Static task
static1
Behavioral task
behavioral1
Sample
228562239cb3c46962152c7ae017f5d3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
228562239cb3c46962152c7ae017f5d3.exe
Resource
win10v2004-20231215-en
General
-
Target
228562239cb3c46962152c7ae017f5d3
-
Size
434KB
-
MD5
228562239cb3c46962152c7ae017f5d3
-
SHA1
5fd88831cbdc7379a0dcd5f045e2c23e1edbba37
-
SHA256
d41b7f3a7e11d1df1cd07f6d5721be4a49e73c434b2ceca1097355bf11be91b2
-
SHA512
889279d4a4bce6b8efc5458c5cc0ba6320d0b0da5896142be4fc8d00a6186f8b55e4d2db41777a01a438ee287cb251a064d75407ad1d763d7e6873d24acf5dc9
-
SSDEEP
12288:ZU+UKDG9BP5fVwZLwxc2TPll6/9/X/n/K/Q/r/:GkG9BP5fVwZc+2Ti/9/X/n/K/Q/r/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 228562239cb3c46962152c7ae017f5d3
Files
-
228562239cb3c46962152c7ae017f5d3.exe windows:4 windows x86 arch:x86
b25753c6dc3f8aaa6f3eee1843071943
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnmapViewOfFile
OutputDebugStringA
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetCurrentThreadId
GetTickCount
Sleep
GetWindowsDirectoryA
CreateDirectoryA
IsBadCodePtr
SuspendThread
ResumeThread
GetCurrentThread
ResetEvent
CreateEventA
TerminateThread
WaitForSingleObject
SetEvent
WaitForMultipleObjects
PulseEvent
ReleaseMutex
CreateFileMappingA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableA
SetEndOfFile
GetLocaleInfoW
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LCMapStringW
LCMapStringA
FlushFileBuffers
ReadFile
SetFilePointer
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
MapViewOfFileEx
CloseHandle
GetVersionExA
GetACP
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
CompareStringW
CompareStringA
lstrlenA
lstrlenW
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
GetLastError
WideCharToMultiByte
MultiByteToWideChar
CreateMutexA
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetCPInfo
QueryPerformanceCounter
GetFileType
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
VirtualAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
InterlockedIncrement
InterlockedDecrement
GetSystemTimeAsFileTime
ExitThread
CreateThread
VirtualFree
HeapCreate
ExitProcess
WriteFile
GetStdHandle
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
user32
UpdateWindow
ShowWindow
CreateWindowExA
GetFocus
LoadStringA
GetMessageA
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
DefWindowProcA
PostQuitMessage
UnregisterClassA
advapi32
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
MakeSelfRelativeSD
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeAbsoluteSD
GetSecurityDescriptorControl
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
GetUserNameA
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoInitialize
CoUninitialize
OleFlushClipboard
shlwapi
PathFileExistsA
PathStripPathW
PathAddBackslashW
PathAppendW
ord8
msvcr100
_isctype
mfc42u
ord6582
gdi32
ord1002
GetTextMetricsW
rpcrt4
TowerExplode
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.l1 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l1 Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE