Static task
static1
Behavioral task
behavioral1
Sample
4f1ad58ac8b3bd2649a4d0d70ab255dc.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4f1ad58ac8b3bd2649a4d0d70ab255dc.exe
Resource
win10v2004-20231215-en
General
-
Target
4f1ad58ac8b3bd2649a4d0d70ab255dc
-
Size
55KB
-
MD5
4f1ad58ac8b3bd2649a4d0d70ab255dc
-
SHA1
71dafec6a3fff1142f593f7fd80c4421acf10a12
-
SHA256
e531f09ebc39053ef8efc9c3dd6012f2c529e38a387e71482b7923c47dd6f37a
-
SHA512
46ad1007763f6585430130c0d0045b8d830bb34beac22e0ff15f5b7b674cad76709a3a426bbe30b5da3283f849391ad572d0315e4e37009bfef3e55c6b97c297
-
SSDEEP
768:mxowCSZNNlBT+2ewLIXetoJXctYmuFMeNX58RnrldAmOz2BdZ2ZimbdjKK:mhHBTxewtoJXctuJNX5GA2Z2ZZ2K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4f1ad58ac8b3bd2649a4d0d70ab255dc
Files
-
4f1ad58ac8b3bd2649a4d0d70ab255dc.exe windows:4 windows x86 arch:x86
a00386beebe59c57dacbf8cfd80454e2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
IsBadReadPtr
IsBadWritePtr
UnmapViewOfFile
GetFileSize
MapViewOfFile
CreateFileMappingA
lstrcatA
GetTempPathA
SetCurrentDirectoryA
GetSystemDirectoryA
GetVersionExA
GetLastError
GetCurrentProcess
GetModuleFileNameA
Process32Next
OpenProcess
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
TerminateProcess
SetPriorityClass
GetOverlappedResult
DeviceIoControl
VirtualProtect
WriteProcessMemory
VirtualAlloc
VirtualAllocEx
CreateRemoteThread
ReadProcessMemory
FreeLibrary
Sleep
SetErrorMode
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
SetEndOfFile
GetModuleHandleA
SetFilePointer
ReadFile
CreateFileA
WriteFile
WaitForSingleObject
CreateEventA
CreateThread
CloseHandle
SetEvent
GetFileAttributesA
SetFileAttributesA
DeleteFileA
CopyFileA
MoveFileA
RemoveDirectoryA
CreateDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetLogicalDriveStringsA
GetDriveTypeA
GetVersion
GetTickCount
GetStartupInfoA
user32
GetDC
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetKeyNameTextA
ToAscii
GetKeyboardState
GetSystemMetrics
GetForegroundWindow
wsprintfA
UnregisterClassA
DispatchMessageA
SendInput
TranslateMessage
GetMessageA
CreateWindowExA
RegisterClassExA
GetWindowTextA
DestroyWindow
LoadCursorA
DefWindowProcA
SetTimer
PostQuitMessage
MessageBoxA
ExitWindowsEx
PostMessageA
IsWindow
SendMessageA
keybd_event
EnumWindows
GetWindowTextLengthA
GetWindowLongA
IsWindowVisible
BringWindowToTop
mouse_event
VkKeyScanA
SetForegroundWindow
GetWindowThreadProcessId
SetWindowTextA
SetWindowPos
ShowWindow
gdi32
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
GetDIBits
DeleteObject
DeleteDC
advapi32
RegDeleteKeyA
CreateServiceA
CloseServiceHandle
OpenServiceA
ControlService
DeleteService
RegCloseKey
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegSetValueExA
RegQueryInfoKeyA
RegCreateKeyExA
RegQueryValueExA
StartServiceA
GetUserNameA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
OpenSCManagerA
shell32
ShellExecuteA
wsock32
inet_ntoa
getpeername
ntohs
closesocket
WSAGetLastError
bind
listen
socket
htons
WSAAsyncSelect
connect
WSAStartup
ioctlsocket
gethostbyname
send
recv
accept
shlwapi
SHDeleteKeyA
wininet
InternetOpenA
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
avicap32
capCreateCaptureWindowA
capGetDriverDescriptionA
msvcrt
_CxxThrowException
__CxxFrameHandler
fopen
fwrite
fclose
realloc
_ftol
??2@YAPAXI@Z
??3@YAXPAX@Z
sprintf
strtok
free
malloc
atol
_stricmp
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
printf
_controlfp
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ