Static task
static1
Behavioral task
behavioral1
Sample
4db44be20fd5aee919d32b2d5cd74b08.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4db44be20fd5aee919d32b2d5cd74b08.exe
Resource
win10v2004-20231222-en
General
-
Target
4db44be20fd5aee919d32b2d5cd74b08
-
Size
564KB
-
MD5
4db44be20fd5aee919d32b2d5cd74b08
-
SHA1
31fc6ee388f19a76ca426ae3b7428849127d265c
-
SHA256
2871316c4d4444f77be9d2326194c22079863edaa5d72c763732fb5d67fe3b23
-
SHA512
7ab032f6f6c2cadba9c22e00fa2bfae3d1158d56beaa178f538628831ef7070fa44f2c7badef81b59331017522d4e2bce5751b169f6a4899bcf7c29af09c14ab
-
SSDEEP
12288:QR6VXTEaFUaH0LSF7BBoxJ6c0zYTdw6RZAZUTcTEj3X1E:QR61T7F1/1Box4rcvRZ/TcYn1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4db44be20fd5aee919d32b2d5cd74b08
Files
-
4db44be20fd5aee919d32b2d5cd74b08.exe windows:4 windows x86 arch:x86
fee34f970ecad6c76ed35bab855dcc02
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
ReportEventA
CryptSetProviderExA
RegSetKeySecurity
LogonUserW
comctl32
ImageList_LoadImageA
DrawInsert
ImageList_EndDrag
InitCommonControlsEx
ImageList_DragMove
DrawStatusTextA
comdlg32
LoadAlterBitmap
PrintDlgW
ChooseColorW
PageSetupDlgA
kernel32
lstrcmpW
DuplicateHandle
HeapDestroy
WriteConsoleOutputAttribute
WritePrivateProfileStructA
GetThreadPriority
IsBadWritePtr
WriteFile
ExitProcess
GetThreadSelectorEntry
GetSystemInfo
SetLocalTime
HeapCreate
GetThreadContext
SetHandleCount
MultiByteToWideChar
GetExitCodeProcess
GetTickCount
EnumCalendarInfoW
UnhandledExceptionFilter
GetCurrentDirectoryW
HeapReAlloc
TlsFree
GetLastError
LoadResource
GetPrivateProfileStringW
CreateRemoteThread
VirtualAlloc
TlsSetValue
TlsAlloc
GetEnvironmentStrings
LCMapStringW
QueryPerformanceCounter
GetConsoleOutputCP
lstrlenW
GetVolumeInformationA
VirtualFree
GetProcAddress
GetCalendarInfoW
CommConfigDialogW
GetEnvironmentStringsW
FindFirstFileA
UnlockFileEx
FileTimeToDosDateTime
InitializeCriticalSection
WaitForMultipleObjectsEx
GetCurrentThreadId
WaitNamedPipeA
ReadFile
GetStartupInfoA
GetExitCodeThread
GetOEMCP
GetPrivateProfileSectionW
CompareStringW
GetLogicalDrives
GetWindowsDirectoryA
LeaveCriticalSection
CompareStringA
GetTimeFormatA
EnterCriticalSection
OpenFileMappingA
IsValidCodePage
DeleteFileA
GetConsoleScreenBufferInfo
GlobalFix
HeapAlloc
EnumSystemLocalesA
GetCPInfo
LCMapStringA
LoadLibraryA
GetStartupInfoW
InterlockedIncrement
VirtualProtect
GetDiskFreeSpaceW
FreeEnvironmentStringsA
GetStringTypeW
VirtualQuery
GetDateFormatA
GetStringTypeExA
WideCharToMultiByte
WriteProfileSectionW
GetCurrentProcessId
GetThreadPriorityBoost
GetCurrentProcess
GetUserDefaultLCID
GlobalGetAtomNameA
OpenMutexA
GetTempFileNameA
GetLocaleInfoW
FlushFileBuffers
RaiseException
FreeLibraryAndExitThread
HeapSize
GetFileType
HeapFree
DeleteCriticalSection
GetStringTypeA
CloseHandle
RtlZeroMemory
CreateMutexA
FlushViewOfFile
RtlUnwind
GetModuleFileNameW
lstrcpynA
GetCurrentThread
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCommandLineA
InterlockedExchange
RtlMoveMemory
ReadFileEx
SetConsoleActiveScreenBuffer
GetStdHandle
EnumTimeFormatsW
TlsGetValue
SetLastError
CreateFileA
WaitForSingleObjectEx
GetLocaleInfoA
GetModuleHandleA
MoveFileA
GetLogicalDriveStringsW
GetVersionExA
GetACP
TerminateProcess
LocalCompact
OpenSemaphoreA
FreeEnvironmentStringsW
GetCommandLineW
SetThreadAffinityMask
IsValidLocale
GetFileAttributesW
SetStdHandle
SetEnvironmentVariableA
GlobalFindAtomW
GetModuleFileNameA
GetLongPathNameA
GetModuleHandleW
EnumCalendarInfoExW
GetTimeZoneInformation
SetFilePointer
EnumResourceLanguagesW
user32
TileChildWindows
CharPrevA
LoadIconA
CreateMenu
RegisterClassExA
GetClassInfoW
ScrollDC
DrawTextA
DdeImpersonateClient
TranslateMDISysAccel
EnumDesktopWindows
GetUpdateRgn
GetDlgItemTextW
SetWindowWord
ChangeMenuA
DestroyWindow
DefWindowProcA
WinHelpA
MessageBoxA
ChildWindowFromPointEx
SetProcessDefaultLayout
GetMenuItemRect
ShowWindow
CreateWindowExW
GetSysColorBrush
BringWindowToTop
DestroyCaret
DlgDirSelectComboBoxExA
GetDlgItemInt
OemKeyScan
GetDlgItemTextA
DrawTextExW
SendNotifyMessageA
RegisterClassA
shell32
SHUpdateRecycleBinIcon
SHInvokePrinterCommandA
SHFileOperation
DragQueryPoint
SHInvokePrinterCommandW
wininet
InternetCanonicalizeUrlW
InternetOpenUrlA
DeleteUrlCacheEntryA
InternetSetDialStateW
Sections
.text Size: 160KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 252KB - Virtual size: 250KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 120KB - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ