?WIBLiyhpl_JEoxoskM@@YGGGH@Z
Static task
static1
Behavioral task
behavioral1
Sample
489a9acbbdaac7c39af4ea99f19152e5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
489a9acbbdaac7c39af4ea99f19152e5.exe
Resource
win10v2004-20231222-en
General
-
Target
489a9acbbdaac7c39af4ea99f19152e5
-
Size
138KB
-
MD5
489a9acbbdaac7c39af4ea99f19152e5
-
SHA1
80a9479b5f1c966e625442884779a4a54b69d075
-
SHA256
d84e4899b80da7e70fd68cc898874b5a61fd51ad4f1169ef60cdd0089bddd4e1
-
SHA512
b407256f6623e44fab329f2f2e6a767663666d7400a3adbbaa925263a93c54343ca1134ac0258fad5cb7e895b2df6bb9362cf73a06b96478413a57287066b341
-
SSDEEP
3072:V9kx7xWEd5JPjgfPUH0/UVTgSDZ5TCQ3lH9P6bef:V9kx7MEd7g0H0/UZgSd5TBVH9Sbe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 489a9acbbdaac7c39af4ea99f19152e5
Files
-
489a9acbbdaac7c39af4ea99f19152e5.exe windows:5 windows x86 arch:x86
c44696775a6d3d5dfd20e1f5b09e0eaf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
memset
user32
FrameRect
CharPrevW
LoadAcceleratorsW
GetMenuItemID
DefFrameProcA
LoadStringA
GetWindowRect
GetMenuItemCount
TrackPopupMenuEx
DispatchMessageA
IntersectRect
GetDoubleClickTime
GetIconInfo
GetClassLongA
CreateWindowExA
CharPrevA
GetMonitorInfoW
IsDialogMessageA
TranslateAcceleratorA
DrawEdge
CallWindowProcW
GetDlgItemTextW
CreateDialogIndirectParamW
FindWindowA
GetMessageW
SetScrollPos
DispatchMessageW
CharLowerA
RemovePropW
LoadImageA
shlwapi
PathRelativePathToA
UrlGetPartA
gdi32
GetBitmapBits
SaveDC
CreateDIBSection
SetBrushOrgEx
UnrealizeObject
GetTextColor
GetDIBColorTable
Escape
SetDIBColorTable
SetDIBitsToDevice
GetRgnBox
ScaleWindowExtEx
comctl32
ImageList_Read
CreatePropertySheetPageW
InitCommonControlsEx
msvcrt
exit
kernel32
DeleteFileW
GetModuleHandleA
EnterCriticalSection
GetCurrentThreadId
SetHandleCount
SetLocalTime
lstrcmpA
GetModuleFileNameA
lstrcpynW
lstrcmpW
WaitForSingleObject
GetStringTypeExW
EscapeCommFunction
GetCommConfig
FindFirstChangeNotificationW
GetSystemWindowsDirectoryW
lstrlenA
comdlg32
FindTextW
GetSaveFileNameW
ReplaceTextW
PageSetupDlgW
Exports
Exports
Sections
.text Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 146B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.$debug Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data1 Size: 512B - Virtual size: 132B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data2 Size: 512B - Virtual size: 401B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data3 Size: 512B - Virtual size: 403B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data4 Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ