Static task
static1
Behavioral task
behavioral1
Sample
0971ae94a974da8160d070c2f73f1299.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0971ae94a974da8160d070c2f73f1299.exe
Resource
win10v2004-20231215-en
General
-
Target
0971ae94a974da8160d070c2f73f1299
-
Size
328KB
-
MD5
0971ae94a974da8160d070c2f73f1299
-
SHA1
1508817b2c0d864d261e09483a0321396138f149
-
SHA256
2376fe8ea49ac1bf8cb923c77ad5506f122ffc323582b23566ebcd57dc43d92e
-
SHA512
55446add385e60f01b29f3524ecc52ab23fe4e1b02daf97c1762800da5c6a0aa47ffc7a4b2f48169c28aa11a1ce9d171c16e27dfbb0a360fe40256072bc4fda1
-
SSDEEP
6144:uggUdHBlWrnRIxDwMA5k2GNH7vpeu1ir4b38kv0:uggUdHLAnRIKFf9L4b38k8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0971ae94a974da8160d070c2f73f1299
Files
-
0971ae94a974da8160d070c2f73f1299.exe windows:4 windows x86 arch:x86
3fe2be9f31798559c581e98e666b4898
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
LoadLibraryW
GetCurrentThreadId
ReleaseMutex
CreateMutexW
DeleteFileA
WaitForSingleObject
GetDiskFreeSpaceExW
TerminateProcess
CreateProcessA
CreateFileA
GlobalMemoryStatus
GetTimeFormatA
GetDateFormatA
GetSystemDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
ExitThread
GetTempPathA
GetComputerNameA
GetLocaleInfoA
CreateThread
TerminateThread
lstrcmpiA
SetErrorMode
GetExitCodeProcess
GetTempPathW
CreatePipe
SearchPathA
SetFileTime
GetFileTime
GetWindowsDirectoryA
SystemTimeToFileTime
GetSystemTimeAsFileTime
SizeofResource
LockResource
LoadResource
FindResourceW
InitializeCriticalSection
CopyFileA
MoveFileA
LeaveCriticalSection
EnterCriticalSection
SetEvent
WideCharToMultiByte
ResetEvent
CreateEventW
SetEndOfFile
SetEnvironmentVariableA
SetCurrentDirectoryW
DeleteFileW
CopyFileW
GetVersionExW
LoadLibraryA
GetProcAddress
GetSystemDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
VirtualFree
VirtualAlloc
DuplicateHandle
GetTickCount
CreateFileW
ReadFile
GetWindowsDirectoryW
OpenProcess
SetPriorityClass
GetCurrentProcess
CloseHandle
MultiByteToWideChar
ExitProcess
Sleep
SetLastError
lstrlenW
GetProcessHeap
HeapAlloc
GetLastError
HeapReAlloc
HeapFree
GetModuleHandleW
GetModuleFileNameA
GetStdHandle
GetCurrentProcessId
WriteFile
PeekNamedPipe
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetStringTypeW
GetStringTypeA
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
HeapSize
SetFilePointer
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
HeapCreate
HeapDestroy
DeleteCriticalSection
GetFileType
SetHandleCount
GetStartupInfoA
GetVersionExA
GetModuleHandleA
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCommandLineA
user32
wsprintfW
wsprintfA
advapi32
EnumServicesStatusW
GetSidSubAuthority
LookupAccountSidW
ControlService
QueryServiceStatus
StartServiceW
OpenServiceW
DeleteService
AllocateAndInitializeSid
FreeSid
OpenServiceA
RegCreateKeyExA
InitiateSystemShutdownW
OpenSCManagerW
GetUserNameA
GetUserNameW
LsaClose
StartServiceCtrlDispatcherW
LsaAddAccountRights
LsaRemoveAccountRights
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegisterServiceCtrlHandlerW
SetServiceStatus
OpenSCManagerA
CreateServiceA
ChangeServiceConfig2W
CloseServiceHandle
LsaOpenPolicy
LookupAccountNameW
shell32
ShellExecuteA
odbc32
ord24
ord75
ord31
ord141
mpr
WNetAddConnection2W
WNetCancelConnectionW
netapi32
NetUserGetInfo
NetServerDiskEnum
NetUserEnum
NetShareAdd
NetApiBufferFree
wininet
InternetOpenW
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
ws2_32
WSACleanup
closesocket
send
select
connect
ioctlsocket
socket
htons
inet_addr
inet_ntoa
gethostbyname
recv
__WSAFDIsSet
getsockname
sendto
htonl
setsockopt
WSASocketW
WSAStartup
gethostbyaddr
shutdown
Sections
.text Size: 160KB - Virtual size: 159KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ