Static task
static1
Behavioral task
behavioral1
Sample
531e88a058c3d3788f58729c3e779fcb.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
531e88a058c3d3788f58729c3e779fcb.exe
Resource
win10v2004-20231215-en
General
-
Target
531e88a058c3d3788f58729c3e779fcb
-
Size
82KB
-
MD5
531e88a058c3d3788f58729c3e779fcb
-
SHA1
194a0747a3498332c9e2f64bebd40a445cfeaac1
-
SHA256
7bf67814d345fc40d67bba9373c402d1e121152348a1816765e47395ca671bd0
-
SHA512
d6b76e2ffb4c4952a3ffbe824be4118eb2f242072eaed7f1222bd33aa86fb51b93861e3a32ffd9bf29e316db125d055bb58507c88d99a4637e20c25764b35466
-
SSDEEP
1536:4fr8QXCRlpQ01w46DVZUOJazr3wMjFcnIF1OIcOIlzzjvz4TL0k:O9ylpoVZUOArgwcIF1OXO0TY0k
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 531e88a058c3d3788f58729c3e779fcb
Files
-
531e88a058c3d3788f58729c3e779fcb.exe windows:4 windows x86 arch:x86
259ccee9bc712961c77fdb60b2db4aa5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryInfoKeyA
GetCurrentHwProfileA
ObjectPrivilegeAuditAlarmA
CryptSetProvParam
SetSecurityDescriptorGroup
RegSetValueW
RegUnLoadKeyA
ConvertSecurityDescriptorToAccessA
SetThreadToken
SetEntriesInAccessListA
GetTrusteeTypeW
CryptEnumProviderTypesW
RegQueryValueA
EnumServicesStatusA
QueryServiceObjectSecurity
GetAccessPermissionsForObjectW
GetTrusteeNameW
LookupAccountSidW
GetMultipleTrusteeOperationW
CryptGetHashParam
AddAuditAccessAce
CreateServiceA
RegEnumValueA
GetAce
RegEnumKeyA
TrusteeAccessToObjectA
CryptGenRandom
GetMultipleTrusteeA
SetAclInformation
RegNotifyChangeKeyValue
ImpersonateLoggedOnUser
QueryServiceStatus
StartServiceW
IsValidSid
CryptSetProviderW
AddAccessDeniedAce
DeleteService
InitiateSystemShutdownW
TrusteeAccessToObjectW
GetCurrentHwProfileW
SetServiceStatus
SetEntriesInAccessListW
ObjectDeleteAuditAlarmW
CryptGetDefaultProviderA
RegSaveKeyA
OpenBackupEventLogW
CryptSetProviderExW
GetKernelObjectSecurity
RegRestoreKeyA
PrivilegeCheck
CryptSignHashA
GetSecurityInfo
ControlService
OpenSCManagerA
CreateProcessAsUserA
CryptHashSessionKey
AllocateLocallyUniqueId
AccessCheck
GetLengthSid
GetFileSecurityA
CryptVerifySignatureW
ReadEventLogW
RegDeleteKeyW
SetSecurityDescriptorSacl
CryptEncrypt
SetServiceObjectSecurity
GetOverlappedAccessResults
AddAccessAllowedAce
OpenEventLogA
CryptGetUserKey
RegCreateKeyA
GetSecurityDescriptorSacl
SetNamedSecurityInfoExA
LookupAccountNameW
GetMultipleTrusteeW
LookupAccountNameA
GetNamedSecurityInfoExW
LookupPrivilegeNameW
GetTrusteeNameA
GetServiceDisplayNameA
RegCreateKeyW
AdjustTokenPrivileges
AllocateAndInitializeSid
SetServiceBits
MapGenericMask
LookupPrivilegeDisplayNameA
RegQueryValueExW
CryptGetKeyParam
SetPrivateObjectSecurity
DuplicateToken
BuildExplicitAccessWithNameW
RegRestoreKeyW
RegisterEventSourceA
SetSecurityInfoExW
MakeSelfRelativeSD
GetFileSecurityW
CryptAcquireContextA
GetSecurityDescriptorDacl
GetAccessPermissionsForObjectA
AccessCheckAndAuditAlarmW
CryptImportKey
LogonUserA
CryptHashData
GetAuditedPermissionsFromAclA
RegReplaceKeyA
ObjectDeleteAuditAlarmA
RegisterServiceCtrlHandlerA
BuildTrusteeWithNameW
CryptReleaseContext
BuildExplicitAccessWithNameA
EqualSid
SetNamedSecurityInfoW
RegEnumValueW
RegLoadKeyA
RevertToSelf
ole32
CoReleaseServerProcess
IsAccelerator
EnableHookObject
CoReleaseMarshalData
CoSuspendClassObjects
CoRegisterClassObject
CoGetCallerTID
CoIsOle1Class
CoImpersonateClient
CreateDataAdviseHolder
CoLockObjectExternal
OleCreateLinkFromData
UtConvertDvtd16toDvtd32
CLSIDFromString
CoInitializeSecurity
DoDragDrop
CLSIDFromProgID
StgIsStorageFile
OleCreateLinkFromDataEx
OleNoteObjectVisible
OleLoad
OleGetIconOfFile
FreePropVariantArray
CoRevokeClassObject
CoFileTimeNow
CoQueryClientBlanket
ReadClassStm
OleQueryLinkFromData
CoSetProxyBlanket
OleCreate
OleRegGetUserType
WriteOleStg
CreateFileMoniker
CoGetCurrentProcess
CoRegisterMallocSpy
OleCreateFromData
CoQueryProxyBlanket
CoTreatAsClass
OpenOrCreateStream
OleRegEnumVerbs
CoGetCurrentLogicalThreadId
CreateILockBytesOnHGlobal
WriteFmtUserTypeStg
OleSetAutoConvert
OleConvertOLESTREAMToIStorage
CoQueryAuthenticationServices
StgOpenStorage
DllDebugObjectRPCHook
CoIsHandlerConnected
StringFromGUID2
CoCreateGuid
OleDoAutoConvert
CreateGenericComposite
ProgIDFromCLSID
OleCreateFromFile
OleCreateLinkToFileEx
OleSetMenuDescriptor
OleGetAutoConvert
CoUnmarshalHresult
CoLoadLibrary
CoGetObject
StgSetTimes
OleCreateEmbeddingHelper
CreateStreamOnHGlobal
GetConvertStg
CoMarshalInterface
OleConvertIStorageToOLESTREAM
OleRun
CoMarshalInterThreadInterfaceInStream
OleRegEnumFormatEtc
UtGetDvtd32Info
ReadFmtUserTypeStg
CreateOleAdviseHolder
OleConvertOLESTREAMToIStorageEx
OleGetClipboard
IsEqualGUID
OleLockRunning
CoResumeClassObjects
CoGetInstanceFromIStorage
OleCreateEx
ReadClassStg
CoFileTimeToDosDateTime
ReadStringStream
OleDuplicateData
GetHookInterface
StgGetIFillLockBytesOnILockBytes
RevokeDragDrop
MkParseDisplayName
StgCreateStorageEx
OleIsCurrentClipboard
CoTaskMemAlloc
RegisterDragDrop
StgCreateDocfileOnILockBytes
CoRegisterMessageFilter
CoCreateInstance
StgOpenStorageEx
CoRevokeMallocSpy
CoGetMarshalSizeMax
CoGetInterfaceAndReleaseStream
shlwapi
PathGetArgsA
StrIsIntlEqualA
PathIsSameRootW
UrlApplySchemeA
PathSkipRootA
PathIsDirectoryEmptyW
SHRegQueryUSValueW
PathCommonPrefixA
UrlGetLocationA
SHRegEnumUSValueA
PathGetCharTypeW
StrFromTimeIntervalW
SHDeleteValueA
SHRegDeleteUSValueA
PathSkipRootW
SHRegQueryInfoUSKeyA
PathRenameExtensionA
PathCompactPathA
StrRStrIA
PathUnquoteSpacesA
PathGetCharTypeA
StrToIntA
SHOpenRegStream2A
PathParseIconLocationW
PathStripPathW
PathRemoveArgsW
PathIsContentTypeA
wnsprintfW
PathIsRelativeA
PathIsUNCServerA
StrCmpNIW
StrSpnA
PathIsUNCServerShareA
PathQuoteSpacesW
PathFindExtensionW
PathUnmakeSystemFolderW
StrCatBuffW
StrCatW
AssocQueryStringByKeyW
PathRelativePathToA
PathIsUNCA
PathCreateFromUrlW
PathUndecorateW
PathUndecorateA
PathIsRootA
PathMakePrettyA
PathIsNetworkPathA
AssocQueryKeyA
SHRegDeleteEmptyUSKeyW
StrFormatByteSizeA
PathCombineA
PathQuoteSpacesA
SHEnumValueW
UrlEscapeA
StrFormatByteSize64A
StrRetToStrW
PathIsPrefixA
UrlIsNoHistoryW
StrCmpIW
PathIsSystemFolderA
SHQueryInfoKeyA
PathIsFileSpecA
StrFromTimeIntervalA
SHDeleteKeyW
SHRegOpenUSKeyA
SHRegDuplicateHKey
SHEnumValueA
PathUnquoteSpacesW
PathIsDirectoryW
PathCanonicalizeW
UrlGetPartA
PathRemoveBackslashA
SHIsLowMemoryMachine
PathIsUNCW
PathCanonicalizeA
PathStripPathA
PathFindNextComponentW
StrRChrW
PathFindExtensionA
StrCmpNW
PathIsContentTypeW
PathIsPrefixW
PathFileExistsA
PathAddBackslashA
PathIsDirectoryEmptyA
PathRemoveBackslashW
SHRegWriteUSValueW
SHCreateStreamOnFileW
StrCSpnIA
StrToIntW
UrlCompareA
SHCopyKeyW
SHAutoComplete
SHRegDeleteEmptyUSKeyA
PathFindSuffixArrayA
StrRChrIW
PathRemoveExtensionA
UrlGetPartW
StrSpnW
StrCpyW
SHCreateShellPalette
StrChrIA
PathCompactPathExA
PathAppendW
ColorRGBToHLS
PathMakeSystemFolderA
PathRemoveExtensionW
UrlIsA
wnsprintfA
UrlEscapeW
PathAddBackslashW
IntlStrEqWorkerA
user32
IsClipboardFormatAvailable
OpenClipboard
WinHelpW
GetDlgItemInt
ValidateRgn
CreateAcceleratorTableA
RegisterClassW
SetCaretPos
SetCapture
GetCaretBlinkTime
GetScrollPos
BringWindowToTop
MapVirtualKeyExA
SetWindowWord
SendDlgItemMessageW
CharToOemBuffA
BroadcastSystemMessage
GetWindowInfo
KillTimer
PostQuitMessage
DestroyIcon
DialogBoxIndirectParamA
SendNotifyMessageW
OffsetRect
CharNextA
UnhookWindowsHook
MsgWaitForMultipleObjects
GetClassWord
GetWindowDC
SetClassLongW
LoadCursorFromFileW
SetSystemCursor
GetTopWindow
DdeCreateStringHandleA
EnumDisplaySettingsA
GetScrollBarInfo
GetMenuItemCount
SystemParametersInfoA
CreateIcon
GetQueueStatus
GetMessageA
CharUpperBuffA
IsMenu
DdeGetData
EnumClipboardFormats
TranslateMessage
FlashWindow
GetKeyNameTextW
CreateWindowExA
GetListBoxInfo
CloseWindow
ReuseDDElParam
GetCapture
EnumPropsW
SetThreadDesktop
DrawFocusRect
ChangeDisplaySettingsExA
SetShellWindow
CreateDesktopW
SetCursor
CascadeChildWindows
RegisterDeviceNotificationA
GetGUIThreadInfo
SetPropW
SetWinEventHook
CopyAcceleratorTableA
OpenInputDesktop
OpenIcon
PostThreadMessageA
IsIconic
DdeAccessData
ScrollWindowEx
GetComboBoxInfo
EndDeferWindowPos
AnyPopup
SendMessageTimeoutW
SetProcessWindowStation
CharLowerA
EnumDisplayDevicesA
GetKeyboardLayoutNameA
InvalidateRect
IsDlgButtonChecked
GetClipboardSequenceNumber
SetMenuItemInfoA
DlgDirSelectExW
IsWindowEnabled
GetSysColor
GetDialogBaseUnits
GetInputState
DdeAbandonTransaction
DdeQueryConvInfo
ShowWindow
SetWindowsHookA
MessageBeep
DispatchMessageA
RealGetWindowClass
GetWindowTextLengthA
GetSystemMetrics
SetUserObjectSecurity
SendInput
GetKeyboardLayoutList
RegisterClipboardFormatW
TranslateAcceleratorA
SetDlgItemTextA
DdeAddData
CreateMenu
IsCharAlphaNumericW
RemovePropW
DialogBoxIndirectParamW
GrayStringA
TileChildWindows
AdjustWindowRectEx
EnumThreadWindows
SetWindowsHookW
DefFrameProcA
CharPrevExA
EnumDisplaySettingsExA
RedrawWindow
MessageBoxIndirectA
CharToOemW
GetTabbedTextExtentA
GetWindowRect
DdeClientTransaction
BroadcastSystemMessageA
GetScrollInfo
LoadBitmapA
SetWindowContextHelpId
MapVirtualKeyA
GetWindowContextHelpId
GetTitleBarInfo
MonitorFromRect
SetCaretBlinkTime
IsCharLowerW
CallWindowProcW
DdeCreateDataHandle
CreateCursor
kernel32
ReadConsoleInputW
GetTempPathW
SetVolumeLabelW
WriteProfileSectionW
GetTempFileNameA
VirtualProtect
GetLocaleInfoA
SetCalendarInfoA
GlobalAlloc
FindNextFileW
GetProfileStringA
LocalUnlock
RemoveDirectoryA
GetBinaryTypeW
IsBadReadPtr
ScrollConsoleScreenBufferA
HeapFree
FileTimeToLocalFileTime
SetErrorMode
ScrollConsoleScreenBufferW
VirtualAlloc
VirtualProtectEx
GetStringTypeExW
IsDebuggerPresent
IsProcessorFeaturePresent
IsDBCSLeadByte
WriteConsoleOutputAttribute
CreateSemaphoreW
GetSystemDirectoryA
ReadFileEx
OpenProcess
FindResourceW
EnumCalendarInfoExW
VirtualQuery
VirtualQueryEx
DeleteFileA
GetEnvironmentStringsA
GetProcessHeaps
GetMailslotInfo
SystemTimeToFileTime
SetThreadAffinityMask
WinExec
MapViewOfFileEx
GetCurrentProcess
EnumResourceNamesW
FillConsoleOutputAttribute
GetExitCodeThread
SearchPathA
EnumSystemCodePagesW
CreateMailslotA
GetWriteWatch
FlushFileBuffers
SetTapePosition
GetDefaultCommConfigW
GetTimeZoneInformation
GetThreadTimes
lstrcpy
Sleep
LocalShrink
FindClose
QueryDosDeviceA
GetFileTime
SetConsoleTitleW
SetSystemTime
GetThreadSelectorEntry
QueryPerformanceFrequency
GetThreadLocale
GlobalReAlloc
EnumResourceTypesW
CreateFileW
SetConsoleScreenBufferSize
LocalSize
GetConsoleCP
CompareStringW
TlsAlloc
GetStartupInfoA
DosDateTimeToFileTime
VirtualFree
IsBadStringPtrA
SetFileAttributesW
SetProcessShutdownParameters
BeginUpdateResourceA
OpenEventA
GetCPInfoExW
Beep
ReadProcessMemory
PeekConsoleInputA
SetTapeParameters
LockFileEx
SetThreadLocale
FatalExit
SetCurrentDirectoryW
SwitchToFiber
GetDriveTypeA
VirtualFreeEx
ReleaseMutex
SetFilePointer
GetEnvironmentStrings
GetStringTypeExA
LoadLibraryExA
EnumSystemLocalesA
GlobalUnfix
LocalLock
OpenFileMappingA
WritePrivateProfileStringA
GlobalGetAtomNameW
lstrcpyn
GetOEMCP
HeapWalk
CreateMailslotW
CreateToolhelp32Snapshot
FindFirstFileW
GetProcessAffinityMask
lstrcmpiW
GetProcessWorkingSetSize
WriteConsoleInputW
LocalFree
FindCloseChangeNotification
MapViewOfFile
GetModuleFileNameA
GetTempPathA
GetNamedPipeHandleStateW
SetCommTimeouts
CreateWaitableTimerA
WriteConsoleOutputCharacterW
GlobalWire
FoldStringA
OpenSemaphoreW
LoadLibraryA
SetFileAttributesA
GetModuleHandleA
GetProcAddress
SetVolumeLabelA
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE