Static task
static1
Behavioral task
behavioral1
Sample
9b262d1270559bb00a5cff6d629da418.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9b262d1270559bb00a5cff6d629da418.exe
Resource
win10v2004-20231222-en
General
-
Target
9b262d1270559bb00a5cff6d629da418
-
Size
63KB
-
MD5
9b262d1270559bb00a5cff6d629da418
-
SHA1
8f44418a81b40edb862e2ec19acaa69774d4dbfc
-
SHA256
7578fa2522405ccb99cb9248cd0553cb97cd4b4cecd16f5a3569878092984380
-
SHA512
ac07d8a858c4af7a0f85c653cecc0a8deb8b7913f5d315a4c45bf43880910f1967f96fe98f1de52836ce8ed26e6edb423eac3523c9d571e29630b0d15954a8f4
-
SSDEEP
768:IxPY4FJJZY9F8888A+ADhfE2FMCFLvaSy9kQYq+oQMXiLeYUwKrPrOzJNs:AVNcK+AdfE2FMCtvalbYq+oOUDrrOzj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b262d1270559bb00a5cff6d629da418
Files
-
9b262d1270559bb00a5cff6d629da418.exe windows:4 windows x86 arch:x86
8128e4c3e398ab4c4083211b37c9157e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetLengthSid
OpenProcessToken
CryptGenRandom
AllocateAndInitializeSid
InitiateSystemShutdownA
InitializeSecurityDescriptor
InitializeAcl
SetSecurityDescriptorDacl
AddAccessAllowedAce
CryptAcquireContextA
CryptReleaseContext
GetTokenInformation
msvcrt
strchr
sprintf
kernel32
GetUserDefaultUILanguage
GetProcessHeap
GetDriveTypeA
GetSystemTimeAsFileTime
CreateThread
RemoveDirectoryA
CreateProcessA
ExpandEnvironmentStringsA
CreateEventA
GetModuleFileNameA
GetSystemTime
GetCurrentThreadId
FreeLibrary
SetEvent
LeaveCriticalSection
GetCurrentProcessId
HeapFree
DeleteCriticalSection
GetThreadPriority
MoveFileExA
WriteFile
GetFileAttributesA
GetCommandLineA
GetDiskFreeSpaceA
ExitProcess
LocalFileTimeToFileTime
SetErrorMode
CopyFileA
SetFileAttributesA
GetProcAddress
SetFileTime
CreateEventW
CreateDirectoryA
QueryDosDeviceA
CloseHandle
OpenEventA
QueryPerformanceCounter
DosDateTimeToFileTime
WaitForMultipleObjects
SystemTimeToFileTime
GetExitCodeProcess
GetFileSize
SetEndOfFile
GetSystemDirectoryA
DeviceIoControl
CreateFileA
SetFilePointer
DeleteFileA
TerminateProcess
FindNextFileA
SetUnhandledExceptionFilter
SleepEx
LoadLibraryA
GetModuleHandleA
GetVersionExA
WaitForSingleObject
EnterCriticalSection
GetTickCount
GetCurrentDirectoryA
HeapAlloc
GetCurrentProcess
SetLastError
ReadFile
FindClose
Sleep
FindFirstFileA
MoveFileA
WideCharToMultiByte
user32
ShowWindow
SendDlgItemMessageA
SetParent
SendMessageA
LoadStringA
DialogBoxParamA
EndDialog
MessageBoxA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
ntdll
NtOpenProcessToken
NtAdjustPrivilegesToken
NtShutdownSystem
NtClose
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.etext Size: 47KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dzgamei Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cqlxhgy Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
iemanyp Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
htabnri Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
heeawux Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
etvlwoj Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
vegoxjl Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
mjscqsh Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ikerynq Size: - Virtual size: 892KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE