Static task
static1
Behavioral task
behavioral1
Sample
41e9236423051a502ca6d07a2cc97294.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
41e9236423051a502ca6d07a2cc97294.exe
Resource
win10v2004-20231222-en
General
-
Target
41e9236423051a502ca6d07a2cc97294
-
Size
329KB
-
MD5
41e9236423051a502ca6d07a2cc97294
-
SHA1
b609ad3a003258980c05b7380fa05261ad52fea8
-
SHA256
cabd1b41f9afc959f7e83c507748669adcb53142f569a9e9d10463ba7b74223f
-
SHA512
852c9e9c34bd14000bbb5327b1bf81b221f9d1db07dd7ddaaff31bb50bf4dba95238c8b8d2e4b0652d569e55c6d9258f7994cef6c2cec5baa22774622de485d8
-
SSDEEP
6144:fdhkwtWHIYMkdAHzilp/soiT/yiGnPE9JTAfM0r/24DojEcuIKYF+CQ6T:fdC3HIYMkdAilVqTQPEfkM0r/RDMdugd
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41e9236423051a502ca6d07a2cc97294
Files
-
41e9236423051a502ca6d07a2cc97294.exe windows:5 windows x86 arch:x86
1d79f2ef01b0b57331551411c0eb26e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
wcstol
_CIcos
qsort
_CIexp
_unlock
atoi
_resetstkoflw
wcsstr
_CIcosh
_adjust_fdiv
_onexit
_wcsicmp
_stricmp
_initterm
_CIatan2
_controlfp
__dllonexit
_lock
calloc
_CIsin
isxdigit
_CIsinh
realloc
_CIlog
memset
_clearfp
_CIacos
floor
_wtof
memmove
_isnan
strchr
_CItan
atof
isdigit
_CIpow
ceil
setlocale
_strdup
tolower
_CItanh
isspace
malloc
_amsg_exit
_copysign
toupper
isalnum
memcpy
wcschr
_CIatan
_CIasin
isalpha
_CIfmod
_fpclass
free
_errno
_purecall
_vsnprintf
_finite
_XcptFilter
modf
_wtoi
_vsnwprintf
_CIsqrt
clock
ole32
CoTaskMemAlloc
CoInitialize
CoCreateInstance
PropVariantCopy
PropVariantClear
CoTaskMemFree
CoUninitialize
ntdll
RtlEnumerateGenericTableWithoutSplaying
RtlInterlockedFlushSList
RtlNumberGenericTableElements
NtCreateSection
RtlInitializeGenericTable
RtlInsertElementGenericTable
DbgPrompt
RtlIsGenericTableEmpty
RtlInitializeBitMap
RtlFindClearBitsAndSet
NtUnmapViewOfSection
DbgPrintEx
DbgBreakPoint
NtAddAtom
RtlUlongByteSwap
NtMapViewOfSection
NtAllocateVirtualMemory
RtlSetBits
NtQuerySystemInformation
psapi
GetProcessMemoryInfo
gdi32
DeleteObject
SelectObject
GetRgnBox
CreateDIBSection
RectInRegion
SetLayout
GetDIBits
RealizePalette
BitBlt
DrawEscape
DeleteDC
CreateCompatibleDC
CreateRectRgnIndirect
GdiEntry13
GetDeviceCaps
CreatePalette
CreateICW
GetSystemPaletteEntries
SelectPalette
CreateDCW
GetDCOrgEx
CombineRgn
CreateCompatibleBitmap
OffsetRgn
GetRegionData
user32
RegisterWindowMessageW
GetWindowDC
InvalidateRect
SetRect
GetClientRect
SystemParametersInfoW
MsgWaitForMultipleObjects
TranslateMessage
UpdateLayeredWindow
PeekMessageW
EnumDisplaySettingsW
IsRectEmpty
GetMonitorInfoW
EnumDisplayMonitors
IsWindow
EnumDisplayDevicesW
GetDesktopWindow
DispatchMessageW
ReleaseDC
GetGuiResources
CopyRect
GetWindowLongW
PostMessageW
OffsetRect
SetLayeredWindowAttributes
ClientToScreen
EqualRect
IntersectRect
GetDC
advapi32
GetTraceEnableFlags
RegCloseKey
TraceEvent
TraceMessage
RegQueryValueExA
RegOpenKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
RegQueryValueExW
RegOpenKeyA
RegisterTraceGuidsW
kernel32
ResetEvent
Sleep
GetSystemDirectoryW
GetSystemTimeAsFileTime
WaitForSingleObject
VirtualQuery
CreateWaitableTimerW
CreateFileMappingW
CancelIo
FindFirstFileW
IsDebuggerPresent
LockResource
HeapReAlloc
GetLastError
GetProcessId
GetProcessHeap
OutputDebugStringW
GetVersion
LocalFree
HeapFree
InterlockedIncrement
GetProcAddress
InterlockedExchange
GlobalUnlock
DebugBreak
WriteFile
SetEvent
RtlCaptureStackBackTrace
GetVersionExA
DisableThreadLibraryCalls
GetSystemInfo
GetCurrentProcessId
CreateFileMappingA
FindClose
RtlUnwind
CreateFileW
InterlockedPushEntrySList
SystemTimeToFileTime
VirtualLock
TerminateThread
RaiseException
WaitForMultipleObjects
SetProcessWorkingSetSize
HeapAlloc
GetTickCount
GetProcessWorkingSetSize
MapViewOfFile
VirtualAlloc
SleepEx
TerminateProcess
GetModuleHandleW
SizeofResource
DeleteCriticalSection
PulseEvent
GetModuleHandleA
LoadLibraryA
CreateEventW
InitializeSListHead
CloseHandle
LoadResource
CreateThread
InterlockedCompareExchange
EnterCriticalSection
WideCharToMultiByte
VirtualFree
OutputDebugStringA
SetUnhandledExceptionFilter
InterlockedFlushSList
InterlockedDecrement
UnmapViewOfFile
LeaveCriticalSection
SetWaitableTimer
LoadLibraryW
GetFullPathNameA
GetFileSize
ExitProcess
UnhandledExceptionFilter
QueryPerformanceFrequency
WaitForSingleObjectEx
GetOverlappedResult
CompareStringW
SetLastError
GetVersionExW
FindResourceW
QueryPerformanceCounter
InterlockedExchangeAdd
lstrcmpiA
SetThreadPriority
InitializeCriticalSection
MulDiv
QueryDepthSList
DelayLoadFailureHook
GetCurrentThreadId
TryEnterCriticalSection
DuplicateHandle
ReadFile
IsProcessorFeaturePresent
GetCurrentThread
FreeLibrary
GetCurrentProcess
CreateFileA
InitializeCriticalSectionAndSpinCount
ProcessIdToSessionId
LocalAlloc
rpcrt4
RpcStringBindingComposeW
RpcSsDestroyClientContext
RpcAsyncCompleteCall
RpcServerInqBindings
UuidToStringW
UuidCreate
I_RpcExceptionFilter
RpcAsyncCancelCall
RpcServerRegisterIfEx
RpcEpRegisterW
RpcBindingSetAuthInfoExW
NdrAsyncClientCall
RpcBindingFree
RpcStringFreeW
NdrAsyncServerCall
RpcAsyncGetCallStatus
RpcServerInqCallAttributesW
RpcServerUnregisterIfEx
RpcAsyncInitializeHandle
RpcBindingVectorFree
RpcServerUseProtseqW
RpcBindingFromStringBindingW
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 248KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE