Static task
static1
Behavioral task
behavioral1
Sample
1b298dc52943d3e07b71c8e4bdd8c32f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1b298dc52943d3e07b71c8e4bdd8c32f.exe
Resource
win10v2004-20231215-en
General
-
Target
1b298dc52943d3e07b71c8e4bdd8c32f
-
Size
133KB
-
MD5
1b298dc52943d3e07b71c8e4bdd8c32f
-
SHA1
1d07fdfbf0afe704c11a98e6e0cc1ec847f23e06
-
SHA256
710c9406d10d9887f8a8c5fc67797ea535048ba7c7988d918a9984d2d7301461
-
SHA512
0fd330db69085e04870575bf0a9dc2a7261ac4fb0079d1e4e9b372667e3f4cb48320e95101f36a7403a750b5e9561335460d5e834f072c872835b809fcedb97c
-
SSDEEP
1536:z1nHFz4FCX3RmXhMiJCvhH9yY5SxBuiGZYx8s+8AaZxiCk3uENF3kUUcI:n4A3kEvSGZYCs+8AaPiVugF3r3I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1b298dc52943d3e07b71c8e4bdd8c32f
Files
-
1b298dc52943d3e07b71c8e4bdd8c32f.exe windows:4 windows x86 arch:x86
24e6ff8621615baba929aeb34b0986b1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempFileNameA
MoveFileExA
GetShortPathNameA
GetWindowsDirectoryA
DeleteFileA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
lstrcpyA
GetCurrentProcess
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
OpenEventA
SetEvent
CloseHandle
GetModuleFileNameA
OpenProcess
WaitForSingleObject
Sleep
GetTickCount
IsDBCSLeadByte
WinExec
GlobalSize
CreateFileA
GlobalFree
WriteFile
GetCurrentProcessId
CopyFileA
CreateEventA
CreateProcessA
VirtualProtect
GetTempPathA
GlobalAlloc
SetFilePointer
FindNextFileA
LocalAlloc
LocalFree
GetVersionExA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
HeapSize
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSection
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetFileSize
FindClose
lstrlenA
lstrcmpA
lstrcmpiA
GetCurrentDirectoryA
FindFirstFileA
SetFileAttributesA
lstrcatA
GetFileAttributesA
RemoveDirectoryA
lstrcpynA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
SetCurrentDirectoryA
ReadFile
HeapAlloc
HeapFree
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
MultiByteToWideChar
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
user32
DestroyWindow
SetWindowPos
GetWindowLongA
AdjustWindowRect
MapDialogRect
SetRect
IsDlgButtonChecked
GetClientRect
PostQuitMessage
PeekMessageA
ShowWindow
SendDlgItemMessageA
CreateDialogParamA
MessageBoxA
DispatchMessageA
TranslateMessage
IsDialogMessageA
GetMessageA
SetDlgItemTextA
ExitWindowsEx
GetDlgItem
SetWindowTextA
wsprintfA
LoadStringA
CharPrevA
comdlg32
GetFileTitleA
advapi32
OpenProcessToken
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegQueryValueExA
RegCloseKey
shell32
SHChangeNotify
SHGetPathFromIDListA
SHGetSpecialFolderLocation
comctl32
ord8
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ