Static task
static1
Behavioral task
behavioral1
Sample
settings.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
settings.exe
Resource
win10v2004-20231215-en
General
-
Target
settings.exe
-
Size
356KB
-
MD5
8bf26f7ff128fb6dbe0ed15bdfab6dbb
-
SHA1
6b97e5793a56f4ba0ad8f4587f3470e95b8f490d
-
SHA256
a75a9199141ab7fc6075c21fc1b9468b04c1c1e35ae860438ce3e718b6b154e8
-
SHA512
80fdd0b51e05498e5aaa3ef3b2c6d4a4c77abc03260720b7c546bcf99134514647e3f4ffca790373a785edceae10e46ec7f8ac1e7e00335405f07b04fbacec4b
-
SSDEEP
3072:ii573DeqHephKdpfIyyf3KXjXB4sGh9uoooooook:iiFiphKGeLB4t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource settings.exe
Files
-
settings.exe.exe windows:4 windows x86 arch:x86
Password: ryuugames.com
274d3419f1877a105dd9f46638e0ac76
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
CreateDirectoryA
GetVersionExA
ExitProcess
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
GetCPInfo
GetACP
GetOEMCP
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
RtlUnwind
InterlockedDecrement
InterlockedIncrement
WriteFile
ReadFile
CreateMutexA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetFilePointer
CreateFileA
SetStdHandle
FlushFileBuffers
GetProcAddress
LoadLibraryA
SetEndOfFile
CloseHandle
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSection
UnhandledExceptionFilter
GetLastError
user32
DialogBoxParamA
SetFocus
IsDlgButtonChecked
GetDlgItem
EndDialog
CheckRadioButton
MessageBoxA
CheckDlgButton
shell32
SHGetSpecialFolderPathA
comctl32
ord17
Sections
.text Size: 40KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 4KB - Virtual size: 440B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 288KB - Virtual size: 284KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ