Static task
static1
Behavioral task
behavioral1
Sample
4a12a6b487999a05a8d73a67b60deb26f92006d7fdf6fc0692b15be25560d4c2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4a12a6b487999a05a8d73a67b60deb26f92006d7fdf6fc0692b15be25560d4c2.exe
Resource
win10v2004-20231215-en
General
-
Target
4a12a6b487999a05a8d73a67b60deb26f92006d7fdf6fc0692b15be25560d4c2
-
Size
184KB
-
MD5
28d8e4344b783e59c63c73ae769abd1a
-
SHA1
93f2445de34fb6aae935cbab2a2f7a7b9f64cda7
-
SHA256
4a12a6b487999a05a8d73a67b60deb26f92006d7fdf6fc0692b15be25560d4c2
-
SHA512
05dbb1aa17f9bb3941c283e03cf361cd539ba61a465ce40e479a25ceba93df37faecf8c1830dafc6f887769aa3bae2ad10eaba560edf7e7b202ab07c68f33d0d
-
SSDEEP
1536:rkb3ZQFOxhbVlHJd0wb6KnvOIIZI7HZOiLkqIkxF6uY8j9f94hIIfsiWYQF:rkCFOrpd0w+KiID0CkUzhMIIEQC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4a12a6b487999a05a8d73a67b60deb26f92006d7fdf6fc0692b15be25560d4c2
Files
-
4a12a6b487999a05a8d73a67b60deb26f92006d7fdf6fc0692b15be25560d4c2.exe windows:4 windows x86 arch:x86
ac704ddc8a4a20c1145aa9186da4f9d7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEvent
CloseHandle
WaitForSingleObject
CreateThread
CreateEventA
Sleep
lstrcmpiA
GetCommandLineA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LoadLibraryA
lstrcpyA
lstrcatA
WideCharToMultiByte
LeaveCriticalSection
GetModuleHandleA
GlobalUnlock
GlobalLock
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
GetStartupInfoA
LocalFree
GetLastError
FindFirstFileA
FindNextFileA
ReleaseMutex
CreateMutexA
HeapFree
GetProcessHeap
HeapAlloc
GlobalFree
GetShortPathNameA
lstrlenW
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
lstrlenA
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetModuleFileNameA
VirtualQuery
LoadLibraryExA
GetProcAddress
EnterCriticalSection
FreeLibrary
user32
IsChild
SetWindowLongA
DefWindowProcA
GetWindowLongA
DestroyWindow
PostMessageA
GetClientRect
PostThreadMessageA
CreateWindowExA
CallWindowProcA
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
CharNextA
UnionRect
PtInRect
GetKeyState
InvalidateRect
GetParent
ShowWindow
SetFocus
IsWindow
BeginPaint
EndPaint
GetFocus
SetWindowPos
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
GetDC
ReleaseDC
GetMessageA
DispatchMessageA
gdi32
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
GetDeviceCaps
CreateDCA
TextOutA
SetTextAlign
Rectangle
CreateRectRgnIndirect
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
CreateMetaFileA
RestoreDC
ole32
CoRegisterClassObject
CoUninitialize
WriteClassStm
OleSaveToStream
CoCreateInstance
OleRegEnumVerbs
CoRevokeClassObject
CoInitialize
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
CreateDataAdviseHolder
OleLoadFromStream
CoTaskMemAlloc
CoTaskMemFree
oleaut32
SysFreeString
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysAllocStringByteLen
OleCreatePropertyFrame
SysStringByteLen
VariantChangeType
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
SysAllocStringLen
VariantClear
SysAllocString
VariantInit
shlwapi
PathAddBackslashA
PathAppendA
PathRemoveFileSpecA
msvcp60
??1bad_cast@std@@UAE@XZ
??_7bad_cast@std@@6B@
??1_Lockit@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0_Lockit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?getline@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??0bad_cast@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0bad_cast@std@@QAE@PBD@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
msvcrt
memcmp
_CxxThrowException
_purecall
_access
free
??2@YAPAXI@Z
strlen
mbstowcs
memset
_mkdir
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@ABQBD@Z
??8type_info@@QBEHABV0@@Z
memcpy
realloc
malloc
strncpy
fclose
fflush
fwrite
fopen
__CxxFrameHandler
_ftol
wcslen
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strcmp
comdlg32
GetOpenFileNameA
GetSaveFileNameA
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
Sections
.text Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ