Static task
static1
Behavioral task
behavioral1
Sample
033b8e7f194e545d562816f8adc1affa.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
033b8e7f194e545d562816f8adc1affa.exe
Resource
win10v2004-20231215-en
General
-
Target
033b8e7f194e545d562816f8adc1affa
-
Size
84KB
-
MD5
033b8e7f194e545d562816f8adc1affa
-
SHA1
95cf0364ca3d63d0717e84c40fbb64c2c82b98f1
-
SHA256
6bc0c0d02f71c02eb30a08fea21e8fa65d4b74bd8821b97a6d3cfd2e3780e859
-
SHA512
3ed60feb0af4350fa61f4fea4f43a094ee9eeaf711ddd81e0d7d9db328ab0400b755385ae92c90c6d8623db66e55b8f04670799d77da3743cfc5a7e8a102b5a9
-
SSDEEP
1536:Hzn3E14CVY0ZmbgF3kZyjlxXMMiADAgAfHuDCYv:D0OgFcvMDMfHuDCYv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 033b8e7f194e545d562816f8adc1affa
Files
-
033b8e7f194e545d562816f8adc1affa.exe windows:5 windows x86 arch:x86
af042229edbd39dcbe5733c35b9149ba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ltapi
ord12
ord21
ord20
ord7
ord9
ord13
ord14
LTAPIRemoveTasks
ord8
ord11
ord5
LTAPIAddTaskEx
ord17
ord16
ord18
ord15
LTAPIClearVolatileTasks
LTAPICompleteTask
ord22
LTAPIMonitorIPAddresses
ord19
LTAPISetIPAddressFilter
LTAPISetVolatileFilter
kernel32
FlushFileBuffers
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
WriteFile
IsBadWritePtr
VirtualAlloc
VirtualFree
CloseHandle
CreateMutexA
OpenMutexA
WaitForSingleObject
ReleaseMutex
GetProcAddress
GetModuleHandleA
CreateFileA
CopyFileA
DeleteFileA
GetLocalTime
GetCurrentProcess
GetVersionExA
GetModuleFileNameA
CreateProcessA
InterlockedExchange
LoadLibraryA
Sleep
SetEvent
GetCurrentProcessId
WaitForMultipleObjects
CreateThread
CreateEventA
TerminateProcess
OpenProcess
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
GetTimeZoneInformation
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
HeapSize
HeapReAlloc
GetCPInfo
GetOEMCP
GetACP
GetCurrentThreadId
VirtualQuery
SetEnvironmentVariableA
IsBadReadPtr
IsBadCodePtr
GetLocaleInfoA
VirtualProtect
GetSystemInfo
SetEndOfFile
ReadFile
SetConsoleCtrlHandler
CompareStringA
CompareStringW
FreeLibrary
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
RaiseException
HeapFree
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetLastError
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
QueryPerformanceCounter
GetTickCount
user32
CharNextA
MessageBoxA
DefWindowProcA
PostQuitMessage
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassExA
SendMessageTimeoutA
PostMessageA
GetWindowThreadProcessId
EnumWindows
RegisterWindowMessageA
advapi32
FreeSid
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
SetFileSecurityA
Sections
.text Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ