPages
GetOEMCP
AreFileApisANSI
Process32FirstW
ExpandEnvironmentStringsA
ReleaseMutex
RtlFillMemory
GetPrivateProfileStructW
GetThreadPriorityBoost
GetConsoleWindow
GetACP
lstrlen
EnumDateFormatsW
CreateMutexW
GetNumberOfConsoleInputEvents
GetPrivateProfileSectionNamesW
LocalCompact
HeapWalk
CloseHandle
CreateMailslotW
SetConsoleCursorPosition
WriteFile
EnumResourceLanguagesA
VirtualProtectEx
GetDiskFreeSpaceExW
GetModuleHandleA
LocalFree
GetPrivateProfileSectionW
RemoveDirectoryW
ReadConsoleOutputA
ResumeThread
GetLastError
SetComputerNameW
GetVolumeInformationW
SetCriticalSectionSpinCount
HeapFree
GetTempFileNameA
SuspendThread
GetStringTypeExA
CreateSemaphoreA
LockFileEx
TerminateProcess
CreateJobObjectW
FindFirstFileExA
MoveFileW
OpenSemaphoreA
GetSystemDirectoryW
ExpandEnvironmentStringsW
SetComputerNameExA
GetTimeFormatA
PurgeComm
VirtualUnlock
ReadDirectoryChangesW
lstrcmpiA
WaitCommEvent
lstrcatW
WritePrivateProfileSectionA
GetProcessTimes
GetCommTimeouts
DeleteVolumeMountPointA
FindFirstFileW
GetCommandLineA
DeleteTimerQueue
GetVolumeInformationA
SetEnvironmentVariableA
FindResourceExW
WriteConsoleA
SetTapePosition
FindFirstChangeNotificationW
GetFileAttributesW
SetThreadAffinityMask
CancelDeviceWakeupRequest
InitializeCriticalSection
GetComputerNameExW
DnsHostnameToComputerNameA
SetConsoleCtrlHandler
GetVersionExA
TransmitCommChar
FindNextVolumeA
GetStartupInfoW
WriteTapemark
LoadLibraryExW
LCMapStringW
RequestWakeupLatency
CompareStringW
GetTapeStatus
GetCurrentThreadId
MapUserPhysicalPagesScatter
DeleteVolumeMountPointW
GetCommandLineW
DebugActiveProcess
SetConsoleTextAttribute
MulDiv
TerminateThread
LockResource
CreateNamedPipeW
SetTimeZoneInformation
FindNextVolumeMountPointW
FindFirstVolumeMountPointW
EnumCalendarInfoExA
WriteFileEx
VirtualAllocEx
PrepareTape
QueryDosDeviceA
FormatMessageA
MoveFileWithProgressW
SetFilePointerEx
GetCalendarInfoA
RaiseException
GetConsoleTitleW
HeapUnlock
GetPrivateProfileStringA
SetFileAttributesA
GetTempPathW
FlushInstructionCache
BuildCommDCBW
GetConsoleAliasesLengthW
SetConsoleCursor
GetStringTypeW
SetEnvironmentVariableW
EnumLanguageGroupLocalesW
IsBadCodePtr
GetConsoleAliasExesA
OpenEventA
GetEnvironmentStrings
SetCalendarInfoW
BuildCommDCBAndTimeoutsA
BindIoCompletionCallback
DeleteTimerQueueTimer
GetDiskFreeSpaceW
SetLocaleInfoA
DeleteFileW
UpdateResourceA
SetFileAttributesW
GlobalUnWire
LocalAlloc
CommConfigDialogW
GetFileType
MapViewOfFile
FlushViewOfFile
GetVolumeNameForVolumeMountPointA
ReadFile
OpenMutexA
SwitchToFiber
QueryInformationJobObject
SetConsoleTitleA
FreeLibrary
GenerateConsoleCtrlEvent
IsDBCSLeadByteEx
FatalAppExitW
SetCurrentDirectoryA
lstrcpy
GetCommModemStatus
BackupSeek
FindNextVolumeW
FindFirstVolumeMountPointA
OutputDebugStringW
IsValidCodePage
Heap32Next
EnumSystemCodePagesW
CreateDirectoryA
GetConsoleAliasesW
TryEnterCriticalSection
EnumSystemLanguageGroupsA
GetCPInfoExW
GetFileInformationByHandle
EnumSystemCodePagesA
IsBadWritePtr
GlobalUnlock
GetLogicalDriveStringsA
lstrcpynW
RtlZeroMemory
GetStartupInfoA
GetSystemDirectoryA
GetUserDefaultLangID
GetProfileIntW
OpenFileMappingA
WritePrivateProfileStructA
Beep
GetCurrentThread
GetProcessWorkingSetSize
gdi32
GetColorAdjustment
EngComputeGlyphSet
GdiResetDCEMF
GetMapMode
SetMiterLimit
GetNearestColor
DescribePixelFormat
GetBoundsRect
CreateEllipticRgn
EngCheckAbort
GetOutlineTextMetricsA
GetMetaRgn
GdiConvertEnhMetaFile
EngDeleteSemaphore
GetKerningPairsW
SetWindowExtEx
GetTextExtentExPointWPri
STROBJ_bEnumPositionsOnly
GdiAddFontResourceW
GetFontAssocStatus
PlayEnhMetaFile
SetTextCharacterExtra
PtInRegion
GetObjectA
DeleteColorSpace
TextOutW
AddFontResourceExA
FONTOBJ_cGetGlyphs
FONTOBJ_vGetInfo
StrokePath
RemoveFontResourceExW
SetDCBrushColor
ExtCreatePen
GetMiterLimit
EngTextOut
EngPaint
EngWideCharToMultiByte
GetCharacterPlacementA
StretchDIBits
EngCreateDeviceBitmap
CreateFontIndirectW
EndPath
GetEUDCTimeStampExW
EnableEUDC
GetICMProfileW
GdiReleaseLocalDC
GetTextExtentPointW
GetPath
GdiPlayJournal
CreateEnhMetaFileA
CreateDIBPatternBrush
SetPixelV
CancelDC
GdiGetSpoolMessage
SetPixel
Polyline
SetPixelFormat
Sections
.text Size: 137KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ