Q:\eqagyltnbiNcpd\hvtaokMp\BfacpbbwtXvl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7ef4c6700ac3bac7a63ff1b12ac2d626.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7ef4c6700ac3bac7a63ff1b12ac2d626.exe
Resource
win10v2004-20231222-en
General
-
Target
7ef4c6700ac3bac7a63ff1b12ac2d626
-
Size
114KB
-
MD5
7ef4c6700ac3bac7a63ff1b12ac2d626
-
SHA1
d361d019273d45288f58c19a8b9aa7f69eeef5f3
-
SHA256
dcad63a6c5421fea680645eb3a5f276aeab770bebf99b46d544d5ee160f5dbcc
-
SHA512
af373397a7eb08d582f268f6ec68a0ed5946470f219c7bae505ccd73dba6e4d3010ba23fc92a96f50ed0b25bc7db2f933aa9cdefa7a22193581d3f4c770e366a
-
SSDEEP
3072:mRvRNNRiHrAqMNiczIXSC2hdMW7Rqo/IvJwFmPbSc:MRCzXSpR/IvJwC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7ef4c6700ac3bac7a63ff1b12ac2d626
Files
-
7ef4c6700ac3bac7a63ff1b12ac2d626.exe windows:5 windows x86 arch:x86
0e2ea1900ca0495405c18504f4140577
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
msvcrt
_controlfp
__set_app_type
perror
__p__fmode
isupper
clock
__p__commode
setlocale
_amsg_exit
fputc
_initterm
_acmdln
gets
exit
_ismbblead
_XcptFilter
_exit
wcsncpy
srand
_cexit
__setusermatherr
sscanf
wcscmp
__getmainargs
strcoll
calloc
comctl32
ImageList_GetIconSize
InitCommonControlsEx
ImageList_Remove
kernel32
LocalLock
ExitProcess
EnumSystemLocalesA
GlobalSize
MoveFileA
EnterCriticalSection
GetModuleHandleW
CreateNamedPipeW
SleepEx
SetTimerQueueTimer
SetCurrentDirectoryW
TlsGetValue
CreateWaitableTimerA
UnlockFile
GetACP
GlobalMemoryStatus
EnumResourceNamesW
GetModuleFileNameW
GetModuleHandleA
FindClose
DuplicateHandle
OpenFileMappingW
shlwapi
PathRemoveBlanksW
ChrCmpIA
StrToInt64ExA
gdi32
EndPage
SelectClipRgn
SetWindowExtEx
SelectObject
GetBkMode
CreateRoundRectRgn
SetAbortProc
SetDIBits
GetDeviceCaps
RectInRegion
CreateDiscardableBitmap
DeleteObject
TextOutA
SetDIBColorTable
SetMapMode
EnumFontsW
GetROP2
GetTextCharsetInfo
user32
LoadImageA
SetWindowLongW
GetSysColorBrush
DefWindowProcA
ModifyMenuW
SetWindowRgn
CharToOemBuffA
IntersectRect
GetDC
ValidateRect
MonitorFromRect
PostMessageW
GetSystemMetrics
GetWindow
DrawFocusRect
SetDlgItemTextW
AppendMenuA
GetDoubleClickTime
UpdateWindow
ChildWindowFromPoint
SetForegroundWindow
FindWindowExW
GetDlgItem
DeferWindowPos
GetClassLongA
CopyRect
HideCaret
CharPrevW
SetClassLongW
LoadMenuA
GetMenuStringW
EqualRect
PostQuitMessage
CreateDialogParamA
IsDialogMessageW
GetMessageW
RegisterClassW
DrawTextA
CascadeWindows
IsChild
GetKeyNameTextW
Exports
Exports
?FormatArgumentExW@@YGPAGGPAKPAM~U
?IsNotWidthExA@@YGPAXPAFPAEH~U
?FreeMonitorA@@YGPAHPAFE~U
?CancelStateExA@@YGDMJD~U
?AddStringW@@YGMGHH~U
?ShowModuleExA@@YGPAME~U
?GeneratePointA@@YGHFGF_N~U
?RtlWindowInfo@@YGIJ~U
?GlobalStateOriginal@@YGDPADG~U
?ValidateConfigExA@@YGIGPAJ_NI~U
?AddState@@YGDPAN~U
?LoadExpressionOld@@YGKPAKKKM~U
?GetExpressionEx@@YG_NHG~U
?IsValidFullNameOriginal@@YGDPAJEPAJI~U
?LoadNameA@@YGG_N~U
?FreeWindowInfoNew@@YG_NM~U
?PutProcess@@YGXME~U
?GlobalFolderPathA@@YGGFFPADPAH~U
?IsNotWindowInfoA@@YGHEPAJI~U
?RtlTextEx@@YGJDM~U
?IsSectionOld@@YGXPAH~U
?InsertMainStructDlhSi@@YGKGH@Z
?CopySemaphoreW@@YG_NJF~U
?IsNotConfigOld@@YGPAKPAMPA_NPAE~U
?FormatMessageEx@@YGPAEPAJIKJ~U
?EnumFunctionOriginal@@YGIK_NGPAK~U
?SetTimeA@@YGXHJ~U
?DecrementMediaTypeExA@@YGXPA_NGEPA_N~U
?FormatDateW@@YGNE~U
?SendComponentW@@YGHJ~U
?CloseFolderW@@YGEEEPAG~U
?ModifyEventEx@@YGEFPAGPAG~U
?PointerOriginal@@YGIGPAM~U
?FreeFileExA@@YGFPAM~U
?InsertWindowInfoA@@YGEPAH~U
?GetModuleExW@@YGPAXPANE~U
?InvalidatePenNew@@YGXIE_N~U
?ModifyProjectExW@@YGPAXKIH~U
?IncrementMessageOld@@YGHF~U
?CloseFilePathW@@YGPAX_NJ~U
?RtlWindowEx@@YGPA_NK~U
?AddSystemEx@@YGKPAII~U
?FormatProfileNew@@YGPADPAFPAFPAM~U
?OnConfigExW@@YGXF~U
?IncrementHeaderOld@@YGHPAM~U
?LoadData@@YGNKD~U
?FormatValueOriginal@@YGPAXDPAK~U
?GenerateThreadW@@YGDJJ~U
?CloseProviderNew@@YGKDEMH~U
?DeleteClassOld@@YGMPAN_NFPAM~U
?LoadMutexEx@@YGKEKPAID~U
?PutScreenOld@@YGPAGPAJM~U
?FormatListItemEx@@YGPAJPAEJG~U
?IsAnchor@@YGMMDJ~U
?ValidateConfigOld@@YGHKIPAM~U
?OnOptionExA@@YGXH_NPAMH~U
?AddHeaderOld@@YGKK~U
?KillVersionOld@@YGPAHPAGPAFPAGI~U
?RtlMutexNew@@YGPAKPAIKI~U
?KillThreadEx@@YGGD~U
?CopyTaskEx@@YGPAKF~U
?IsPointEx@@YGHIGDPAK~U
?IsListItemExA@@YGPAXEPAHNF~U
?FormatWindowInfoNew@@YGPAEFNF~U
?LoadAnchorW@@YGJPAKI~U
?ModifyExpressionNew@@YGGG~U
?PutExpressionExW@@YGDJFH~U
?LoadName@@YGKH~U
?InsertWindowInfoW@@YGDE_N_N~U
?FormatVersionExW@@YGMPAEPAFPAFH~U
?EnumConfig@@YGXPAE~U
?ModifyFolderOriginal@@YGKGPA_NFJ~U
?CrtFunctionA@@YGXDEI~U
?FormatMonitorNew@@YGE_N~U
?ShowExpression@@YGPAKFPAGDPAK~U
?DecrementFolderExW@@YGPAJKMI~U
?AddThreadA@@YGXPAIMGPAJ~U
?GlobalEventExA@@YGPAJPAMPAD~U
?CloseProcessExW@@YGPA_NFHPAMI~U
?ValidateArgumentExA@@YGE_N~U
?CopyDateTimeNew@@YGPAKPAHPAG~U
?ModifyWindowOriginal@@YGII_N~U
?GenerateVersionOld@@YGJK~U
?CopyPenNew@@YGMPAIHPAJI~U
?FreeMutexOld@@YGPAGJ~U
?FreeMonitorExW@@YGPA_NFPAIPAHI~U
?ClosePointerEx@@YGFPAG~U
?SendPenOld@@YGPAXPAFD~U
?DeleteTimerExA@@YGKNJI~U
?SetRectOld@@YGGFPAF~U
?InsertFunctionOriginal@@YGPANNFD~U
?EnumCommandLineExA@@YGEPAJPAIF~U
?DecrementSystem@@YGPAGF~U
?InvalidateConfigEx@@YGNPAN~U
?IsValidSizeEx@@YGDPAHPAGG~U
?EnumModuleExW@@YGN_N~U
?Option@@YGXPAHD~U
?InsertObjectNew@@YGPADPAFPAJJE~U
?CloseMutantW@@YGXFDKPAE~U
?CopySemaphoreOld@@YGXPADPAJ~U
?InstallHeightEx@@YGHE~U
?CloseModuleW@@YGGKDEPAD~U
?KillFullNameExA@@YGPA_NPANKPAGI~U
?SendTimeExW@@YGXGK~U
?InstallProfileA@@YGKPAH~U
?IsValidNameExA@@YGPAEI~U
?FindDataNew@@YGNKPAEFM~U
?ValidateFolderA@@YGDEPAMDPAF~U
?FindScreenEx@@YGXIPAFPAD~U
?HideStateOriginal@@YGHH~U
?EnumText@@YGHNGHPAE~U
?LoadMonitorNew@@YGXG~U
?IsValidHeightEx@@YGPAGPAK~U
?SetSystemEx@@YGXPAJPANFF~U
?CrtWidth@@YGJJ~U
?RemoveFunctionW@@YGXGNIJ~U
?CloseOptionOld@@YGPAFPAHPAGPAHPAJ~U
?InstallDate@@YGGPAK~U
?CallTimeNew@@YGPAKKGFPAJ~U
?AddDirectoryExA@@YGPAEEJ~U
?RemoveNameNew@@YGJE~U
?ModifySemaphoreA@@YGJPAKH~U
?FreeWindowInfoOld@@YGXPAJ~U
?LoadWindowInfoOld@@YGHD~U
?ValidateTaskEx@@YGGEF~U
?CopyClassA@@YGIMK~U
?SetObjectExA@@YGKPAJPAID~U
?RtlTaskA@@YGHM~U
?IsNotOptionOriginal@@YGPAD_NI~U
?ShowStateOld@@YGDPA_NPAI~U
?DecrementHeightExW@@YGEHPAGD~U
?ShowExpressionNew@@YGPADJ~U
?RemoveArgumentOld@@YGPAEPANPAH~U
?InsertConfigOriginal@@YGPAFEJG~U
?DecrementSizeOld@@YGPAMEH~U
?GetFullNameExW@@YGPAXPADJ~U
?IsNotDataA@@YGIIJ~U
?CallStateEx@@YGPAKJ~U
?LoadWidthA@@YGPAXPANK~U
?KillObjectNew@@YGMIGPAID~U
?TimerA@@YGDPAJJM~U
?GlobalSemaphoreOld@@YGPAEM~U
?InsertHeightExW@@YGPAIJG~U
?FormatFullName@@YGKK~U
?CallModule@@YGXNPAFGPAG~U
?FormatTaskOld@@YGPAGDH~U
?InsertDataNew@@YGKPAKJF~U
?AddDialogExA@@YGFGPAF~U
?ModifyFolderPathExA@@YGXIN~U
?PointExA@@YGIMNM~U
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rimp Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdbg1 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.redt Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rit Size: 512B - Virtual size: 508B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdbg2 Size: 512B - Virtual size: 68B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rvar Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rpt Size: 512B - Virtual size: 448B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hdata Size: 512B - Virtual size: 268B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ping Size: - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 109KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ