Static task
static1
Behavioral task
behavioral1
Sample
f8aa79ca50f0f84282f60d681047d7ac.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f8aa79ca50f0f84282f60d681047d7ac.exe
Resource
win10v2004-20231222-en
General
-
Target
f8aa79ca50f0f84282f60d681047d7ac
-
Size
2.6MB
-
MD5
f8aa79ca50f0f84282f60d681047d7ac
-
SHA1
e83c3249a7edb05391ae97e1ea0ff68bf85aac4e
-
SHA256
e611fdd01ec93d0c0d384b0bf0e6e11fc398fb7c74b49e8794cb3d4f5e6a1cbd
-
SHA512
147d129e23310dabb3d53de31454977078e96e61bd182c8413e3ff58ffd1aaf536bdbe0ed62351e19ef9a6fa54e80d47785be45ba8ca2ce3a2f2b8ee5e47e091
-
SSDEEP
49152:2QbyM+LJfa3cxsAZ3oLctP3r3IHF1v3HASbUhvg4fTJ85vJDpp8dut++A:xnMJqgsP453r3lwuvg4L+1384t+r
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8aa79ca50f0f84282f60d681047d7ac
Files
-
f8aa79ca50f0f84282f60d681047d7ac.exe windows:4 windows x86 arch:x86
2fa48766052a5296553dbd196689ff6e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
SetFileTime
CompareFileTime
GetFileAttributesA
GetTempFileNameA
GetTempPathA
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
Sleep
SetEvent
CreateEventA
CopyFileA
GetFileSize
GetModuleFileNameA
lstrcpynA
GetCommandLineA
GetUserDefaultLangID
GetTickCount
CreateProcessA
CreateFileA
GetDiskFreeSpaceA
lstrcmpiA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetWindowsDirectoryA
CreateDirectoryA
GetSystemDirectoryA
MultiByteToWideChar
GetVersionExA
GetEnvironmentVariableA
GetCurrentProcess
GetProcAddress
GetModuleHandleA
DeleteFileA
LocalFree
LocalAlloc
GetLastError
GetPrivateProfileStringA
GetCurrentThread
GlobalFree
GlobalAlloc
WritePrivateProfileStringA
ExpandEnvironmentStringsA
WaitForSingleObject
GetExitCodeProcess
SetFileAttributesA
LoadLibraryA
FreeLibrary
ExitProcess
WriteFile
ReadFile
SetFilePointer
MulDiv
lstrcatA
FindFirstFileA
lstrcpyA
FindNextFileA
FindClose
RemoveDirectoryA
GetPrivateProfileIntA
lstrlenA
CreateThread
advapi32
RegCreateKeyA
RegEnumValueA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
ImpersonateSelf
OpenThreadToken
OpenProcessToken
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
FreeSid
RevertToSelf
RegDeleteKeyA
RegDeleteValueA
comctl32
ord17
gdi32
SetBkMode
CreateFontA
CreateSolidBrush
DeleteObject
CreateFontIndirectA
GetObjectA
BitBlt
CreateCompatibleDC
SetTextColor
LineTo
MoveToEx
CreatePen
GetStockObject
SetBkColor
GetNearestColor
CreateBrushIndirect
GetTextColor
SelectObject
ole32
OleInitialize
CoCreateInstance
OleUninitialize
shell32
SHFileOperationA
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetSpecialFolderLocation
ShellExecuteA
user32
SendDlgItemMessageA
LoadBitmapA
IsWindowVisible
SetFocus
EndDialog
IsWindowEnabled
SetClassLongA
DialogBoxParamA
ScreenToClient
SetWindowPos
CharNextA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
SetDlgItemTextA
PostQuitMessage
CharPrevA
SetForegroundWindow
FindWindowExA
IsWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
wsprintfA
MessageBoxA
LoadIconA
LoadCursorA
RegisterClassA
SystemParametersInfoA
GetDesktopWindow
DefWindowProcA
BeginPaint
GetClientRect
FillRect
GetWindowTextA
DrawTextA
EnableWindow
GetParent
EnumChildWindows
GetDlgItemTextA
GetDlgItem
ShowWindow
GetWindowRect
EndPaint
SendMessageA
SetRect
CreateWindowExA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ