Static task
static1
Behavioral task
behavioral1
Sample
49775beab78a48476b2d260abcf2c64f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
49775beab78a48476b2d260abcf2c64f.exe
Resource
win10v2004-20231215-en
General
-
Target
49775beab78a48476b2d260abcf2c64f
-
Size
3.1MB
-
MD5
49775beab78a48476b2d260abcf2c64f
-
SHA1
9b75014690a6bce3ef3a38730ed23019a9f01a1f
-
SHA256
5b78af0ede2e6c95824a34c98c5de055df82e9682a5a651e5cbdb9328c82771d
-
SHA512
f983a4ead453663beb8273033437eaa758135ec009ff12075d25fdeb367515a674eb4456be64b6a11cadd23fcc923eb68ad69a3a2e394e81e71b9ce0e22b3aaf
-
SSDEEP
98304:Rj5XntYxDwxIUOMF59yTjs01oAz516CqsHA:Rj5Xbquqs01ld16
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49775beab78a48476b2d260abcf2c64f
Files
-
49775beab78a48476b2d260abcf2c64f.exe windows:5 windows x86 arch:x86
f5d31b62d72d6957e99d6498931420be
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointer
UnhandledExceptionFilter
QueryDosDeviceW
RemoveDirectoryW
ConnectNamedPipe
GetDriveTypeA
CreateMailslotW
GetSystemDirectoryW
GetProcAddress
LoadLibraryA
FreeLibraryAndExitThread
IsBadReadPtr
UnlockFileEx
GetPrivateProfileStringA
GetVolumeInformationW
GetProcessHeaps
SetCommBreak
BackupSeek
CreateNamedPipeW
GetVersionExW
SetCurrentDirectoryW
GetPrivateProfileStructA
DebugActiveProcessStop
MulDiv
CreateDirectoryA
GetShortPathNameW
DebugSetProcessKillOnExit
ReadFileScatter
GetLastError
InterlockedIncrement
lstrcmpiW
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
FileTimeToSystemTime
GetDiskFreeSpaceA
FindFirstFileA
GetPrivateProfileIntW
GetPriorityClass
WriteProfileSectionW
TlsAlloc
SetCommMask
GetPrivateProfileSectionNamesW
SetDefaultCommConfigA
RequestWakeupLatency
CancelIo
GetProcessPriorityBoost
WriteFileGather
ExitProcess
MoveFileA
DefineDosDeviceA
ExpandEnvironmentStringsA
GetBinaryTypeA
EscapeCommFunction
GetFileAttributesExA
GetFileTime
GetSystemInfo
GetHandleInformation
CreateDirectoryExW
DeleteAtom
SetUnhandledExceptionFilter
SetFileShortNameW
GetDriveTypeW
TransmitCommChar
FileTimeToDosDateTime
SuspendThread
SetDefaultCommConfigW
WritePrivateProfileSectionA
SetComputerNameA
GetCurrentProcessId
SetFirmwareEnvironmentVariableA
GlobalGetAtomNameA
GlobalFindAtomW
DuplicateHandle
SetThreadExecutionState
GlobalAlloc
EnumResourceLanguagesW
IsProcessorFeaturePresent
GlobalAddAtomA
SleepEx
PurgeComm
BuildCommDCBAndTimeoutsW
GetTickCount
GetCurrentProcess
IsBadStringPtrW
GlobalUnWire
LoadModule
SystemTimeToFileTime
GetSystemWindowsDirectoryW
CreateSemaphoreW
SetNamedPipeHandleState
GetFileAttributesW
FindFirstFileW
FileTimeToLocalFileTime
GlobalFindAtomA
CreateFileMappingW
ReleaseSemaphore
FatalAppExitW
MoveFileExW
LoadLibraryW
GetProcessVersion
GlobalSize
EnumResourceLanguagesA
LocalFileTimeToFileTime
GetLocalTime
OpenSemaphoreA
GetProfileStringW
FindResourceExW
EraseTape
GetShortPathNameA
IsBadWritePtr
GetProcessTimes
SetFirmwareEnvironmentVariableW
GetFileSize
GetLogicalDriveStringsW
GetAtomNameA
DefineDosDeviceW
GetEnvironmentStringsW
GetProcessHeap
GetTempFileNameA
GetComputerNameA
GetThreadSelectorEntry
GetComputerNameW
VirtualQuery
FormatMessageW
SetFileAttributesW
GetFileAttributesExW
ResetWriteWatch
CallNamedPipeW
GetCurrentDirectoryW
RemoveDirectoryA
FlushInstructionCache
GetSystemDirectoryA
AddAtomW
OpenMutexW
PostQueuedCompletionStatus
CreateDirectoryExA
WriteFile
SetEndOfFile
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
QueryPerformanceCounter
FreeEnvironmentStringsW
GetEnvironmentStrings
SetLocalTime
SetPriorityClass
GetCurrentThreadId
lstrlenW
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
CloseHandle
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStringTypeA
GetModuleFileNameA
HeapReAlloc
SetFileAttributesA
RaiseException
SearchPathA
EndUpdateResourceW
GetTimeZoneInformation
GetThreadContext
SetComputerNameW
CreateDirectoryW
GetProfileIntW
GetWindowsDirectoryW
GetCommandLineW
BackupWrite
InitAtomTable
SetProcessWorkingSetSize
GetCompressedFileSizeA
CommConfigDialogA
GetStdHandle
GetStartupInfoA
SetStdHandle
SetLastError
OpenProcess
GlobalDeleteAtom
EndUpdateResourceA
GlobalAddAtomW
FindNextFileW
GetEnvironmentVariableW
GetWriteWatch
DeleteFileW
GlobalWire
WriteProfileSectionA
DebugActiveProcess
ExpandEnvironmentStringsW
WideCharToMultiByte
CreateFileW
WritePrivateProfileStringW
SetHandleCount
DosDateTimeToFileTime
PeekNamedPipe
GetFileType
OutputDebugStringW
VerifyVersionInfoW
GlobalGetAtomNameW
TlsFree
SetTimeZoneInformation
GetPrivateProfileSectionW
MapViewOfFileEx
DeviceIoControl
GetPrivateProfileStringW
CreateEventW
GetThreadPriorityBoost
EnumResourceNamesW
CreatePipe
CreateMailslotA
WriteProfileStringW
SetCommTimeouts
SetVolumeLabelW
SetProcessShutdownParameters
GetDefaultCommConfigW
GlobalMemoryStatus
QueryPerformanceFrequency
FreeEnvironmentStringsA
GetAtomNameW
GetSystemWindowsDirectoryA
Beep
SetFileTime
lstrcpynW
InterlockedCompareExchange
InterlockedExchange
Sleep
RtlUnwind
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
TerminateProcess
IsDebuggerPresent
GetCPInfo
GetCommandLineA
LCMapStringA
LCMapStringW
GetStringTypeW
TlsGetValue
TlsSetValue
HeapSize
HeapCreate
VirtualFree
VirtualAlloc
user32
CharLowerW
SetWindowLongW
LoadStringW
DestroyWindow
SendMessageW
GetClassNameA
MessageBoxW
SystemParametersInfoW
SetWindowPos
CharUpperW
CallWindowProcW
CharNextW
GetClassNameW
RealGetWindowClassA
SetWindowTextW
GetWindowRect
ShowWindow
EnumChildWindows
MoveWindow
RealGetWindowClassW
advapi32
RegDeleteValueW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
shell32
ShellExecuteW
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
oleaut32
VarUI4FromStr
comctl32
ord17
Sections
.text Size: 398KB - Virtual size: 398KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 54KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.6MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ