Static task
static1
Behavioral task
behavioral1
Sample
2ae7391d9c9d1de7a2edfa8ad0d7dc4d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2ae7391d9c9d1de7a2edfa8ad0d7dc4d.exe
Resource
win10v2004-20231215-en
General
-
Target
2ae7391d9c9d1de7a2edfa8ad0d7dc4d
-
Size
596KB
-
MD5
2ae7391d9c9d1de7a2edfa8ad0d7dc4d
-
SHA1
f34227ed2a45aee3849f58e78c5cd112e23988d1
-
SHA256
dd3d98778c1bf3576283259eae3f68a00dc8d5f71da468f3c8503c82bbd54504
-
SHA512
c357a8270b317462eced024f6db04e281be2ae7532652d83740ead9609f892491110a6497c1427f565e6e97966fcb06365eb9869eb1db353ab39bba3d24026b8
-
SSDEEP
12288:v6+utAeSsiEkGH9pUsfn3Gce4sl7dHxcVOqtFufZjtF3zh5h:S+uSxsiEPjK9atFuRh5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2ae7391d9c9d1de7a2edfa8ad0d7dc4d
Files
-
2ae7391d9c9d1de7a2edfa8ad0d7dc4d.exe windows:5 windows x86 arch:x86
f7e01bfd325ac0a1a18ea7936ba70137
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegDeleteValueW
gdi32
GetDeviceCaps
DeleteObject
CreateSolidBrush
oleaut32
SysFreeString
SysStringLen
kernel32
GetOEMCP
VirtualAlloc
Sleep
VirtualFree
FindResourceW
UnmapViewOfFile
CreateProcessA
SizeofResource
InterlockedExchange
GetModuleHandleW
GetACP
lstrcpynA
CloseHandle
ReadFile
GetModuleHandleA
TlsFree
MapViewOfFile
RaiseException
GetCurrentThread
InterlockedCompareExchange
GetCommandLineA
HeapSize
WideCharToMultiByte
LockResource
GetCurrentProcessId
GetEnvironmentStrings
FileTimeToLocalFileTime
CreateProcessW
lstrlenW
VirtualQuery
GlobalUnlock
GetEnvironmentStringsW
GetThreadLocale
LCMapStringA
GetConsoleCP
GlobalFree
lstrlenA
GetSystemInfo
HeapCreate
LCMapStringW
GetLastError
LeaveCriticalSection
ExitProcess
CreateFileA
TlsSetValue
GetFileType
CreateEventA
CreateFileW
GetTimeZoneInformation
GetProcAddress
WaitForMultipleObjects
FindNextFileA
CreateFileMappingA
CompareStringA
GetDiskFreeSpaceA
FindFirstFileA
lstrcmpA
CompareStringW
GetProcessHeap
GlobalLock
GetEnvironmentVariableA
GetWindowsDirectoryA
DeleteFileA
CreateDirectoryA
GetFileSize
GetStartupInfoA
LoadLibraryA
GetVersionExA
TlsAlloc
GetTickCount
QueryPerformanceCounter
FreeLibrary
LoadLibraryW
SetHandleCount
EnterCriticalSection
HeapFree
WriteConsoleW
InterlockedIncrement
GetCurrentThreadId
GetLocaleInfoA
SetEndOfFile
CreateEventW
GlobalAlloc
GetVersion
WriteConsoleA
TerminateProcess
SetEnvironmentVariableA
SetUnhandledExceptionFilter
CreateThread
SetFilePointer
CreateMutexA
GetLocalTime
MultiByteToWideChar
UnhandledExceptionFilter
GetModuleFileNameA
FlushFileBuffers
HeapAlloc
IsDebuggerPresent
VirtualProtect
GetModuleFileNameW
TlsGetValue
SetLastError
FormatMessageA
InterlockedDecrement
FindClose
LoadResource
InitializeCriticalSection
FormatMessageW
LocalFree
SetEvent
GetStringTypeW
HeapReAlloc
GetExitCodeProcess
GetSystemTimeAsFileTime
WriteFile
GetStringTypeA
lstrcmpiA
GetCPInfo
GetTempPathA
SetStdHandle
FreeEnvironmentStringsW
SetErrorMode
LocalAlloc
GetConsoleMode
GetCurrentDirectoryA
GetCurrentProcess
DeleteCriticalSection
FreeEnvironmentStringsA
GetFileAttributesW
HeapDestroy
FindFirstFileW
WaitForSingleObject
GetFileAttributesA
FileTimeToSystemTime
ReleaseMutex
GetConsoleOutputCP
GetStdHandle
RtlUnwind
user32
ReleaseDC
CallWindowProcA
InvalidateRect
SystemParametersInfoA
MessageBoxA
GetDesktopWindow
LoadIconA
LoadCursorA
ScreenToClient
GetDlgItem
SetTimer
SetWindowTextA
ReleaseCapture
SetCapture
GetWindowRect
GetSystemMetrics
DefWindowProcA
BeginPaint
CreateWindowExA
GetWindowLongA
LoadStringA
IsWindowEnabled
TranslateMessage
PeekMessageA
EnableWindow
ShowWindow
UpdateWindow
GetParent
DestroyWindow
GetKeyState
ClientToScreen
GetClientRect
SendMessageA
GetCursorPos
GetDC
EndPaint
IsWindow
SetWindowPos
LoadBitmapA
PostQuitMessage
SetForegroundWindow
Sections
.text Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 567KB - Virtual size: 566KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ