Static task
static1
Behavioral task
behavioral1
Sample
646dcb210c874a16950e60b2226952b1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
646dcb210c874a16950e60b2226952b1.exe
Resource
win10v2004-20231215-en
General
-
Target
646dcb210c874a16950e60b2226952b1
-
Size
440KB
-
MD5
646dcb210c874a16950e60b2226952b1
-
SHA1
46a9805532e84d3de864b7b54a31d4832d9693c3
-
SHA256
4daeef51c27cdef1d8a6835ece4cb67f62e910376045907f73a7eb6f9c54906b
-
SHA512
495f8528a483862fe9d4dda2750d21ec5ff4ded1b7ff761d413b37ed9622522b8f44357f60bcc0f301e2a1b1a4fd2cd1fe218145ecf7065f4f6445799e14e1b1
-
SSDEEP
12288:kCjpWiSBropozKYZBZzyy2RVQX/B+TrtGE:kCjpWiDY1Zi7Tr4E
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 646dcb210c874a16950e60b2226952b1
Files
-
646dcb210c874a16950e60b2226952b1.exe windows:4 windows x86 arch:x86
db1db4c2bc6a96703343b76709ee0226
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
shlwapi
PathStripToRootA
SHGetValueA
PathFileExistsA
PathRemoveExtensionA
PathFindExtensionA
PathFindFileNameA
PathIsUNCA
PathAppendA
advapi32
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegDeleteKeyA
SetSecurityDescriptorDacl
RegOpenKeyA
kernel32
GlobalGetAtomNameA
InterlockedIncrement
DeleteFileA
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
GetThreadLocale
DuplicateHandle
FindClose
FindFirstFileA
GetFullPathNameA
FindNextFileA
FileTimeToSystemTime
FileTimeToLocalFileTime
TlsGetValue
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
WritePrivateProfileStringA
GetCurrentDirectoryA
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
GetFileAttributesA
GlobalFindAtomA
RtlUnwind
HeapFree
HeapAlloc
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
GetProcessHeap
GetStartupInfoA
WriteConsoleW
GetFileType
GetStdHandle
ExitThread
CreateThread
HeapSize
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
GetConsoleCP
GetConsoleMode
Sleep
GetACP
SetHandleCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
DebugBreak
SetStdHandle
GetTimeZoneInformation
GetDriveTypeA
WriteConsoleA
GetConsoleOutputCP
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEnvironmentVariableA
lstrcmpW
InterlockedDecrement
GetModuleFileNameW
ReleaseSemaphore
CreateSemaphoreA
FreeResource
GetCurrentProcessId
GlobalAddAtomA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
lstrcmpA
GlobalDeleteAtom
GetModuleHandleA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
MulDiv
CreateEventA
SuspendThread
SetEvent
WaitForSingleObject
GetCurrentThreadId
ResumeThread
SetThreadPriority
RaiseException
LocalAlloc
SetFilePointer
WriteFile
ReadFile
LocalFree
GetCurrentProcess
SetPriorityClass
DeviceIoControl
ExitProcess
SetLastError
GetVolumeInformationA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FindResourceA
LoadResource
LockResource
SizeofResource
LoadLibraryA
GetProcAddress
GetVersionExA
FreeLibrary
lstrlenA
lstrcmpiA
CompareStringW
CompareStringA
GetVersion
WideCharToMultiByte
MultiByteToWideChar
InterlockedExchange
GetTempPathA
GetModuleFileNameA
CopyFileA
DosDateTimeToFileTime
LocalFileTimeToFileTime
CreateFileA
GetFileTime
CompareFileTime
SystemTimeToFileTime
SetFileTime
CloseHandle
GetLastError
GetSystemTimeAsFileTime
CreateDirectoryA
user32
UnregisterClassA
DestroyMenu
ShowWindow
SetWindowTextA
IsDialogMessageA
LoadIconA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetForegroundWindow
UpdateWindow
GetClientRect
GetMenu
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EndPaint
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
UnhookWindowsHookEx
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
MessageBoxA
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
GetMenuState
BeginPaint
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ClientToScreen
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
SendMessageA
GetKeyState
PeekMessageA
ValidateRect
wsprintfA
GetWindowThreadProcessId
GetParent
GetClassNameA
EnableWindow
RegisterWindowMessageA
GetWindowTextA
GetCursorPos
CharUpperA
LoadCursorA
GetDC
ReleaseDC
GetSysColorBrush
GetSystemMetrics
gdi32
SetTextColor
GetClipBox
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
ExtTextOutA
CreateBitmap
GetDeviceCaps
TextOutA
RectVisible
PtVisible
SetMapMode
RestoreDC
SaveDC
DeleteObject
GetObjectA
SetBkColor
Escape
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
DocumentPropertiesA
OpenPrinterA
ole32
CoGetMalloc
CoUninitialize
CoInitializeEx
CoCreateInstance
CoDisconnectObject
oleaut32
LoadTypeLi
VariantClear
SysFreeString
VariantCopy
VariantInit
VariantChangeType
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
Sections
.text Size: 332KB - Virtual size: 331KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 88KB - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 748B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ