Static task
static1
Behavioral task
behavioral1
Sample
425deb4e56fbad4335df2e96945c6439.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
425deb4e56fbad4335df2e96945c6439.exe
Resource
win10v2004-20231215-en
General
-
Target
425deb4e56fbad4335df2e96945c6439
-
Size
429KB
-
MD5
425deb4e56fbad4335df2e96945c6439
-
SHA1
af650542fd0ff5cfd62208bd3a44836a38348bf4
-
SHA256
f20b4e40183e43cd994773148aa28ff3812913894dd6d0df2e740c040e6d4bad
-
SHA512
42552f2be532b4899cd061748bf63ac7e6c9cd3c074e75c227d45ec06dcf270968a0e907797e3c3a0ecb28e421d2d3461b8b1434ff2d5f26ba1cc08ff542fea7
-
SSDEEP
6144:2D2ImopGU36ivi+0ad23bFqXP0nRwDNFlVEyKODLLLt4Wb52mOZ0VX6qOf7H5k:qplZfK+0a0G0YFlVaE/B4Wbbqx7K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 425deb4e56fbad4335df2e96945c6439
Files
-
425deb4e56fbad4335df2e96945c6439.exe windows:4 windows x86 arch:x86
a9434ab060e0d6ee6826ed5cb65ffe93
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
LoadAlterBitmap
PageSetupDlgW
ChooseFontA
PrintDlgW
ChooseFontW
GetOpenFileNameA
ChooseColorA
ReplaceTextW
GetOpenFileNameW
PageSetupDlgA
ReplaceTextA
GetFileTitleW
GetSaveFileNameW
FindTextW
ChooseColorW
wininet
HttpSendRequestExW
InternetSetFilePointer
InternetConnectA
DeleteUrlCacheEntryW
InternetUnlockRequestFile
GopherFindFirstFileW
FtpPutFileW
RetrieveUrlCacheEntryStreamA
gdi32
CancelDC
SelectClipRgn
AnimatePalette
SetGraphicsMode
GetNearestPaletteIndex
gdiPlaySpoolStream
CreateDiscardableBitmap
FloodFill
GdiPlayScript
GetTextExtentPoint32W
GetSystemPaletteUse
EndDoc
CreateScalableFontResourceW
PolylineTo
EnumEnhMetaFile
CloseEnhMetaFile
Escape
FillRgn
SetWorldTransform
SetWinMetaFileBits
GetDIBColorTable
shell32
ShellExecuteExW
SHFileOperationA
SHBrowseForFolderA
SHGetPathFromIDList
RealShellExecuteA
SHFileOperation
SHBrowseForFolderW
ShellExecuteW
SHGetDataFromIDListW
ShellHookProc
DragFinish
SheGetDirA
DragQueryPoint
SHGetDataFromIDListA
SHInvokePrinterCommandW
kernel32
HeapDestroy
SetUnhandledExceptionFilter
GetLocaleInfoA
SetLastError
GetCurrencyFormatW
SetConsoleCtrlHandler
GetTimeZoneInformation
GetModuleHandleA
GetCurrentThreadId
GetCommandLineW
GetCurrentProcessId
GetNamedPipeInfo
GetVersionExA
IsValidLocale
FreeEnvironmentStringsW
GetCommandLineA
SetEnvironmentVariableA
GetProcAddress
UnhandledExceptionFilter
GetCurrentProcess
GetStartupInfoA
GetLocaleInfoW
Sleep
CreateFileA
FreeEnvironmentStringsA
GetUserDefaultLCID
DeleteCriticalSection
GetStringTypeA
TerminateProcess
GetStartupInfoW
SetLocalTime
WideCharToMultiByte
GetSystemTimeAsFileTime
InitializeCriticalSection
GetTickCount
EnumSystemLocalesA
GetLastError
VirtualLock
GetSystemDefaultLCID
WriteConsoleOutputCharacterA
GetStringTypeW
GetUserDefaultLangID
HeapReAlloc
MultiByteToWideChar
GetEnvironmentStringsW
TlsFree
FreeLibrary
IsValidCodePage
GetSystemDefaultLangID
MoveFileW
LoadLibraryA
TlsAlloc
LeaveCriticalSection
GetDateFormatA
GetCurrentThread
SetHandleCount
GetPrivateProfileStructA
GetProcessHeap
WriteFile
TlsGetValue
SetLocaleInfoW
OutputDebugStringW
CompareStringW
ExitProcess
GetStdHandle
GetTimeFormatA
VirtualFree
HeapAlloc
TransactNamedPipe
VirtualAlloc
InterlockedExchange
HeapFree
GetModuleFileNameW
GlobalHandle
GetFileType
GetModuleFileNameA
RtlUnwind
LCMapStringW
CompareStringA
LCMapStringA
HeapSize
InterlockedIncrement
TlsSetValue
HeapCreate
IsDebuggerPresent
QueryPerformanceCounter
GetEnvironmentStrings
GetCPInfo
EnterCriticalSection
GetACP
VirtualQuery
InterlockedDecrement
GetOEMCP
Sections
.text Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 277KB - Virtual size: 277KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ