Static task
static1
Behavioral task
behavioral1
Sample
117362712ac03df77abd9ff7d9adb684.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
117362712ac03df77abd9ff7d9adb684.exe
Resource
win10v2004-20231215-en
General
-
Target
117362712ac03df77abd9ff7d9adb684
-
Size
10.7MB
-
MD5
117362712ac03df77abd9ff7d9adb684
-
SHA1
4f523c36361897b0a44fb3e0c1928abe572558c6
-
SHA256
63a34c73f9e0e7384f23a6397f325e5f6b1d0a456f97d63d32be878afa6ba583
-
SHA512
83342ece3efde9289f12dd02d5ec44a5269cda6df2ffe3352425879c236610591a97ba5515c41b52e79ce3af38c8471bdddbd375475f577a2d1910aa9f537fbd
-
SSDEEP
196608:/1qLn/DmaRfTU3Na1HE0bmRIGtvmewwmDSe485MeVIISGLJgNQpWE:da/DBRfQda9m5bwwGSY5TTSgJgNe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 117362712ac03df77abd9ff7d9adb684
Files
-
117362712ac03df77abd9ff7d9adb684.exe windows:5 windows x86 arch:x86
55f8e466e609e883100b05c6925e87a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidToStringW
RpcStringFreeW
shlwapi
PathFindFileNameW
StrCmpIW
SHDeleteKeyW
SHDeleteValueW
PathRemoveExtensionW
SHGetValueW
SHSetValueW
user32
CreateWindowExW
GetSystemMetrics
LoadIconW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowRect
PostQuitMessage
FindWindowExA
SendMessageW
DefWindowProcW
ShowWindow
MessageBoxW
MessageBoxIndirectW
GetWindowThreadProcessId
GetShellWindow
RegisterClassExW
LoadCursorW
PostMessageW
kernel32
GetConsoleCP
QueryPerformanceCounter
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
IsProcessorFeaturePresent
HeapSize
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedIncrement
GetCPInfo
GetTimeZoneInformation
IsDebuggerPresent
VirtualFree
VirtualAlloc
GetFileSize
FindFirstFileW
SetFilePointer
VirtualQuery
GetCurrentProcess
GetCurrentThread
WriteFile
OpenProcess
WideCharToMultiByte
GetVersionExW
TerminateProcess
ReadFile
CreateFileW
MultiByteToWideChar
GetConsoleMode
SetLastError
FindClose
Process32FirstW
RemoveDirectoryW
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTickCount
GetTempPathW
CreateProcessW
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
GetModuleHandleA
FindResourceA
FreeResource
LoadResource
LoadLibraryW
SizeofResource
LockResource
ExitProcess
CreateMutexW
CreateDirectoryW
GetModuleHandleW
Sleep
CopyFileW
GetModuleFileNameW
FindResourceW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MapViewOfFile
RaiseException
OpenEventA
OpenFileMappingA
LocalFree
InterlockedDecrement
GetVersion
MoveFileExW
GetCurrentThreadId
GetStringTypeW
RtlUnwind
HeapReAlloc
SetStdHandle
WriteConsoleW
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
LoadLibraryA
InterlockedExchange
FreeLibrary
GetLastError
SetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
LocalAlloc
advapi32
SetEntriesInAclW
SetSecurityInfo
AllocateAndInitializeSid
GetSecurityInfo
DuplicateTokenEx
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenThreadToken
OpenProcessToken
FreeSid
shell32
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW
ole32
CoCreateGuid
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantInit
Sections
.text Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13.1MB - Virtual size: 13.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ