Behavioral task
behavioral1
Sample
27cb1c920995b7780b7daf7bc3a29b2c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
27cb1c920995b7780b7daf7bc3a29b2c.exe
Resource
win10v2004-20231215-en
General
-
Target
27cb1c920995b7780b7daf7bc3a29b2c
-
Size
500KB
-
MD5
27cb1c920995b7780b7daf7bc3a29b2c
-
SHA1
185a109ca7c807c664a8a9f4611c4809000f5b11
-
SHA256
9f471900ec46bfc8113f1e088642e8f9d176c00fac57f63ce866394b2936c702
-
SHA512
df94e147aa51d50087989bdff2eb784d6e5418ba755b8836275f178c06d17e657b6f8822b6a759f9f566d9e6c47d9fe84b7d8158eb82bdfa1dee4c3db6b26f82
-
SSDEEP
6144:7z1v4paGECo9F3y0qvbQtqCdNMLAjVJIhMqR+0/5VUNZmMoAO:XFyaGECoRqvkqkakjVrqRsr
Malware Config
Signatures
-
Ardamax family
-
Ardamax main executable 1 IoCs
resource yara_rule sample family_ardamax -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27cb1c920995b7780b7daf7bc3a29b2c
Files
-
27cb1c920995b7780b7daf7bc3a29b2c.exe windows:4 windows x86 arch:x86
090bfec246706900caf708cf52ddc611
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
UrlUnescapeW
StrDupW
PathRemoveFileSpecW
PathFileExistsW
PathRemoveExtensionW
PathFindExtensionW
PathFindFileNameW
StrFormatByteSizeW
StrCmpIW
PathStripPathW
ws2_32
recv
send
WSAStartup
htons
WSACleanup
getservbyname
inet_addr
gethostbyname
socket
closesocket
shutdown
select
connect
comctl32
ImageList_Destroy
ImageList_Create
CreatePropertySheetPageW
PropertySheetW
_TrackMouseEvent
DestroyPropertySheetPage
ImageList_LoadImageW
ImageList_Draw
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_GetImageCount
shell32
Shell_NotifyIconW
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW
ExtractIconW
SHChangeNotify
DoEnvironmentSubstW
ShellExecuteExW
wininet
InternetGetLastResponseInfoW
InternetOpenW
InternetCloseHandle
FtpPutFileW
FtpCreateDirectoryW
FtpRemoveDirectoryW
FtpDeleteFileW
FtpSetCurrentDirectoryW
InternetConnectW
mpr
WNetCancelConnection2W
WNetAddConnection2W
kernel32
LCMapStringW
GetThreadLocale
IsProcessorFeaturePresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringA
Sleep
SetProcessPriorityBoost
EnterCriticalSection
lstrcpyW
MoveFileExW
ExitProcess
GetCurrentProcessId
CompareStringW
CloseHandle
InitializeCriticalSection
WriteFile
lstrlenW
CreateMutexW
CreateFileW
InterlockedIncrement
GetLastError
SetProcessWorkingSetSize
RaiseException
GetCurrentProcess
SizeofResource
InterlockedDecrement
LoadResource
GetVersionExW
lstrcmpiW
FindResourceW
LoadLibraryExW
VirtualAlloc
DeleteFileW
lstrlenA
GetDateFormatW
SetLastError
lstrcpyA
VirtualFree
DeleteCriticalSection
lstrcmpA
GetUserDefaultLangID
CreateThread
SetThreadPriority
ResumeThread
LockResource
GlobalLock
GetLocalTime
lstrcmpW
GlobalUnlock
SystemTimeToFileTime
CompareFileTime
FindResourceExW
FlushInstructionCache
GetCurrentThreadId
lstrcatW
LoadLibraryW
GetSystemTimeAsFileTime
GetModuleFileNameW
GetVersion
GetModuleHandleW
lstrcpynW
RemoveDirectoryW
GetShortPathNameW
MultiByteToWideChar
GetProcAddress
CreateDirectoryW
GetEnvironmentVariableW
LeaveCriticalSection
WideCharToMultiByte
OpenProcess
SetFileAttributesW
SetPriorityClass
FreeLibrary
GetCurrentThread
EnumResourceNamesW
LocalAlloc
LocalReAlloc
ReadFile
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
SetFilePointer
LocalFree
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FormatMessageW
CreateToolhelp32Snapshot
OutputDebugStringW
GetTimeZoneInformation
GetComputerNameW
lstrcmpiA
GetTimeFormatW
GetTickCount
CopyFileW
GetTempFileNameW
GetTempPathW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesW
MoveFileW
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetProcessHeap
GetStartupInfoW
HeapDestroy
HeapCreate
GetModuleHandleA
GetStdHandle
GetModuleFileNameA
HeapSize
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
RtlUnwind
InterlockedExchange
LoadLibraryA
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
LCMapStringA
VirtualQuery
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
user32
GetClassInfoExW
GetWindow
LoadIconW
InvalidateRect
SetDlgItemInt
GetDC
EnumWindows
CallWindowProcW
WindowFromPoint
FrameRect
PeekMessageW
SetTimer
SetRectEmpty
UnhookWindowsHookEx
CopyRect
BeginPaint
GetParent
GetMessagePos
PtInRect
GetDlgItem
SendMessageTimeoutW
FindWindowW
OffsetRect
GetFocus
GetDlgItemTextW
KillTimer
EndPaint
RegisterHotKey
DrawEdge
UnregisterHotKey
SetWindowLongW
MessageBeep
TrackPopupMenuEx
SetFocus
PostMessageW
GetMonitorInfoW
MonitorFromPoint
ReleaseDC
SetClipboardViewer
DestroyWindow
GetWindowTextLengthW
GetDlgItemInt
CharNextW
LoadImageW
SetCursor
CallNextHookEx
GetSystemMetrics
ChangeClipboardChain
GetWindowTextW
LoadCursorW
GetKeyState
SetWindowsHookExW
GetSysColor
IsClipboardFormatAvailable
SendMessageW
DrawTextW
GetSysColorBrush
OpenClipboard
DdeInitializeW
SystemParametersInfoW
DdeCreateStringHandleW
DdeConnect
SetDlgItemTextW
DdeClientTransaction
GetClipboardData
DdeAccessData
GetClassLongW
DispatchMessageW
IsMenu
TranslateMessage
DestroyMenu
SetForegroundWindow
GetWindowLongW
CreateWindowExW
GetMessageW
DeleteMenu
GetClientRect
CloseClipboard
ReleaseCapture
DdeDisconnect
CheckMenuItem
IsWindowEnabled
EndDialog
DdeFreeStringHandle
IsWindow
GetMenu
InflateRect
GetCapture
DdeUninitialize
GetSubMenu
GetMenuItemCount
PostQuitMessage
MapWindowPoints
TrackPopupMenu
AdjustWindowRectEx
DrawFrameControl
SetCapture
GetMenuItemInfoW
ScrollWindow
RegisterWindowMessageW
GetWindowThreadProcessId
FillRect
SetMenuItemInfoW
SetWindowTextW
CharLowerW
MoveWindow
GetWindowModuleFileNameW
GetDesktopWindow
ModifyMenuW
EnableWindow
UpdateWindow
wsprintfW
MapVirtualKeyW
GetKeyNameTextW
UnregisterClassA
GetCursorPos
GetForegroundWindow
GetActiveWindow
ShowWindow
GetWindowRect
MessageBoxW
GetClassNameW
LoadMenuW
IsWindowVisible
GetAncestor
ScreenToClient
DefWindowProcW
DestroyIcon
RegisterClassExW
DialogBoxParamW
GetDlgCtrlID
GetWindowDC
DrawFocusRect
SetWindowPos
gdi32
CreateDIBSection
SetBkMode
CreateCompatibleDC
CreateRectRgnIndirect
SelectObject
CreateBitmap
SetBkColor
BitBlt
ExcludeClipRect
CreateFontW
GetObjectW
CreateFontIndirectW
GetDIBits
SetPolyFillMode
RealizePalette
CombineRgn
DeleteDC
DeleteObject
GetTextMetricsW
SetTextColor
CreateCompatibleBitmap
GetStockObject
CreatePatternBrush
GetTextExtentPoint32W
CreateSolidBrush
CreatePen
SetBrushOrgEx
TextOutW
Polygon
PatBlt
comdlg32
GetSaveFileNameW
GetOpenFileNameW
ole32
CoTaskMemRealloc
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
oleaut32
SysFreeString
VarUI4FromStr
Sections
.text Size: 365KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ