Static task
static1
Behavioral task
behavioral1
Sample
aadrive32.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
aadrive32.exe
Resource
win10v2004-20231215-en
General
-
Target
6d50b80765be25fb693c82b1e1b64a0c
-
Size
43KB
-
MD5
6d50b80765be25fb693c82b1e1b64a0c
-
SHA1
af6da1db2bf97f33d03f8931f38677fa42a86a94
-
SHA256
29a01880e269ca6fc7d33d535ea9ee660f395253eb38d756e99f6452bb35ccc8
-
SHA512
a20a03f7d86dd3cd24dac928b74332c7e9ad3114e56eea7589cbd4cf8e4798d5b1e5ed22582e5129e518bb5d9657e90aca593c6ae52629bc5b12ce9dfbbc4a81
-
SSDEEP
768:40hNv6tOXbX5faZByW8BzhkCYMnGwj4Xpuwo6UlMwSYqpIhSltu58nc:4ENv6krXtaZwBdT4Zu9/lXh2tu58c
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/aadrive32.exe
Files
-
6d50b80765be25fb693c82b1e1b64a0c.7z
-
aadrive32.exe.exe windows:4 windows x86 arch:x86
441847b4ee650c7b0b843194c94fcbc8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
wnsprintfA
StrCatBuffA
StrCatBuffW
StrCpyNW
user32
LoadImageA
SetFocus
SetWindowLongA
ShowWindow
LoadBitmapA
SendDlgItemMessageA
GetSysColor
CallMsgFilterA
MessageBeep
WinHelpA
GetWindowRect
SendMessageW
LoadStringA
EnableWindow
GetParent
ReleaseDC
SetDlgItemTextA
SendMessageA
DialogBoxIndirectParamA
GetDlgItemTextA
SetCursor
CreateWindowExW
DialogBoxParamA
GetWindowLongA
EndDialog
LoadCursorA
GetDlgItem
DialogBoxIndirectParamW
GetDC
shell32
ShellExecuteA
gdi32
GetTextExtentPointW
DeleteObject
SelectObject
GetTextMetricsW
GetTextMetricsA
GetTextExtentPointA
wintrust
WintrustAddActionID
WTHelperCertIsSelfSigned
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WintrustRemoveActionID
WinVerifyTrust
kernel32
UnhandledExceptionFilter
lstrlenW
lstrlenA
CompareFileTime
HeapFree
InterlockedCompareExchange
TerminateProcess
SetUnhandledExceptionFilter
GetDateFormatA
GetTickCount
EnterCriticalSection
FileTimeToSystemTime
GetCurrentThreadId
InitializeCriticalSection
SetProcessWorkingSetSize
ExitProcess
VirtualAlloc
GetCurrentProcessId
LeaveCriticalSection
HeapReAlloc
WinExec
GetCurrentProcess
GetCommandLineA
GetLastError
DeleteCriticalSection
HeapAlloc
lstrcmpiA
GetSystemTimeAsFileTime
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 664KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ