Static task
static1
Behavioral task
behavioral1
Sample
5b44c54271bf9c7788cab1d1dc8781dd.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5b44c54271bf9c7788cab1d1dc8781dd.exe
Resource
win10v2004-20231215-en
General
-
Target
5b44c54271bf9c7788cab1d1dc8781dd
-
Size
358KB
-
MD5
5b44c54271bf9c7788cab1d1dc8781dd
-
SHA1
88646c4544dc3b3dde2b9a00ff2ab93152c7d1a0
-
SHA256
8108403b0231e72b1299efb817e36408a45f0ad032ba84a1871f27a911c000c4
-
SHA512
e2180e52669e9926804d0719ac151337617ab1568382337d2d0a2aee451101ad4c3089e8ee5bdac5def3758e757e81f48e43e9ce4fa084f00c2159e05400916b
-
SSDEEP
6144:Jlrhoh/jkKYk1DEUccA5Oh8k+udvdCg64+5+vMuml5lUun3KGFxifqBwd:nrhoJjkK31IXcDUu+g64lvnml5i0Fxil
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b44c54271bf9c7788cab1d1dc8781dd
Files
-
5b44c54271bf9c7788cab1d1dc8781dd.exe windows:5 windows x86 arch:x86
21c35e7882821ce2d42343416306dc2b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
iphlpapi
_PfRemoveFiltersFromInterface@20
GetRTTAndHopCount
GetUdpTable
GetIcmpStatistics
InternalSetIpNetEntry
_PfGetInterfaceStatistics@16
InternalCreateIpForwardEntry
GetUdpStatistics
_PfTestPacket@20
GetTcpStatisticsEx
_PfRemoveGlobalFilterFromInterface@8
InternalDeleteIpNetEntry
Icmp6SendEcho2
_PfMakeLog@4
GetAdaptersInfo
_PfAddFiltersToInterface@24
NTTimeToNTPTime
SetTcpEntry
GetUniDirectionalAdapterInfo
NotifyAddrChange
GetAdapterIndex
_PfCreateInterface@24
InternalGetTcpTable
DeleteIpNetEntry
SetIpTTL
InternalGetIpAddrTable
_PfBindInterfaceToIPAddress@12
GetInterfaceInfo
IcmpSendEcho2
InternalDeleteIpForwardEntry
InternalGetIpForwardTable
_PfDeleteLog@0
Icmp6CreateFile
DeleteIpForwardEntry
kernel32
ShowConsoleCursor
Module32First
HeapSetInformation
IsBadStringPtrW
LCMapStringA
CreateWaitableTimerW
GetModuleHandleW
LoadLibraryA
ReplaceFileA
OpenFileMappingW
GetCPInfoExA
GetLocaleInfoA
GetSystemWindowsDirectoryW
VDMOperationStarted
CreateMailslotA
InterlockedFlushSList
FreeResource
GetPrivateProfileStructW
WritePrivateProfileStructA
GetLocalTime
GlobalFindAtomW
lstrcpyn
IsProcessInJob
TlsAlloc
BuildCommDCBA
VirtualAlloc
EnumResourceNamesA
QueryPerformanceCounter
GetStartupInfoW
WaitForDebugEvent
OpenWaitableTimerA
CreateWaitableTimerA
lstrcpyW
dsauth
DhcpDsValidateService
StoreEndSearch
StoreSearchGetNext
StoreCollectAttributes
DhcpDsAddServer
StoreDeleteObject
StoreCleanupHandle
StoreSetSearchSubTree
DhcpDsCleanupDS
DhcpDsDelServer
DhcpDsGetAttribs
DhcpDsSetLists
StoreCreateObjectVA
DhcpDsGetLists
StoreBeginSearch
DhcpEnumServersDS
StoreGetHandle
DhcpDsEnumServers
StoreInitHandle
DhcpAddServerDS
DhcpDeleteServerDS
StoreSetSearchOneLevel
DhcpDsGetRoot
DhcpDsInitDS
ole32
OleRegEnumVerbs
HMENU_UserUnmarshal
OleUninitialize
CoMarshalInterThreadInterfaceInStream
HICON_UserUnmarshal
ComPs_NdrDllGetClassObject
StgGetIFillLockBytesOnFile
ReadFmtUserTypeStg
HICON_UserSize
PropSysFreeString
HDC_UserMarshal
OleRegGetMiscStatus
OleIsRunning
HICON_UserFree
StgConvertVariantToProperty
ReadClassStm
CoGetDefaultContext
HPALETTE_UserFree
CoRegisterSurrogateEx
CoGetObject
CoGetClassVersion
StgCreateStorageEx
CLIPFORMAT_UserUnmarshal
CoTestCancel
OleRegEnumFormatEtc
CLSIDFromOle1Class
CLSIDFromProgID
ReadOleStg
DllGetClassObject
OleDoAutoConvert
CreateOleAdviseHolder
CLIPFORMAT_UserSize
GetConvertStg
OleSetClipboard
OleConvertOLESTREAMToIStorage
StringFromGUID2
OleLoadFromStream
CoTaskMemAlloc
HBITMAP_UserSize
CoRegisterClassObject
CoGetMarshalSizeMax
HPALETTE_UserUnmarshal
CoGetInstanceFromFile
query
?CiNtOpenNoThrow@@YGJAAPAXPBGKKK@Z
??0CTransaction@@QAE@XZ
?Lookup@CPropStoreInfo@@AAEIK@Z
?GetStr@CKey@@QBEPAGXZ
?QueryInterface@CDbProperties@@UAGJABU_GUID@@PAPAX@Z
?QueryInterface@CFwPropertyMapper@@UAGJABU_GUID@@PAPAX@Z
?SkipFloat@CMemDeSerStream@@UAEXXZ
?AddArg@CEventItem@@QAEXK@Z
?Commit@CRcovStrmAppendTrans@@QAEXXZ
??1CImpersonateSystem@@QAE@XZ
?IsValid@COccRestriction@@QBEHXZ
?GetPropInfo@CEmptyPropertyList@@QAEHPBGPAPAVCDbColId@@PAGPAI@Z
?NotifyWriteRead@CRequestClient@@QAEHPAX0K0KAAK@Z
??1CDbContentBaseRestriction@@QAE@XZ
?ReInit@CQueryUnknown@@QAEXKPAPAVCRowset@@@Z
?CIShutdown@@YGXXZ
?IsWriteProtected@CDriveInfo@@QAEHXZ
?QueryScopeAdmin@CScopeEnum@@QAEPAVCScopeAdmin@@XZ
?FastInit@CPropStoreManager@@QAEXPAVCiStorage@@@Z
?GetDouble@CMemDeSerStream@@UAENXZ
?AddArg@CEventItem@@QAEXPBG@Z
??0CDbColId@@QAE@ABU_GUID@@PBG@Z
?Setup@CPropStoreManager@@QAEXKKKKHK@Z
??0CDbSelectNode@@QAE@XZ
?FPSToPROPID@CPidConverter@@UAEJABVCFullPropSpec@@AAK@Z
?ciDelete@@YGXPAX@Z
?UnMarshall@CDbNumeric@@QAEHAAVPDeSerStream@@@Z
?Release@CEnumWorkid@@UAGKXZ
?Rewind@CMmStreamConsecBuf@@QAEXXZ
?AddCatalog@CMachineAdmin@@QAEXPBG0@Z
?MakePath@CFullPath@@QAEXPBG@Z
??1CScopeEnum@@QAE@XZ
?FormFullTree@CTextToTree@@QAEPAUtagDBCOMMANDTREE@@XZ
?MakePath@CFullPath@@QAEXPBGI@Z
BeginCacheTransaction
?GetPropertyInfo@CDbProperties@@UAGJKQBUtagDBPROPIDSET@@PAKPAPAUtagDBPROPINFOSET@@PAPAG@Z
??1CDbCmdTreeNode@@QAE@XZ
?BorrowBuffer@CPhysStorage@@QAEPAKKHH@Z
?EnumerateFilesInDir@CiStorage@@SGXPBGAAVCEnumString@@@Z
?AddArg@CFwEventItem@@QAEXK@Z
?SetFILETIME@CStorageVariant@@QAEXU_FILETIME@@I@Z
?GrowBuffer@CVirtualString@@AAEXK@Z
?AddRef@CEnumString@@UAGKXZ
esent
JetExternalRestore2
JetSnapshotStop
JetOpenFile
JetEscrowUpdate
JetCreateDatabaseWithStreaming
JetGetCurrentIndex
JetDefragment
JetCreateInstance
JetAttachDatabase
JetCommitTransaction
JetIdle
JetCreateDatabase
JetSetColumnDefaultValue
JetCloseDatabase@12
JetCreateInstance2
JetGetLS
JetMakeKey@20
JetGotoPosition
JetSetDatabaseSize
JetDupCursor
JetSetColumn
JetSetCurrentIndex3
JetGetDatabaseInfo
JetSetCurrentIndex4
JetTruncateLogInstance
JetEndSession
JetTerm2
JetCompact
mssip32
CryptSIPVerifyIndirectData
CryptSIPGetInfo
CryptSIPGetSignedDataMsg
CryptSIPRemoveSignedDataMsg
CryptSIPGetRegWorkingFlags
CryptSIPPutSignedDataMsg
CryptSIPCreateIndirectData
Sections
.text Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 151KB - Virtual size: 593KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ