Behavioral task
behavioral1
Sample
5045c5999590558f1a90d5701d4a7d4f.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5045c5999590558f1a90d5701d4a7d4f.exe
Resource
win10v2004-20231222-en
General
-
Target
5045c5999590558f1a90d5701d4a7d4f
-
Size
439KB
-
MD5
5045c5999590558f1a90d5701d4a7d4f
-
SHA1
819c563f21056fd4d346532ea4ae7e134d31b7e8
-
SHA256
9b9c4c4bd36f49992bed287d52e959a98e2bbd98eca685b4c9bcf74e0b2f0b8a
-
SHA512
dff24294a3c6bde6a4b43eaa991c5802345f04b1e5891ba7f53a96066f8c9bae926997c918b67636e7f570ae2fe373aefa4e5abbb4d486140d38b37cbe54e27c
-
SSDEEP
6144:j2ndn26d7o8oNPzJHDMqsD/fuZIh+zA4AdD/HDTaOlchat47ek9aiXqS8sVv9bTl:lOoZ4wikat47ekwwv/M
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5045c5999590558f1a90d5701d4a7d4f
Files
-
5045c5999590558f1a90d5701d4a7d4f.exe windows:6 windows x86 arch:x86
6ee49fde990014b6bfeb54fb41ee5553
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegGetValueW
RegFlushKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
PrivilegeCheck
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
kernel32
FindNextFileW
DeleteFileW
FindFirstFileW
EnumUILanguagesW
HeapAlloc
GetProcessHeap
GetSystemTimeAsFileTime
FindClose
FreeResource
GetSystemTime
SystemTimeToFileTime
GetFileTime
MoveFileExW
LoadLibraryExW
GetVersionExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
CreateDirectoryW
GetFileAttributesW
LoadLibraryW
GetProcAddress
GetLastError
FreeLibrary
GetSystemPreferredUILanguages
GetSystemDefaultUILanguage
LCIDToLocaleName
GetProductInfo
GetVersionExA
SetUnhandledExceptionFilter
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
GetCurrentThread
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
OutputDebugStringA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
CloseHandle
EnterCriticalSection
LeaveCriticalSection
LCMapStringA
WideCharToMultiByte
LCMapStringW
LoadLibraryExA
InitializeCriticalSection
Sleep
VirtualAlloc
HeapReAlloc
SetFilePointer
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
IsValidLocale
SetStdHandle
FlushFileBuffers
CreateFileW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualProtect
GetSystemInfo
VirtualQuery
ReadFile
SetEndOfFile
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
GetFileSizeEx
SetFileAttributesW
GetFileAttributesExW
ExpandEnvironmentStringsW
GlobalMemoryStatusEx
DeviceIoControl
GetDiskFreeSpaceExW
LocalFree
FlushViewOfFile
CreateFileMappingW
GetSystemWindowsDirectoryW
WaitForSingleObject
CreateMutexW
RemoveDirectoryW
SetEnvironmentVariableW
ntdll
RtlUnwind
EtwEventRegister
RtlReAllocateHeap
EtwEventUnregister
RtlGetSystemPreferredUILanguages
EtwEventEnabled
RtlExpandEnvironmentStrings
RtlAllocateHeap
RtlFreeHeap
NtUnmapViewOfSection
RtlNtStatusToDosError
NtMapViewOfSection
RtlUnicodeStringToInteger
RtlInitUnicodeString
EtwEventWrite
netapi32
NetGetJoinInformation
NetApiBufferFree
Sections
.text Size: 253KB - Virtual size: 253KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGELK Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE