Static task
static1
Behavioral task
behavioral1
Sample
50516ba042ed1aaae22e56c6507c2bfb.exe
Resource
win7-20231215-en
General
-
Target
50516ba042ed1aaae22e56c6507c2bfb
-
Size
2.7MB
-
MD5
50516ba042ed1aaae22e56c6507c2bfb
-
SHA1
a462d0473733f518807bd380d9468eb94321abb6
-
SHA256
85ab17e1b22b87b9aa6058da5a239f41efb41f6e12f25c380508c636053e4975
-
SHA512
8a5ccc941e3cc4793651e0ba1e2775cc9f6782235eee32854b7be961dbc44c3d9e260e5c17c9c0224a2a2e441dc6a26014b3fe8cc21716d7e4d17be476eb9ce8
-
SSDEEP
49152:pr9V00000000000000000000000000l1zILnkoyQ:pBV00000000000000000000000000Un7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 50516ba042ed1aaae22e56c6507c2bfb
Files
-
50516ba042ed1aaae22e56c6507c2bfb.exe windows:5 windows x86 arch:x86
04671cdeaa0d966282030b0f15f4d956
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
msi
ord173
kernel32
FindNextFileW
RemoveDirectoryW
GetLastError
CreateDirectoryW
GetFileSize
ReadFile
ExpandEnvironmentStringsW
WriteFile
GetEnvironmentVariableW
MultiByteToWideChar
WideCharToMultiByte
MulDiv
GetModuleHandleW
GetCurrentProcess
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetCurrentThreadId
OutputDebugStringW
GetLocalTime
GetModuleFileNameW
FlushFileBuffers
lstrcmpiW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
SetThreadLocale
GetSystemDefaultLCID
DecodePointer
lstrlenW
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
GetExitCodeThread
CreateThread
WaitForSingleObject
OpenProcess
GetExitCodeProcess
Sleep
CreateProcessW
GetCommandLineW
CreateEventW
SetEvent
GlobalMemoryStatus
DeleteFileW
SetCurrentDirectoryW
GetTimeFormatW
GetDateFormatW
GetUserDefaultLangID
GetVersionExW
CompareStringW
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
GetStringTypeW
GetFileType
GetACP
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
VirtualFree
VirtualAlloc
GetOEMCP
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetLastError
GetFullPathNameW
FindFirstFileW
FindClose
RaiseException
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetEnvironmentVariableW
WriteConsoleW
user32
GetDlgCtrlID
GetCursorPos
ScreenToClient
PtInRect
SetRectEmpty
ReleaseCapture
GetCapture
SetCapture
SetFocus
TrackMouseEvent
SetCursor
DrawFocusRect
GetFocus
SystemParametersInfoW
GetWindowTextLengthW
GetWindowTextW
DrawTextW
OffsetRect
GetSysColor
IsWindowEnabled
FillRect
MessageBoxW
GetClassNameW
EnableWindow
DialogBoxParamW
DispatchMessageW
TranslateMessage
UpdateWindow
PeekMessageW
GetActiveWindow
GetMessageW
RegisterWindowMessageW
PostThreadMessageW
EndPaint
LoadCursorW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
GetSystemMetrics
InvalidateRect
RedrawWindow
IsWindowVisible
ShowWindow
EndDialog
CreateWindowExW
IsWindow
SendMessageW
SetWindowLongW
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
MapWindowPoints
SetWindowPos
SetWindowTextW
GetDlgItem
UnregisterClassW
DestroyWindow
DefWindowProcW
CharNextW
ReleaseDC
GetClientRect
GetDC
LoadStringW
BeginPaint
gdi32
CreateCompatibleBitmap
DeleteDC
CreateCompatibleDC
SelectObject
BitBlt
GetObjectW
CreateFontIndirectW
GetStockObject
SetTextColor
SetBkMode
DeleteObject
advapi32
RegCloseKey
CryptDecrypt
CryptGetHashParam
CryptReleaseContext
CryptCreateHash
CryptDeriveKey
CryptDestroyKey
CryptHashData
CryptDestroyHash
CryptAcquireContextW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
shell32
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
ole32
CoTaskMemAlloc
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
oleaut32
VarUI4FromStr
Sections
.text Size: 224KB - Virtual size: 223KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 486KB - Virtual size: 485KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE