Static task
static1
Behavioral task
behavioral1
Sample
0bfaee63d7b3e24a7672f78e5059146c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0bfaee63d7b3e24a7672f78e5059146c.exe
Resource
win10v2004-20231215-en
General
-
Target
0bfaee63d7b3e24a7672f78e5059146c
-
Size
2.4MB
-
MD5
0bfaee63d7b3e24a7672f78e5059146c
-
SHA1
6b63143276c08c8c89b6aa6606dd5056bed1fb64
-
SHA256
96a319a705dc13f0e17c5217e00ee60383e3fe4a0e56adba8a90093f30e7fee4
-
SHA512
6ebfdd65b7baf766e30af5d88ce390f8bccbd1b22f27683667583103b954e4420d473d19cf740499ba76dfb412a6e883c1948bd037d7b740d3eab517a7b71864
-
SSDEEP
24576:WfwrGID2rJO7LYlRrZtZAGtJF4Aq9UjfBBcgF9op9xqvvQyyupDJdy+iSiqmXLTR:SwrRElhZL5DbBB/yshmPNn75YMyR7xo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0bfaee63d7b3e24a7672f78e5059146c
Files
-
0bfaee63d7b3e24a7672f78e5059146c.exe windows:5 windows x86 arch:x86
bbd010668e3412e62a07e288c355502c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindResourceA
lstrlenA
FindClose
CreateMutexA
GetVolumeInformationA
GetModuleHandleA
HeapSize
GetVersion
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
GetLastError
OpenMutexA
GetFileAttributesA
CreateFileA
LoadLibraryA
LockResource
DeleteFileA
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
SetFileAttributesA
GetLogicalDriveStringsA
DecodePointer
HeapDestroy
GetProcAddress
GetFileSize
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
UpdateResourceA
CreateProcessA
CreateDirectoryA
EndUpdateResourceA
GetComputerNameA
AreFileApisANSI
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesExW
OutputDebugStringW
GetVersionExA
DeleteFileW
LeaveCriticalSection
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetCurrentProcessId
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
FindNextFileA
GetDriveTypeA
TerminateProcess
InterlockedDecrement
WriteFile
EnterCriticalSection
SetLastError
HeapFree
FindFirstFileA
BeginUpdateResourceA
VirtualFree
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
FindFirstFileExA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
GetCurrentDirectoryW
MoveFileExW
HeapQueryInformation
SetEnvironmentVariableA
GetConsoleCP
SizeofResource
GetModuleFileNameA
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FreeLibraryAndExitThread
ExitThread
CreateThread
ReadConsoleW
GetConsoleMode
GetACP
GetSystemInfo
ReadFile
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
TryEnterCriticalSection
DuplicateHandle
GetCurrentThread
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InterlockedPushEntrySList
InterlockedFlushSList
LoadLibraryExW
GetModuleFileNameW
RtlUnwind
VirtualAlloc
VirtualProtect
VirtualQuery
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
WriteConsoleW
GetCommandLineA
GetCommandLineW
user32
GetDC
GetDesktopWindow
wsprintfA
ReleaseDC
GetSystemMetrics
gdi32
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
DeleteObject
GetObjectA
advapi32
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SystemFunction036
shell32
ShellExecuteA
SHGetSpecialFolderPathA
ole32
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
CoInitialize
oleaut32
VariantClear
SysAllocString
SysFreeString
VariantInit
shlwapi
PathFindExtensionA
PathFindExtensionW
gdiplus
GdiplusStartup
GdipCloneImage
GdiplusShutdown
GdipGetImageEncoders
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipFree
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdipAlloc
wininet
InternetConnectA
InternetCloseHandle
HttpSendRequestA
InternetReadFile
HttpOpenRequestA
InternetCheckConnectionA
InternetOpenA
urlmon
URLDownloadToFileA
ObtainUserAgentString
iphlpapi
GetAdaptersInfo
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 261KB - Virtual size: 261KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 959KB - Virtual size: 958KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ