Static task
static1
Behavioral task
behavioral1
Sample
976097aab2f645fe2bf477d1934e6ba34be4a86472d502514f6c07e4948c42b3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
976097aab2f645fe2bf477d1934e6ba34be4a86472d502514f6c07e4948c42b3.exe
Resource
win10v2004-20231222-en
General
-
Target
976097aab2f645fe2bf477d1934e6ba34be4a86472d502514f6c07e4948c42b3
-
Size
7.8MB
-
MD5
729b76c1d11b83b811d7196b8176e95b
-
SHA1
1e88c6963dca5b2beb36b0b1faec50f9792c4d9f
-
SHA256
976097aab2f645fe2bf477d1934e6ba34be4a86472d502514f6c07e4948c42b3
-
SHA512
1ba98dfe1e5f3397306b2d023f375b1709549f60bc6c5f354715ad2a8ab18d75781158526d163c01aba942be0fd8fdf2844ca4cad1363d6854aafba548bdf33e
-
SSDEEP
98304:aBt1fFq9u8JuxyD6jH2cfmI67Z8Q2cx3KvvZ:4t1fFq9u8JuZHVd67iQVa5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 976097aab2f645fe2bf477d1934e6ba34be4a86472d502514f6c07e4948c42b3
Files
-
976097aab2f645fe2bf477d1934e6ba34be4a86472d502514f6c07e4948c42b3.exe windows:6 windows x64 arch:x64
75b1661a4bd551a580a76729e3a1bd07
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcess
CreateEventA
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetCurrentThreadId
LoadResource
LockResource
SizeofResource
SetDefaultDllDirectories
FindResourceW
GlobalAlloc
GlobalLock
GlobalFree
SetDllDirectoryW
GetLocaleInfoW
HeapDestroy
SetLastError
GetLastError
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
CompareFileTime
GetSystemTimeAsFileTime
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
FormatMessageW
VerSetConditionMask
VerifyVersionInfoA
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
WriteFile
GetModuleHandleW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
SetUnhandledExceptionFilter
SystemTimeToFileTime
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetGeoInfoW
GetUserGeoID
GetSystemDefaultUILanguage
GetLocaleInfoEx
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
DeleteFileW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetLongPathNameW
GetTempFileNameW
SetFilePointer
GetTempPathW
IsWow64Process
CopyFileW
MoveFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LoadLibraryExW
EnumResourceNamesW
GetUserDefaultUILanguage
OutputDebugStringW
GetCurrentThread
GetModuleFileNameW
ResetEvent
GetThreadLocale
SetThreadLocale
GetFileAttributesW
GetFileSizeEx
FreeResource
ReleaseMutex
WaitForSingleObject
CreateMutexA
GlobalReAlloc
GlobalSize
GlobalUnlock
MulDiv
FindResourceExW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
OpenEventW
OpenProcess
LocalAlloc
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DosDateTimeToFileTime
CompareStringW
GetVolumeInformationW
GetSystemDirectoryW
GetComputerNameW
GetFileSize
InitializeCriticalSection
TryEnterCriticalSection
VerifyVersionInfoW
ProcessIdToSessionId
GetVersionExW
GetCurrentPackageFamilyName
CreateThread
SetThreadPriority
GetThreadPriority
TerminateThread
GetExitCodeThread
FreeConsole
AttachConsole
GetConsoleDisplayMode
FindResourceA
GetLocaleInfoA
CreateDirectoryA
IsDebuggerPresent
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
GetStringTypeW
CreateEventW
SwitchToThread
GetCPInfo
LCMapStringW
ReleaseSemaphore
WaitForMultipleObjectsEx
OpenEventA
SetWaitableTimer
ResumeThread
GetLogicalProcessorInformation
CreateWaitableTimerA
FormatMessageA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetStringTypeExW
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetDriveTypeW
ExitThread
FreeLibraryAndExitThread
SetFilePointerEx
SetConsoleCtrlHandler
GetConsoleCP
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
SetEndOfFile
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFullPathNameW
SetFileAttributesW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
WriteConsoleW
RaiseException
CloseHandle
DecodePointer
CreateFileW
RtlUnwind
AreFileApisANSI
HeapCreate
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
GetCurrentProcessId
CreateFileA
DeleteFileA
HeapCompact
UnlockFile
LockFileEx
MapViewOfFile
LocalFree
CreateFileMappingW
GetSystemTime
CreateDirectoryW
gdiplus
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipDeleteGraphics
GdipSetCompositingMode
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdiplusShutdown
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipFree
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipDrawImageRectRectI
GdipAlloc
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipSetClipRectI
GdipDrawImageRectRect
GdipDrawImage
GdipFillPath
GdipFillEllipse
GdipFillRectangle
GdipGraphicsClear
GdipDrawRectangle
GdipDrawLines
GdipDrawLine
GdipSetTextRenderingHint
GdipSetCompositingQuality
GdipCreateFromHWNDICM
GdipCreateFromHWND
GdipCreateFromHDC
GdipFlush
GdipSetImageAttributesColorMatrix
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
GdipAddPathLine
GdipClosePathFigures
GdipDeletePath
GdipCreatePath
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipBitmapSetPixel
GdipBitmapGetPixel
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromHICON
GdipSetImageAttributesWrapMode
GdiplusStartup
comctl32
ImageList_Create
ImageList_Destroy
ord413
ord410
ImageList_ReplaceIcon
wldap32
ord33
ord32
ord60
ord46
ord211
ord26
ord27
ord22
ord301
ord200
ord30
ord41
ord50
ord79
ord143
ord35
ord45
ord217
normaliz
IdnToUnicode
IdnToAscii
dbghelp
MiniDumpWriteDump
gdi32
CreateCompatibleDC
CreateDIBSection
GetDIBits
CreateCompatibleBitmap
GetObjectW
GetTextExtentPoint32W
TextOutW
GetTextMetricsW
LPtoDP
SetTextColor
SetMapMode
CreateSolidBrush
CreateBitmap
SetBkMode
DeleteDC
SetBkColor
SelectObject
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
CreateFontW
CreateFontIndirectW
advapi32
SetSecurityInfo
CryptGetHashParam
CryptHashData
OpenProcessToken
RegOpenKeyExW
RegDeleteTreeW
RegQueryValueExW
RegEnumValueW
RegCreateKeyExW
RegEnumKeyExW
OpenThreadToken
RegOpenKeyW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
ConvertStringSidToSidW
AddAccessAllowedAceEx
AddAce
DuplicateTokenEx
GetAce
GetAclInformation
GetLengthSid
GetSecurityDescriptorSacl
GetTokenInformation
InitializeAcl
GetUserNameW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityInfo
RegCopyTreeW
LookupAccountNameW
RegDeleteValueW
RegSetValueExW
RegQueryInfoKeyW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
RegFlushKey
GetSidSubAuthority
RegCloseKey
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
shell32
SHGetPropertyStoreForWindow
ShellExecuteW
SHFileOperationW
SHGetFileInfoW
SHQueryUserNotificationState
SHBindToParent
SHAppBarMessage
SHEvaluateSystemCommandTemplate
ShellExecuteExW
CommandLineToArgvW
SHGetSettings
SHGetDesktopFolder
SHGetKnownFolderPath
SHGetFolderPathW
SHCreateDirectoryExW
SHGetMalloc
ole32
CoUninitialize
StringFromGUID2
PropVariantClear
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoSetProxyBlanket
CoInitializeEx
CoInitializeSecurity
oleaut32
SysAllocStringLen
SysAllocString
VariantClear
CreateErrorInfo
SetErrorInfo
VariantChangeType
GetErrorInfo
SysStringLen
VariantCopy
VariantInit
SysFreeString
bcrypt
BCryptGenRandom
msi
ord173
ord217
rpcrt4
UuidCreateSequential
RpcStringFreeW
UuidToStringW
wininet
InternetQueryOptionW
DeleteUrlCacheEntryW
winhttp
WinHttpGetProxyForUrl
WinHttpOpen
WinHttpCloseHandle
crypt32
CertOpenSystemStoreA
CertFreeCertificateContext
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
userenv
GetUserProfileDirectoryW
ExpandEnvironmentStringsForUserW
shlwapi
SHRegDuplicateHKey
PathFileExistsW
AssocQueryStringW
StrChrIW
ord487
StrRetToBufW
PathGetArgsW
ord176
version
VerQueryValueW
ws2_32
ntohl
gethostbyname
getnameinfo
sendto
recvfrom
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
shutdown
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
gethostname
ntohs
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
WTSQueryUserToken
secur32
GetUserNameExW
comdlg32
GetSaveFileNameW
Sections
.text Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 55KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 291KB - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 197KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 600KB - Virtual size: 604KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE