Static task
static1
Behavioral task
behavioral1
Sample
172a444a31fa58d38409433012226fbf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
172a444a31fa58d38409433012226fbf.exe
Resource
win10v2004-20231215-en
General
-
Target
172a444a31fa58d38409433012226fbf
-
Size
464KB
-
MD5
172a444a31fa58d38409433012226fbf
-
SHA1
c557d1d3ccbed32d3df0154ab9282b3bbeea0576
-
SHA256
d9ef8cba7ea2ad6b2c008fc5730cf33ddef1100b4495b2aefe1915d3cb44314b
-
SHA512
96680a1ec16ce7d5c0968adcccdd7f4f96bbd3d8a906c848aa0813310cbc57c6701eff20de2f825214e5f1332dee0d3a0e795427f40647c835844982adeffcc6
-
SSDEEP
6144:cpZGsmU+2y7b4kcmqE61nzUKjXWWtqrIPUZ0z4OvfTI8rnEeo2ezZViNlNkvQTpI:cg12y7emqEMAKki60ssjo92NBpfyqQd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 172a444a31fa58d38409433012226fbf
Files
-
172a444a31fa58d38409433012226fbf.exe windows:4 windows x86 arch:x86
2ca616baa7d6112df1b740c5a74acf49
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
RpcStringBindingParseW
RpcBindingSetAuthInfoExW
RpcBindingSetAuthInfoW
I_RpcBindingIsClientLocal
RpcBindingToStringBindingW
RpcRaiseException
RpcImpersonateClient
RpcEpResolveBinding
RpcBindingFromStringBindingW
RpcSsDestroyClientContext
UuidCreate
NdrClientCall2
RpcStringBindingComposeW
I_RpcExceptionFilter
UuidFromStringW
UuidToStringW
I_RpcMapWin32Status
RpcBindingFree
RpcBindingSetAuthInfoA
RpcRevertToSelf
RpcStringFreeW
NDRCContextBinding
RpcBindingSetAuthInfoExA
ntdll
NtWriteVirtualMemory
RtlAdjustPrivilege
ddraw
DirectDrawCreate
kernel32
lstrcmpiW
GetVolumeInformationW
lstrcpyW
RaiseException
MoveFileW
GetModuleHandleExW
GetComputerNameA
FindResourceA
SearchPathW
GetModuleFileNameW
SetNamedPipeHandleState
CreateEventA
EnterCriticalSection
GetSystemWindowsDirectoryW
GetLongPathNameW
FindClose
WideCharToMultiByte
GetFileTime
CreateEventW
SetThreadPriority
InterlockedIncrement
lstrlenA
GetProcessHeap
MultiByteToWideChar
FindFirstFileW
SetLastError
GetSystemTime
GetLogicalDriveStringsW
ResumeThread
GetComputerNameW
GetFileAttributesW
GetProcAddress
GetFileSize
lstrcmpW
FindResourceExW
CloseHandle
CancelIo
GetTickCount
WriteFile
GetSystemTimeAsFileTime
lstrcpyA
GetLastError
GetPrivateProfileStringW
DelayLoadFailureHook
InterlockedExchange
GetDiskFreeSpaceExW
TerminateProcess
GlobalMemoryStatus
MapViewOfFile
GetPriorityClass
OutputDebugStringW
GetModuleHandleW
FindNextFileW
WaitForSingleObject
DuplicateHandle
LocalReAlloc
lstrlenW
GetFileSizeEx
HeapFree
InterlockedCompareExchange
HeapAlloc
IsBadWritePtr
WaitNamedPipeW
VirtualFree
LoadLibraryA
VirtualAlloc
Sleep
OpenEventW
ReadFile
lstrcatW
GetProfileStringA
GetCurrentProcessId
GetDiskFreeSpaceW
CreateMutexW
CompareFileTime
InitializeCriticalSection
GetWindowsDirectoryW
FreeLibrary
GetFullPathNameA
ExitThread
CreateProcessInternalA
CreateProcessInternalW
_lclose
GetPrivateProfileIntW
CreateFileA
WritePrivateProfileStringW
GetVersionExA
DeviceIoControl
GetCurrentThreadId
GetSystemDirectoryW
GetTimeZoneInformation
SetUnhandledExceptionFilter
SetErrorMode
LoadLibraryExW
ReadProcessMemory
DeleteCriticalSection
LocalAlloc
CreateMutexA
GetDriveTypeW
UnhandledExceptionFilter
SizeofResource
FindFirstFileExW
CreateFileMappingW
WaitForMultipleObjectsEx
GetUserDefaultUILanguage
LoadLibraryW
lstrcpynW
SleepEx
ExpandEnvironmentStringsA
AreFileApisANSI
CopyFileW
GetLocalTime
InterlockedDecrement
GetFullPathNameW
GetCurrentProcess
ReleaseMutex
CreateFileMappingA
OpenFile
QueryPerformanceCounter
FormatMessageW
GetComputerNameExW
DeleteFileW
SetEvent
LeaveCriticalSection
InterlockedExchangeAdd
ExpandEnvironmentStringsW
GetSystemInfo
GetOverlappedResult
GetFileAttributesExW
CreateFileW
LocalFree
OpenMutexW
UnmapViewOfFile
LoadResource
EnumUILanguagesW
GetModuleHandleA
ResetEvent
CreateThread
SetFilePointer
OpenProcess
GetProfileIntA
GetCommandLineW
GetCurrentThread
Sections
.text Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 392KB - Virtual size: 391KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ