Static task
static1
Behavioral task
behavioral1
Sample
3a646af1ae9e8b3d086ebb9789c536dd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3a646af1ae9e8b3d086ebb9789c536dd.exe
Resource
win10v2004-20231215-en
General
-
Target
3a646af1ae9e8b3d086ebb9789c536dd
-
Size
600KB
-
MD5
3a646af1ae9e8b3d086ebb9789c536dd
-
SHA1
d2aba42c0f85d70ad4626baee883ec35ec4b734b
-
SHA256
e5be50d338d2f0288ba34a05f4887caa93ae5ae0c1f5f12fed776280990b8f7a
-
SHA512
6df54133c18765346cb08d46cf1e2d1bfbd2487918d921a092428d6410b726eb0910815b4b52d56f6b2e04a2e42223cd4d2bea9083125f8c8a7ccaec21f81841
-
SSDEEP
12288:JKKWDGnObGMtf4PuQvQ8HUIQQ0128nvk2LA:JLnwGsf4GQXHUHQ0E8nvk2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a646af1ae9e8b3d086ebb9789c536dd
Files
-
3a646af1ae9e8b3d086ebb9789c536dd.exe windows:4 windows x86 arch:x86
2dae9525bc133eacb0b46f08ec15eabc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32
SetPixel
SetDeviceGammaRamp
GetBitmapDimensionEx
SetViewportExtEx
user32
GetThreadDesktop
VkKeyScanW
InvertRect
SystemParametersInfoA
GetWindow
IsWindowEnabled
PostQuitMessage
CheckDlgButton
LoadImageA
FindWindowA
RegisterClassA
LoadMenuA
GetDC
RegisterClassExA
GetDCEx
WindowFromPoint
kernel32
GetCurrencyFormatA
CreateMutexA
VirtualAlloc
HeapFree
SetLocalTime
LoadLibraryA
TlsGetValue
GetDateFormatA
GetLocaleInfoA
GetCurrentProcess
FreeEnvironmentStringsA
SystemTimeToFileTime
LoadModule
FindNextFileW
MultiByteToWideChar
GetFileAttributesExW
CloseHandle
SetHandleCount
UnhandledExceptionFilter
SetVolumeLabelW
GetLocaleInfoW
LCMapStringA
LCMapStringW
GetCPInfo
GetCurrentThreadId
WriteConsoleW
QueryPerformanceCounter
CreateDirectoryW
VirtualProtect
VirtualFree
GetFileType
TlsFree
GetSystemDefaultLCID
GetProcAddress
GetUserDefaultLCID
GetOEMCP
EnterCriticalSection
SetStdHandle
CreateEventA
GetCompressedFileSizeW
CreateToolhelp32Snapshot
GetTimeZoneInformation
CompareStringA
TlsAlloc
OpenMutexA
GetStartupInfoW
OpenProcess
InterlockedDecrement
GetConsoleCP
CreateFileA
MoveFileW
SetConsoleTextAttribute
GetStringTypeExW
GetSystemTimeAsFileTime
GetStringTypeA
GetFileSize
CreateWaitableTimerW
SetConsoleTitleA
RtlUnwind
GetACP
IsValidCodePage
LocalReAlloc
GetEnvironmentStringsW
InitializeCriticalSection
FillConsoleOutputCharacterW
VirtualQuery
HeapDestroy
SetConsoleCtrlHandler
WriteConsoleA
GetPrivateProfileStructW
OutputDebugStringA
TerminateProcess
GetSystemDirectoryA
InterlockedExchange
EnumSystemLocalesA
GetModuleFileNameA
SetEnvironmentVariableA
ExitProcess
VirtualQueryEx
GetEnvironmentStrings
GetConsoleMode
FreeEnvironmentStringsW
FreeLibrary
GetVersionExA
WriteFile
HeapAlloc
GetStdHandle
ReadFile
FlushFileBuffers
HeapCreate
InterlockedIncrement
GetModuleFileNameW
GetStartupInfoA
GlobalGetAtomNameA
GetCurrentThread
GetLastError
CompareStringW
GetCommandLineA
CreateDirectoryExW
IsValidLocale
SetUnhandledExceptionFilter
SetLastError
CopyFileExA
TlsSetValue
LockResource
GetConsoleOutputCP
FormatMessageA
EnumCalendarInfoW
GetProfileIntA
HeapReAlloc
IsDebuggerPresent
LeaveCriticalSection
SetCurrentDirectoryW
Sleep
GetCurrentDirectoryW
GetTickCount
GetCurrentProcessId
CompareFileTime
TerminateThread
GetStringTypeW
SetFilePointer
HeapSize
GetSystemTimeAdjustment
GetTimeFormatA
GetModuleHandleA
lstrcat
SetFileAttributesW
GetCommandLineW
CreateProcessA
WideCharToMultiByte
DeleteCriticalSection
GetProcessHeap
FlushViewOfFile
comctl32
ImageList_EndDrag
DrawStatusTextA
GetEffectiveClientRect
CreateUpDownControl
ImageList_DragMove
InitMUILanguage
ImageList_GetImageInfo
DestroyPropertySheetPage
ImageList_Replace
ImageList_GetIcon
ImageList_GetImageCount
ImageList_SetFlags
ImageList_Merge
CreateMappedBitmap
ImageList_Add
ImageList_DragEnter
InitCommonControlsEx
ImageList_Remove
CreatePropertySheetPageW
advapi32
RegSetValueExA
RegQueryValueExA
RegReplaceKeyA
CryptSetProviderExA
CryptEnumProvidersW
RegReplaceKeyW
RegCreateKeyW
RegSetValueW
RegOpenKeyExW
CryptHashData
Sections
.text Size: 180KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 252KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 116KB - Virtual size: 135KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ