Behavioral task
behavioral1
Sample
89c1ae90f0015f289e992fd8079f647f.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
89c1ae90f0015f289e992fd8079f647f.exe
Resource
win10v2004-20231215-en
General
-
Target
89c1ae90f0015f289e992fd8079f647f
-
Size
1.3MB
-
MD5
89c1ae90f0015f289e992fd8079f647f
-
SHA1
9fabb2c72e791783b17676ab70adadb36f01730b
-
SHA256
42b93806d66231b6d2f4cd38d76da641366ce714612a3dc3d44bb11fe8647409
-
SHA512
7a071ded01af076351e9cf1d1a5afeabd68cbaabd910d6cd890c3d2349de85937fe2f5bbab6cd5075defdc62a3aaeb720e59a54dbae373c381eb4a62f02dfc46
-
SSDEEP
12288:Pb+pAF+NbAOeeeZeeeeEhMEr6CX4zistYpXO:T+pAFaAuaE6tirXO
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 89c1ae90f0015f289e992fd8079f647f
Files
-
89c1ae90f0015f289e992fd8079f647f.exe windows:4 windows x86 arch:x86
017b8124651dd7e155c6503eadcd5940
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
LocalFree
WideCharToMultiByte
lstrlenA
GetLastError
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetCurrentThreadId
GetCommandLineA
InterlockedIncrement
GetModuleFileNameA
SetCurrentDirectoryA
GetTempPathA
GetFullPathNameA
MultiByteToWideChar
GetLocalTime
FreeResource
FindResourceA
LoadResource
LockResource
SizeofResource
Sleep
InterlockedDecrement
GetStartupInfoA
advapi32
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
comctl32
_TrackMouseEvent
gdi32
DeleteDC
CreateFontA
CreateCompatibleDC
CreateDIBSection
SetBkMode
CreateSolidBrush
SelectObject
SetTextColor
ExtCreateRegion
GetStockObject
StretchDIBits
SetBkColor
ExtTextOutA
DeleteObject
msvcrt
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
_beginthreadex
_endthreadex
wcslen
time
wcscmp
sprintf
_ftol
strchr
fputc
fprintf
fputs
sscanf
memchr
tolower
_CxxThrowException
realloc
malloc
free
atoi
strstr
fwrite
fread
remove
fopen
fseek
ftell
fclose
rename
_purecall
??2@YAPAXI@Z
_vsnprintf
_except_handler3
__CxxFrameHandler
__setusermatherr
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_controlfp
ole32
OleInitialize
CoCreateInstance
CoInitialize
oleaut32
shell32
SHGetSpecialFolderPathA
ShellExecuteA
user32
SendMessageA
GetParent
MessageBoxA
KillTimer
RegisterClassA
LoadCursorA
SetForegroundWindow
DestroyWindow
DispatchMessageA
SetTimer
TranslateMessage
DefWindowProcA
SetCapture
IsWindowVisible
SetWindowLongA
ReleaseCapture
GetCapture
ShowWindow
GetWindowLongA
ReleaseDC
GetDC
EndPaint
BeginPaint
LoadIconA
PtInRect
GetWindowRect
PostQuitMessage
UnhookWindowsHookEx
SetWindowRgn
SetWindowsHookExA
InvalidateRect
DrawTextA
DialogBoxParamA
SetWindowPos
CopyRect
GetDesktopWindow
GetClientRect
RedrawWindow
FlashWindow
GetSystemMetrics
CallNextHookEx
FindWindowExA
CreateWindowExA
GetDlgItem
GetDlgItemTextA
InflateRect
GetWindowDC
OffsetRect
GetWindowTextA
SetActiveWindow
EnableWindow
EndDialog
GetMessageA
winmm
timeGetTime
ws2_32
Sections
UPX0 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE