Static task
static1
Behavioral task
behavioral1
Sample
ba0b6234cb2e1b19f6d2c759f19ed2ba31aa7da4b1745b77185d68672eb5f85d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ba0b6234cb2e1b19f6d2c759f19ed2ba31aa7da4b1745b77185d68672eb5f85d.exe
Resource
win10v2004-20231222-en
General
-
Target
ba0b6234cb2e1b19f6d2c759f19ed2ba31aa7da4b1745b77185d68672eb5f85d
-
Size
10.0MB
-
MD5
c53e19afba0f5298a97c8c72ef9cdf38
-
SHA1
f089658c34790cd816ce57904533376eab59b25e
-
SHA256
ba0b6234cb2e1b19f6d2c759f19ed2ba31aa7da4b1745b77185d68672eb5f85d
-
SHA512
8341ea5fb6ac01c09cf5bcc752b429874f95cb3161c1ffd5e0ea2faa1d659477b00d6033f69eff1bb1d60f12bec437bbe51d9a54ec365ffa637048ab43214412
-
SSDEEP
196608:V6CqNWzHxSXRTBFLiB++2+hZ9xWjwJQxKMaRVoDO2A8bnC:85CxyRtF+NqUJQIMaRiiwbC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ba0b6234cb2e1b19f6d2c759f19ed2ba31aa7da4b1745b77185d68672eb5f85d
Files
-
ba0b6234cb2e1b19f6d2c759f19ed2ba31aa7da4b1745b77185d68672eb5f85d.exe windows:5 windows x86 arch:x86
005e990545d9f8a0ef5292feec2d8dd4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetFileAttributesW
FormatMessageW
FindClose
GetFullPathNameW
FindFirstFileW
FlushInstructionCache
HeapCreate
InterlockedCompareExchange
HeapAlloc
HeapFree
InitializeCriticalSection
FreeLibrary
LoadLibraryW
GetVersionExW
GetLocalTime
GetVersionExA
IsBadReadPtr
LoadLibraryA
GetModuleHandleA
AreFileApisANSI
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
FindNextFileW
MoveFileExW
GetFileSize
GetFileSizeEx
ReadFile
GetFileAttributesExW
CopyFileW
GetShortPathNameW
GlobalFree
LocalAlloc
LocalFree
OpenProcess
GetExitCodeProcess
ReadProcessMemory
WaitForSingleObject
CreateProcessW
CreateToolhelp32Snapshot
Process32FirstW
FreeResource
GetDriveTypeW
GetACP
GetSystemInfo
ResumeThread
SetEndOfFile
SetFilePointer
GetFileTime
SetFileTime
GetLongPathNameW
lstrlenW
GetSystemDirectoryW
GetTempFileNameW
GetWindowsDirectoryW
GetCurrentDirectoryW
SearchPathW
MoveFileW
InterlockedExchangeAdd
TryEnterCriticalSection
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
GetStdHandle
GetFileType
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
RtlUnwind
RaiseException
LoadLibraryExW
WriteConsoleW
ExitProcess
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
GetConsoleCP
FlushFileBuffers
HeapSize
GetFileInformationByHandle
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
lstrlenA
GetSystemTime
SystemTimeToFileTime
GlobalMemoryStatus
DeviceIoControl
CreatePipe
InitializeCriticalSectionEx
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
Process32NextW
VerifyVersionInfoW
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
WaitForMultipleObjects
FormatMessageA
InterlockedIncrement
WideCharToMultiByte
OutputDebugStringA
CreateThread
CreateFileW
GetTempPathW
FindResourceW
OutputDebugStringW
CloseHandle
WriteFile
SizeofResource
LoadResource
Sleep
LockResource
CreateMutexW
ReleaseMutex
GetLastError
SetCurrentDirectoryW
GetModuleHandleW
GetModuleFileNameW
GetTickCount
InterlockedDecrement
HeapDestroy
user32
SystemParametersInfoA
CharLowerBuffW
MapVirtualKeyA
IsMenu
CreatePopupMenu
DestroyMenu
CheckMenuItem
GetMenuItemCount
InsertMenuW
AppendMenuW
DeleteMenu
TrackPopupMenu
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetForegroundWindow
SetMenuContextHelpId
UpdateLayeredWindow
MsgWaitForMultipleObjects
GetForegroundWindow
GetProcessWindowStation
GetUserObjectInformationW
BeginPaint
UpdateWindow
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetCapture
SetFocus
IsZoomed
IsIconic
SetLayeredWindowAttributes
AnimateWindow
PostQuitMessage
TrackMouseEvent
IsWindowVisible
MonitorFromWindow
GetWindow
GetParent
SetWindowLongW
GetWindowLongW
MapWindowPoints
GetWindowRect
GetActiveWindow
GetDlgItem
CreateWindowExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
LoadImageW
CreateIconFromResource
LoadBitmapW
DestroyWindow
IsWindow
DestroyCursor
LoadCursorW
IntersectRect
GetIconInfo
DrawIconEx
OffsetRect
InflateRect
ReleaseDC
GetDC
GetWindowPlacement
SendMessageW
LoadIconW
GetSystemMetrics
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetSysColor
ClientToScreen
EnableMenuItem
CharNextW
GetDesktopWindow
SetActiveWindow
ShowWindow
MessageBoxW
PostMessageW
SetWindowPos
SetWindowTextW
IsWindowEnabled
EnableWindow
GetKeyState
GetFocus
PtInRect
EqualRect
wsprintfW
SystemParametersInfoW
DrawTextW
SetRect
SetCursor
DestroyIcon
EndPaint
GetClassNameW
IsRectEmpty
UnionRect
CopyRect
ScreenToClient
SetCaretPos
HideCaret
GetCaretBlinkTime
CreateCaret
GetCursorPos
InvalidateRect
GetMonitorInfoW
GetClientRect
advapi32
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
StartServiceW
RegCreateKeyExW
RegEnumKeyW
RegEnumValueW
RegQueryValueExW
RegSetKeySecurity
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
ChangeServiceConfig2W
ChangeServiceConfigW
DuplicateTokenEx
RegOpenKeyExW
RegSetValueExW
CreateProcessAsUserW
LookupPrivilegeValueW
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
SetTokenInformation
GetTokenInformation
OpenProcessToken
RegEnumKeyExW
RegCloseKey
OpenServiceW
shell32
SHBrowseForFolderW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHChangeNotify
ole32
CoInitializeEx
CoSetProxyBlanket
CoCreateGuid
OleInitialize
OleUninitialize
CoInitialize
CoUninitialize
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CreateBindCtx
shlwapi
StrToIntExW
SHDeleteValueW
SHDeleteKeyW
StrStrIW
PathFileExistsW
PathRemoveFileSpecW
ws2_32
sendto
recvfrom
__WSAFDIsSet
WSAIoctl
getpeername
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
select
htonl
ioctlsocket
gethostname
shutdown
htons
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
socket
setsockopt
listen
connect
closesocket
bind
accept
WSASetLastError
send
recv
getnameinfo
freeaddrinfo
getaddrinfo
WSAGetLastError
gdiplus
GdipSaveImageToFile
GdipAlloc
GdipGetImageHeight
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDisposeImage
GdipCloneImage
GdipGetImageGraphicsContext
GdiplusStartup
GdipGetImageWidth
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFileICM
GdipFree
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDeleteGraphics
GdipGraphicsClear
GdiplusShutdown
GdipDrawImageI
GdipImageGetFrameDimensionsList
GdipDrawImageRectI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipImageGetFrameDimensionsCount
imm32
ImmReleaseContext
ImmGetContext
ImmAssociateContext
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
gdi32
GetGlyphIndicesW
GetTextExtentPointI
AddFontMemResourceEx
RemoveFontMemResourceEx
SetTextColor
GetOutlineTextMetricsW
SetTextAlign
CreateCompatibleDC
GetTextMetricsW
SetWorldTransform
GetFontUnicodeRanges
GetGlyphOutlineW
GetFontData
GetCharABCWidthsW
EnumFontFamiliesExW
GetStockObject
CreateCompatibleBitmap
StretchBlt
ExtTextOutW
GetTextFaceW
GdiFlush
GetDCOrgEx
SetBkMode
GetClipBox
CreateSolidBrush
CreateFontIndirectW
CreateBitmap
CreateRoundRectRgn
EnumFontsW
SetGraphicsMode
GetDeviceCaps
BitBlt
GetViewportOrgEx
GetCurrentObject
SetViewportOrgEx
GetObjectW
CreateDIBSection
SelectObject
SelectClipRgn
IntersectClipRect
GetRegionData
ExtCreateRegion
DeleteObject
DeleteDC
Rectangle
oleaut32
SysFreeString
SysAllocString
VariantClear
SysAllocStringByteLen
SysStringLen
crypt32
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertOpenStore
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertCloseStore
wldap32
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord219
ord216
ord14
ord46
ord145
setupapi
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList
iphlpapi
GetAdaptersAddresses
usp10
ScriptFreeCache
ScriptItemize
ScriptShape
Sections
.text Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 927KB - Virtual size: 927KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 73KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 61.3MB - Virtual size: 61.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 181KB - Virtual size: 181KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ