Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Malicious_Behavior.SB.29876.449.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Malicious_Behavior.SB.29876.449.dll
Resource
win10v2004-20231222-en
General
-
Target
SecuriteInfo.com.Malicious_Behavior.SB.29876.449.exe
-
Size
2.8MB
-
MD5
078137cfd2801c9951fa502c4bfb0b52
-
SHA1
e89d42c2ba431e4ccb83925b5baffc70cd858590
-
SHA256
a5a6c935c12a7ae2180647a4a521ba565f380fe89441f831a5dc0f45b037e83b
-
SHA512
56eda3107c0390a0df90a1e189730870a8375d19085191a98c1187988f6b0e019119262906f98949435d502ab785799f07375bb08446a1c8e87521bcc3b0c95d
-
SSDEEP
49152:2+EZh20Sbg3TyOXP8ZIHPujACspE16s7jJ7I:ql3TfPsACsA7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Malicious_Behavior.SB.29876.449.exe
Files
-
SecuriteInfo.com.Malicious_Behavior.SB.29876.449.exe.dll windows:6 windows x64 arch:x64
ecc51492b9a27d5c694af6ca9db4f917
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
winmm
timeGetTime
kernel32
FlsFree
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
SwitchToFiber
GetTickCount64
Sleep
MoveFileExA
DisableThreadLibraryCalls
CreateThread
FreeLibraryAndExitThread
GetModuleFileNameA
SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
SetConsoleMode
GetLastError
AllocConsole
ConvertThreadToFiber
CreateFiber
HeapFree
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
QueryPerformanceCounter
SizeofResource
FindResourceA
UnmapViewOfFile
CreateFileA
LockResource
CloseHandle
LoadResource
CreateFileMappingW
MapViewOfFile
FreeConsole
GetConsoleWindow
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
GetThreadContext
GetProcAddress
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
FormatMessageA
LocalFree
GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceFrequency
WaitForSingleObjectEx
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
SetEndOfFile
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OutputDebugStringW
RaiseException
GetACP
IsValidCodePage
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
SetStdHandle
DeleteFileW
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
ExitThread
GetModuleHandleExW
ExitProcess
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
user32
GetForegroundWindow
MessageBoxA
FindWindowA
GetAsyncKeyState
ShowWindow
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 847KB - Virtual size: 847KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 108KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 237KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ