_WinMainSandboxed@20
Static task
static1
Behavioral task
behavioral1
Sample
94c476c859100c491e428677a71d1ad1f07f350061a52e13c00916a6a4ba5784.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
94c476c859100c491e428677a71d1ad1f07f350061a52e13c00916a6a4ba5784.exe
Resource
win10v2004-20231215-en
General
-
Target
94c476c859100c491e428677a71d1ad1f07f350061a52e13c00916a6a4ba5784
-
Size
8.8MB
-
MD5
6fc65eec69269d8ad376b100b4e18ca4
-
SHA1
9a341b072ab1c1940638ae1f271a648d55f53f4c
-
SHA256
94c476c859100c491e428677a71d1ad1f07f350061a52e13c00916a6a4ba5784
-
SHA512
7fc410126fca76e11196308d3e4eb8212f4b573db4f62109399a517b7de88d62c5fb9c74cb19eaabd641ce07ddbaa537d9b041309496077d003c4ddae612c65a
-
SSDEEP
196608:TMOhUEy7hmFKSMYMv2/gkBX143lIUlOLuQMPGnuzSDBduuuuu9+:TthUEy7wF22/gkB8gBMP1zSbuuuuu0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 94c476c859100c491e428677a71d1ad1f07f350061a52e13c00916a6a4ba5784
Files
-
94c476c859100c491e428677a71d1ad1f07f350061a52e13c00916a6a4ba5784.exe windows:5 windows x86 arch:x86
901f487907aea119888450003c24d2ea
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetStartupInfoW
GetCommandLineA
GetCommandLineW
GetSystemDirectoryW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
RemoveDirectoryW
CreateFileA
CreateFileW
GetFileAttributesA
DeleteFileW
FindFirstFileW
CopyFileW
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapSize
HeapLock
HeapUnlock
HeapWalk
DebugBreak
CreateThread
OpenThread
SetThreadPriority
QueueUserAPC
TlsAlloc
TlsFree
SleepEx
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
FreeLibrary
GetProcessTimes
GetCurrentProcess
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
LoadLibraryA
GetModuleHandleExW
SetCurrentDirectoryW
GetCurrentDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
SetUnhandledExceptionFilter
FindNextFileW
GetCPInfo
IsDBCSLeadByte
VerSetConditionMask
LockResource
GlobalFree
ExitThread
LoadResource
CreateProcessA
FindResourceExA
FindResourceExW
GetSystemDirectoryA
GetFileAttributesW
MoveFileExW
GetVersionExW
VerifyVersionInfoW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetLongPathNameW
GetFileInformationByHandle
GetFileSizeEx
DeviceIoControl
SetFilePointerEx
lstrlenW
CreateMutexA
CreateProcessW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
OutputDebugStringA
GetTempPathA
GetTempFileNameA
GetSystemWow64DirectoryW
CreateDirectoryA
GetFullPathNameW
GetFileAttributesExW
LoadLibraryW
GetVolumeInformationW
SetLastError
SetEvent
ResetEvent
WaitForMultipleObjects
GetTickCount
CreateEventW
GetSystemTime
GetTimeZoneInformation
SystemTimeToFileTime
GetCurrentThread
GetExitCodeThread
DuplicateHandle
MapViewOfFile
UnmapViewOfFile
LCMapStringW
GetLocaleInfoW
TerminateThread
CreateWaitableTimerW
ReleaseSemaphore
CreateSemaphoreW
SetThreadAffinityMask
ReleaseMutex
CreateFileMappingA
CompareFileTime
IsDebuggerPresent
OutputDebugStringW
EncodePointer
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
RtlUnwind
LoadLibraryExW
GetStdHandle
GetStringTypeW
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapReAlloc
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
ReadConsoleW
FormatMessageW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
TlsSetValue
TlsGetValue
GetSystemInfo
CloseHandle
FindClose
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
GetFileSize
Sleep
WaitForSingleObject
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetCurrentThreadId
SwitchToThread
RaiseException
GetExitCodeProcess
ExitProcess
GetProcAddress
InterlockedCompareExchange
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
GetVersionExA
GetVersion
VerifyVersionInfoA
GetNumberFormatW
GetCurrencyFormatW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
FreeLibraryAndExitThread
DeleteFileA
DecodePointer
GetProcessAffinityMask
advapi32
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
RegOpenKeyA
Exports
Exports
Sections
.text Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 97KB - Virtual size: 998KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.shockd Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 349KB - Virtual size: 348KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 257KB - Virtual size: 257KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ