Static task
static1
Behavioral task
behavioral1
Sample
561f58f7c79c75e567041089b22a4753.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
561f58f7c79c75e567041089b22a4753.exe
Resource
win10v2004-20231215-en
General
-
Target
561f58f7c79c75e567041089b22a4753
-
Size
480KB
-
MD5
561f58f7c79c75e567041089b22a4753
-
SHA1
5343bbfe85032755987d0cc6766d3366355c3889
-
SHA256
2c587d2a0a6c5cf861ef2aa1f1857e47d1ba8d2133cb9347c171035f18c7c771
-
SHA512
6c647ef91bfa395ee356fa72bd99360d212c6324f191c61ce86afc253510264bc5903896e18dd464d2a7c824eec4246e830fa7851687d5fbb13121fd169da2d1
-
SSDEEP
12288:9WeR1O/Gzf4BRFhwHgKpZN3mWnsfoH5/MMJ1gdgPNV:9WeRIU2FhwfJ3mWn5ZZbgdgn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 561f58f7c79c75e567041089b22a4753
Files
-
561f58f7c79c75e567041089b22a4753.exe windows:4 windows x86 arch:x86
c981b2bb0e100fec5f9215d132d0f3bf
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteEx
wininet
InternetTimeFromSystemTime
InternetDialW
InternetSetDialStateA
InternetTimeToSystemTimeW
InternetGetConnectedStateEx
InternetGoOnlineA
InternetFortezzaCommand
IsHostInProxyBypassList
user32
GetCursor
ShowScrollBar
RegisterClassExA
LoadAcceleratorsA
EnumDisplayDevicesW
GetClassWord
SetDebugErrorLevel
DestroyWindow
CallNextHookEx
OpenInputDesktop
IsCharAlphaNumericA
MessageBoxW
GetClipCursor
CreateWindowExA
ShowWindow
InSendMessageEx
DefWindowProcW
GetMessagePos
DrawFocusRect
SetMessageQueue
RegisterClassA
SetProcessWindowStation
comctl32
InitCommonControlsEx
ImageList_SetDragCursorImage
ImageList_Read
CreateStatusWindowW
gdi32
CopyEnhMetaFileA
RemoveFontResourceW
DeviceCapabilitiesExW
GetPolyFillMode
GetWinMetaFileBits
SetPaletteEntries
kernel32
HeapCreate
GetCurrentProcess
LCMapStringW
ExpandEnvironmentStringsA
EnumSystemLocalesA
CreateMailslotW
GetConsoleOutputCP
GetStringTypeA
TlsFree
TlsGetValue
ExitProcess
GetTickCount
QueryPerformanceCounter
GetProcessShutdownParameters
HeapDestroy
SetFilePointer
CloseHandle
LoadLibraryA
GetLocaleInfoW
GetStartupInfoA
HeapFree
CreateMutexA
GetCurrentProcessId
GetConsoleCP
GlobalReAlloc
SetUnhandledExceptionFilter
DeleteCriticalSection
SetEnvironmentVariableA
TlsAlloc
HeapSize
VirtualQuery
GetProcAddress
LeaveCriticalSection
LCMapStringA
GetEnvironmentStrings
GetOEMCP
HeapReAlloc
IsValidCodePage
InterlockedExchange
TlsSetValue
GetFileType
OpenMutexA
GetFileAttributesW
TerminateProcess
WriteConsoleW
CompareStringA
GetACP
SetHandleCount
GetCurrentThreadId
WriteFile
GetConsoleMode
IsDebuggerPresent
GetLocaleInfoA
GetSystemInfo
VirtualFree
GetModuleHandleA
WriteConsoleA
IsValidLocale
FindAtomA
ReadFile
FlushFileBuffers
FreeEnvironmentStringsW
SetStdHandle
WideCharToMultiByte
InterlockedDecrement
FreeEnvironmentStringsA
SetLastError
FlushInstructionCache
GetTimeFormatA
FreeLibrary
SetConsoleCtrlHandler
UnhandledExceptionFilter
GetCommandLineA
GetLastError
MultiByteToWideChar
CreateFileA
GetStdHandle
CompareStringW
GetSystemTimeAsFileTime
GetProcessHeap
GetCurrentThread
GetTimeZoneInformation
Sleep
EnterCriticalSection
GetFileAttributesA
GetStringTypeW
GetUserDefaultLCID
OpenSemaphoreA
CreateDirectoryExA
RtlUnwind
GetModuleFileNameA
InitializeCriticalSection
GetDateFormatA
InterlockedIncrement
VirtualAlloc
HeapAlloc
GetEnvironmentStringsW
GetVersionExA
GetCPInfo
advapi32
RegQueryMultipleValuesW
CryptDecrypt
RegSetValueExA
RegSaveKeyA
CryptEnumProvidersA
RegCloseKey
RegOpenKeyA
RegRestoreKeyW
CryptDestroyKey
RevertToSelf
CryptEncrypt
CryptSetProviderExA
RegQueryValueExA
LookupPrivilegeDisplayNameA
RegOpenKeyExA
CryptAcquireContextA
RegEnumKeyA
CryptContextAddRef
CryptGenKey
RegQueryInfoKeyA
RegCreateKeyA
Sections
.text Size: 188KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 140KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 104KB - Virtual size: 131KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ