Static task
static1
Behavioral task
behavioral1
Sample
803f1762afdf7aa4101c5f811dc97032.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
803f1762afdf7aa4101c5f811dc97032.exe
Resource
win10v2004-20231215-en
General
-
Target
803f1762afdf7aa4101c5f811dc97032
-
Size
910KB
-
MD5
803f1762afdf7aa4101c5f811dc97032
-
SHA1
1927c68bf7425189a586a7edf84da87d76c84852
-
SHA256
108539424ea54be258a2b7dbd175445d05700d91f5526b0882cd0ada6cc92487
-
SHA512
9eba8a08f13f94a0bb23e71116f5fd0138fe737c1d21ca6fd9b41c7f53947fe632fec327cd0db823611d56fa4a208ae7e18852a8d21373a178186c2f42d64c1a
-
SSDEEP
6144:tFYnvmw4fTlJmytIjDnSNC2/6cy05llyf2UnN8uKFhAVsWopf0:tSvA/mDjGNC2iTIlov8uKF2+W3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 803f1762afdf7aa4101c5f811dc97032
Files
-
803f1762afdf7aa4101c5f811dc97032.exe windows:4 windows x86 arch:x86
3097ded9568dd074bece0d9642a34005
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
xpprt1
?prepareOpStack
?ehIsError
?ehSetContext
?setjmp
?exeNativeError
?exeStackUnwind
?momSOn
?symContextInit
__vft18ConUndefinedObject10AtomObject
?conNAllocL
?symPublicConst
?symRefItemConst
?momSOff
CURDRIVE
CURDIR
?getRFPC
?domAdd
SET
?conSendItem
?conAssignRefWMember
APPDESKTOP
ACREATE
?domAssign
SLEEP
?retNil
?conNRelease
?conNReleaseL
?frameExit
?ehUnwind
?nomClassLock
?nomClassUnlock
?retObject
?conNewNil
?conGetClass
?nomCreateClass
?nomDefineVar
?nomDefineMethod
?nomEndClassDefinition
?conNewExtObject
?nomCallInitClass
?conRelease
?passParameter
?conGetSelfClass
?conMemberToItem
?retStackItem
DBSELECTAREA
?retStackValue
DBGOTOP
?getRCFC
?domValXEql
DBCLOSEAREA
DBCLOSEALL
MSGBOX
EOF
?domNot
_QUIT
?setCWArea
?restWArea
DATE
DTOC
GETENV
UPPER
SUBSTR
?andShortCut
FILE
?domXEql
?domAnd
FSIZE
?domGCmp
ORDLISTCLEAR
ORDLISTADD
?pushCodeBlock
_EARLYBOUNDCODEBLOCK
DBCREATEINDEX
ALLTRIM
LEFT
DTOS
__vft20ConStringConstObject10AtomObject
DBSETFILTER
TRIM
SPACE
?domNEql
?orShortCut
?domOr
DBSKIP
INT
?domValEql
?conNewLogic
CHR
?symGetItemConst
OS
MEMORY
STR
DISKSPACE
SETAPPWINDOW
NATIONMSG
?domRefElem
?domAddEqu
?domGetElem
?domNegate
AEVAL
__vft14ConLogicObject10AtomObject
SETAPPFOCUS
APPEVENT
CTOD
VAL
LEN
PADR
DBSEEK
FOUND
?getRFCC
?domEql
?getWFPC
?domInc
REPLICATE
LTRIM
?domMul
?conNewString
?conNewCon
?conNNewNil
?domDiv
__vft19ConNumericIntObject10AtomObject
MONTH
YEAR
?domSub
EMPTY
DAY
?domDec
PADL
RECNO
?domGECmp
?domLECmp
DBGOTO
DBCLEARRELATION
ALIAS
DBSETRELATION
?getRFIC
?getRFCS
RIGHT
ARRAY
?domSubEqu
VALTYPE
?domSubStr
XBPBITMAP
XBPMETAFILE
GRAPATHBEGIN
GRABOX
GRAPATHEND
GRAPATHCLIP
SELECT
__vft21ConNumericFloatObject10AtomObject
AADD
RUNSHELL
DOW
?floadTos
STRZERO
?domValNEql
RTRIM
?domValGCmp
AT
__vft14ConStringShort10AtomObject
DBELOAD
ALERT
DBEBUILD
DBESETDEFAULT
DBEINFO
POSTAPPEVENT
CMONTH
EVAL
CDOW
STRTRAN
DBUSEAREA
NETERR
DBGOBOTTOM
THREAD
ASC
DBCOMMITALL
_iniExitProcedureList
___iniStart
___iniGetDLLInitHook
__This_executable_needs_version_1_90_0
___xpprt1Version
DLLLOAD
DLLCALL
DLLUNLOAD
XBPBASEDIALOG
XBPBASECRT
XBPBASECOMBOBOX
XBPBASELISTBOX
XBPBASEPUSHBUTTON
XBPBASESPINBUTTON
XBPBASEMENUBAR
XBPBASEMENU
XBPBASESLE
XBPBASEMLE
XBPBASETREEVIEW
XBPBASETREEVIEWITEM
XBPBASE3STATE
XBPBASETABPAGE
XBPBASESCROLLBAR
XBPBASECHECKBOX
XBPBASERADIOBUTTON
XBPBASESTATIC
XBPBASEPRESSPACE
SETMOUSE
ACLONE
BAND
?pushDynamicCodeBlock
ASCAN
SHELLLINKRESOLVE
FOPEN
FREADSTR
FCLOSE
PCOUNT
?domLCmp
GRAQUERYTEXTBOX
?conOpNewInt
L2BIN
CONVTOANSICP
SETAPPEVENT
BIN2L
?domMod
?domValLCmp
LOADRESOURCE
PROCNAME
THREADID
DOSERROR
ERRORBLOCK
ERROR
BREAK
WORKSPACELIST
?setSWArea
DBCOMMIT
?ehUnsetContext
?ehGetBreakContainer
DBRROLLBACK
DBSESSION
ISFUNCTION
?executeMacro
DOSERRORMESSAGE
APPTYPE
ROW
COL
SETPOS
_BREAK
ERRORLEVEL
ISMETHOD
PROCLINE
CONFIRMBOX
ROOTCRT
TONE
QOUT
OUTERR
APPNAME
TIME
VERSION
VAR2CHAR
QQOUT
MLCOUNT
MEMOLINE
Sections
.text Size: 661KB - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpp Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 121KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE