Static task
static1
Behavioral task
behavioral1
Sample
4726ab4ca93a59053f2c37177f4c4cb6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4726ab4ca93a59053f2c37177f4c4cb6.exe
Resource
win10v2004-20231215-en
General
-
Target
4726ab4ca93a59053f2c37177f4c4cb6
-
Size
403KB
-
MD5
4726ab4ca93a59053f2c37177f4c4cb6
-
SHA1
1c096cb1da368af6b04f958a76a9f2806100b8c2
-
SHA256
aacb7edcf076f93f501754c934f7d9a99e35e140af9348ff568631afdce29eac
-
SHA512
6353c279e69d0b27681b358f412290d7037c842934844995ce26e540348ed73ac77834ddbdf12114fd7be2fcecc70d299b3bb85c6adcdf6b3c9b536efc2cce51
-
SSDEEP
12288:yRDoEberodJqfDFaW9DlGIWYmsZNpvEMNSLupL+wkvj:9pkIWENIi9sj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4726ab4ca93a59053f2c37177f4c4cb6
Files
-
4726ab4ca93a59053f2c37177f4c4cb6.exe windows:4 windows x86 arch:x86
31130332537cdec1bdb911f6a6e6ba7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
HttpEndRequestW
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestA
RegisterUrlCacheNotification
InternetSetDialStateA
InternetAlgIdToStringW
InternetSetOptionA
InternetOpenA
FtpPutFileA
CreateUrlCacheGroup
InternetConfirmZoneCrossing
FtpCommandW
HttpAddRequestHeadersW
FtpRenameFileW
CommitUrlCacheEntryW
InternetSetFilePointer
InternetConfirmZoneCrossingW
RetrieveUrlCacheEntryStreamA
UnlockUrlCacheEntryFileW
InternetGetCertByURL
InternetCrackUrlW
InternetConfirmZoneCrossingA
gdi32
GetObjectA
CreateBitmap
GetCharWidthA
PolylineTo
SetBkMode
ScaleViewportExtEx
SetPixel
GetEnhMetaFileDescriptionA
ResizePalette
EnumObjects
GetSystemPaletteEntries
ExtEscape
GetPath
SetMiterLimit
GetEnhMetaFilePaletteEntries
EndPage
CopyEnhMetaFileA
ExtTextOutW
CancelDC
user32
ExitWindowsEx
ScrollWindowEx
CheckMenuRadioItem
GetComboBoxInfo
GetMessageW
LoadBitmapW
CharUpperBuffW
OpenDesktopA
MenuItemFromPoint
SetKeyboardState
LoadMenuIndirectA
CheckDlgButton
CreatePopupMenu
BlockInput
CharUpperBuffA
AppendMenuW
CharToOemBuffW
advapi32
RegReplaceKeyW
RegDeleteKeyW
RegConnectRegistryW
LookupSecurityDescriptorPartsA
InitiateSystemShutdownA
RegQueryValueExW
InitiateSystemShutdownW
CryptEnumProvidersA
RegQueryMultipleValuesA
RegSetValueA
RegEnumValueW
CryptVerifySignatureA
CryptReleaseContext
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyA
StartServiceW
CryptGetDefaultProviderA
CryptDeriveKey
RegEnumKeyExA
kernel32
TlsSetValue
TerminateProcess
TlsFree
GetCommandLineW
InterlockedExchange
HeapDestroy
WriteConsoleOutputCharacterW
SetHandleCount
IsBadWritePtr
WaitForMultipleObjects
GlobalUnfix
WriteFile
QueryPerformanceCounter
DeleteCriticalSection
GetCurrentThreadId
GetEnvironmentStrings
CreateDirectoryA
FreeEnvironmentStringsA
LeaveCriticalSection
GetEnvironmentStringsW
WaitCommEvent
GetCurrentProcessId
GetModuleFileNameW
InitializeCriticalSection
FreeLibrary
GetCurrentThread
HeapAlloc
FlushConsoleInputBuffer
MultiByteToWideChar
GetFileSize
GetStdHandle
VirtualFree
RtlUnwind
GetStartupInfoA
VirtualAlloc
VirtualQuery
EnterCriticalSection
WriteConsoleOutputAttribute
UnhandledExceptionFilter
EnumSystemCodePagesW
lstrlenW
SetConsoleTitleA
GetEnvironmentVariableA
GetModuleFileNameA
WritePrivateProfileStructW
DeleteFileW
GetStartupInfoW
EnumCalendarInfoExW
GetCurrentProcess
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleA
SetLastError
TlsAlloc
FindResourceExW
TlsGetValue
HeapCreate
lstrcpyA
GetFileType
HeapFree
HeapReAlloc
FormatMessageW
FreeEnvironmentStringsW
LoadLibraryA
GetLastError
EnumCalendarInfoExA
GetVolumeInformationA
GetProcAddress
TransactNamedPipe
ExitProcess
GetVersion
GetCommandLineA
Sections
.text Size: 121KB - Virtual size: 121KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 270KB - Virtual size: 288KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ