S:\YSkxolm\EIdrKGihwAzul\veDuGNgboYxJr\ulXBrUtl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7aa2238e7fd4a39faa6522d3a1cecde1.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7aa2238e7fd4a39faa6522d3a1cecde1.exe
Resource
win10v2004-20231215-en
General
-
Target
7aa2238e7fd4a39faa6522d3a1cecde1
-
Size
161KB
-
MD5
7aa2238e7fd4a39faa6522d3a1cecde1
-
SHA1
729e854b1584d0f7f9fb9e470f48a30989f9000a
-
SHA256
806819609db1b36474f33dfa8cf358d90da6691631353e15d71a27f00bef24a8
-
SHA512
73b90a01818e13927f40e7def64c9bbefca860bfdcdf1b4ad89aa25d79b5973a8635996d50429c0717270d957d4d91915525b217e3b07eb24c611b6c8ab711e4
-
SSDEEP
3072:i+txKUK/U9ml89KxrljTjHNDkF51ZUXoNSas:A88jHNDk51ZWY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7aa2238e7fd4a39faa6522d3a1cecde1
Files
-
7aa2238e7fd4a39faa6522d3a1cecde1.exe windows:5 windows x86 arch:x86
383004689bea2ab774d8d979884dfb8a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
comctl32
ImageList_ReplaceIcon
ImageList_Draw
ImageList_Write
user32
TileWindows
LoadAcceleratorsA
IsRectEmpty
AdjustWindowRectEx
LoadCursorA
SetMenu
DefWindowProcW
PostThreadMessageW
CopyRect
CharPrevW
PostMessageW
SetUserObjectInformationW
GetPropW
GetCursorPos
VkKeyScanW
DialogBoxParamW
SetSysColors
IsDialogMessageA
DefFrameProcA
GetMessageA
LoadIconW
GetClassLongA
IsCharUpperA
DefFrameProcW
MessageBoxA
SendMessageTimeoutA
GetWindowTextA
InvalidateRgn
DrawStateA
RegisterClassExW
MessageBoxW
MapVirtualKeyW
DeferWindowPos
SetParent
PostThreadMessageA
DefWindowProcA
DestroyCaret
ShowScrollBar
SendDlgItemMessageW
InsertMenuA
GetDlgItem
kernel32
SetSystemTime
SetCommBreak
WaitForSingleObject
lstrcmpA
HeapCreate
LoadLibraryW
FindCloseChangeNotification
SetHandleCount
GetTempFileNameW
lstrcatW
GetSystemDirectoryW
DisconnectNamedPipe
GetModuleFileNameW
GetLocalTime
FindFirstFileA
GetTickCount
ExitProcess
DeleteAtom
TerminateThread
LoadLibraryA
lstrcpynW
EnumResourceNamesW
msvcrt
strncmp
towlower
_controlfp
__set_app_type
__p__fmode
__p__commode
_amsg_exit
wcsrchr
isdigit
_initterm
_acmdln
exit
strpbrk
rand
_ismbblead
localtime
_XcptFilter
sprintf
_exit
_cexit
ungetc
__setusermatherr
srand
__getmainargs
fputs
floor
shlwapi
PathRemoveBlanksW
StrToInt64ExW
gdi32
CreatePen
CreateDIBitmap
GetTextMetricsA
GetTextAlign
SetLayout
EndPath
CreateSolidBrush
SetDIBits
GetPixel
SetDIBitsToDevice
SetBitmapBits
ScaleViewportExtEx
SetWindowExtEx
GetFontData
GetROP2
SelectPalette
GetCharWidth32W
EnumFontFamiliesW
Exports
Exports
?FreeDateOriginal@@YGPAMMPAMPAD&U
?PutMonitorExA@@YGHPANPAEPAH&U
?AddDeviceOriginal@@YGFK&U
?InsertWidthEx@@YGPAFE&U
?HideRectExW@@YGIM&U
?FreeDialogEx@@YGFPAKEHPAG&U
?GetListNew@@YGPAIMDMPAE&U
?ValidateProfileA@@YGJPAH&U
?RemoveVersionA@@YGDPADEPAF&U
?GetDateA@@YGIHFPAGPAF&U
?FreeTimerNew@@YGPAJ_NPAJPAD_N&U
?LoadKeyboardExA@@YGNE&U
?CharExW@@YGKK&U
?RemoveCharOriginal@@YGKPA_NPAM_NH&U
?IsNotThreadNew@@YGHPAK&U
?DeleteClassW@@YGPAHMJPAEE&U
?GenerateAppNameExW@@YGFPAGJHI&U
?CopyHeightEx@@YGEPAGPAKIPAE&U
?GeneratePointer@@YGIMPA_ND&U
?EnumHeightW@@YGPAKIE&U
?CopyWindowNew@@YGGED&U
?PutMemoryNew@@YGMPAH&U
?IncrementExpressionExA@@YGGN&U
?InvalidateProfileA@@YGXJ_NNPAF&U
?SetDateTime@@YGPAMNKMF&U
?CallFullNameExA@@YGEKKD&U
?IsValidProcessExA@@YGPAKKKNF&U
?IsNotAppNameA@@YGPAIHPAFNPAM&U
?FormatDateTimeNew@@YGPAXEJFH&U
?FormatProcessA@@YGEPAI&U
?LoadTaskA@@YGPA_NIFPAFJ&U
?InsertWidthOriginal@@YGHPADMMM&U
?DecrementObjectNew@@YGJI&U
?FindDateExA@@YGKHG&U
?CloseArgument@@YGGJPAJ&U
?DecrementScreenNew@@YGNPAGEID&U
?IsListItemEx@@YGIDPAJG&U
?CancelTimerNew@@YGPAXDPAKPAI&U
?FreeComponentW@@YGEPAEDNJ&U
?GetFolderPath@@YGGPAI&U
?CopyClassOld@@YGPANNPAD&U
?LoadHeightOld@@YGGMPAMPAJG&U
?FormatWidthA@@YGFIPA_NMH&U
?EnumObjectOld@@YGXDD&U
?CallMutantA@@YGF_N&U
?CopySizeW@@YGGPAN&U
?OnAnchorOriginal@@YGD_N&U
?CloseRectExA@@YGGIPAM&U
?FormatDateTimeOriginal@@YGDIJPAGE&U
?CloseMessageExW@@YGPAXKD&U
?KillDateTimeExW@@YGPAJPAH&U
?PutModuleA@@YGPAHPAM&U
?HideDialogExW@@YGPAGJ&U
?CopyAppName@@YGMHFPAIPAF&U
?LoadMutantExA@@YGJHHPAD&U
?InsertFullNameEx@@YGPAKJPAG&U
?RtlSize@@YGPAMH&U
?IsValidMutexEx@@YGPAMM&U
?DeleteWindowA@@YGXG&U
?RemoveObjectW@@YGPAKM&U
?FreeRectOriginal@@YGXPAEPAEI&U
?DecrementStringOriginal@@YG_NE&U
?InstallComponentNew@@YGGIPAJHJ&U
?ShowAnchorOld@@YGKDPAFPAJI&U
?InvalidateSystemNew@@YGXPADPAM&U
?CrtDirectoryExA@@YGIKIPAJF&U
?SendFolderOld@@YGMEMPAJH&U
?KillProviderOld@@YGFFDDM&U
?IncrementStringW@@YGHHPAGJPAD&U
?RtlAppName@@YGXGF&U
?DeleteHeaderNew@@YGJ_NPAD&U
?IncrementProcess@@YGGDFPAHF&U
?CopyComponentA@@YGPADPAMD&U
?IncrementFunctionExA@@YGKF&U
?CancelMessageNew@@YGHPAKM&U
?KillFolderPathExA@@YGPAJDG&U
?HideConfigA@@YGJIKD&U
?IsFolderExA@@YGXPAK&U
?CrtMessageExA@@YGH_NHGE&U
?DeleteSize@@YGM_NPAGPAD&U
?InstallMutexExA@@YGXKPAEPAEF&U
?IncrementValueOld@@YGENEG&U
?LoadListItemOriginal@@YGDEPAI&U
?DecrementString@@YGI_NMPAI&U
?ValidateWindow@@YGXIK&U
?InstallPathExA@@YGPAKKHPA_NPA_N&U
?CrtWindowInfoW@@YGXKJ&U
?GlobalHeightEx@@YGXIII&U
?KillSystemExA@@YGPAFPAGH&U
?ValidateDateTimeEx@@YGXDKPAE&U
?CancelHeaderExW@@YGPANPAF&U
?OnCharW@@YGMDFG&U
?InvalidateFilePathExW@@YGPA_NF&U
?ShowMonitorExW@@YG_NJ&U
?HeightExA@@YGPAMKPAEKK&U
?InstallMessageOld@@YGPAMKME&U
?EnumMutex@@YGDMMJPAM&U
?FindListA@@YGPANFPAJPA_NF&U
?ShowClassEx@@YGEKGPAG&U
?CloseHeaderOld@@YGEPAHPAMPAG&U
?EnumListItemNew@@YGJDDM&U
?CopyDateOld@@YGJE&U
?IsDirectoryA@@YGKI&U
?ModifyTaskExA@@YGPADJPAEM&U
?FindAppNameNew@@YGEPAE&U
?KillSizeOld@@YGPAFPAE&U
?HideStateNew@@YGKPAFJ&U
?ValidateTimeW@@YGXHKM&U
?SetTextA@@YGFPAD&U
?RtlProviderOld@@YGXPAK&U
?PutPointerEx@@YGXFEDPAF&U
?InvalidateKeyboardNew@@YGPAMKHK&U
?KillWindowInfoExW@@YGXPAJPAEPAFPAN&U
?IncrementOptionA@@YGDPAMPAJM_N&U
?FolderPathA@@YGMGH&U
?InstallDeviceNew@@YGIPAEIPAH&U
?GlobalHeaderOriginal@@YGXGPAG&U
?AddEggLogicDiuyhJD@@YGKPA_WKH@Z
?ValidateListEx@@YG_NPAKDPAIPA_N&U
?CrtTimerOld@@YGPAGPAMPAIPAIK&U
?RtlStringA@@YGDNPAGI&U
?CancelSemaphoreA@@YGPAXPAH&U
?CancelModuleOld@@YGHPAJPAHE&U
?IsRectEx@@YGNPAJJEH&U
?FreeModule@@YGD_NH&U
?FreeProcessEx@@YGHDHF&U
?IsFolder@@YGKI&U
?GlobalNameW@@YGXPAIH&U
?ShowWidthOriginal@@YGPAIPAEGH&U
?DecrementCommandLineA@@YGPAHPAIJG&U
?DeleteFolderExA@@YGPAKPAHG&U
?FreeListEx@@YGPAGEFF&U
?DeleteArgumentOriginal@@YGPAXHMJPAF&U
?CancelMutantOriginal@@YGDJ&U
?RemoveAnchorOriginal@@YGKHPANPAG&U
?ValidateWindowW@@YGDHPAIPAGM&U
?RemoveSizeExA@@YGHMFPAF&U
?DeleteMutexExW@@YGPAXK&U
?InsertSection@@YGKJ&U
?GenerateProfileW@@YGFDPAHPAD&U
?ModifyAppNameNew@@YGPAFPA_NFPAMG&U
?SetPathA@@YGXDPAIPAGF&U
?RemoveKeyNameOriginal@@YGHHPAE&U
?KillFolderOld@@YGMPA_NPANF&U
?InvalidatePathA@@YGIK&U
?FindStringEx@@YGEE_N&U
?RemoveDeviceNew@@YGINE&U
?DeleteSemaphoreW@@YGEE&U
?CopyMemoryExA@@YGGN&U
?SendConfigEx@@YGXKG&U
?IsNotValue@@YGFHHD&U
?LoadProfileEx@@YGPAGJ&U
?RemoveMediaTypeOld@@YGPAD_N&U
?CallStringExA@@YGMKPAJ&U
?IsNotTaskA@@YGHPADPAFK&U
?IsNotTaskNew@@YGPADKPAGPAED&U
Sections
.text Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.simp Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dbug Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.stit Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.set Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sdbg Size: 512B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dpt Size: 512B - Virtual size: 482B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wdata Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.raw Size: - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ