Static task
static1
Behavioral task
behavioral1
Sample
a9b813bb2d22fa24b0384ae39007b5da.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a9b813bb2d22fa24b0384ae39007b5da.exe
Resource
win10v2004-20240226-en
General
-
Target
a9b813bb2d22fa24b0384ae39007b5da
-
Size
507KB
-
MD5
a9b813bb2d22fa24b0384ae39007b5da
-
SHA1
1673ffcf36fc27a6c7a47dc754c2d81259c6b847
-
SHA256
438d33fdcff781a04ee91648956dd18be8eb7b19932b20009764b05f7858e734
-
SHA512
5b010fc0d092e5c53f9501516a6f34022539c8c9fae0293a9cdc4f8f9bfeea4e811758e975e03bfff253df1163049530f8edf9b554bc435a6a37787312f66337
-
SSDEEP
6144:V25F/s1L5ThoU1o1d7F7x61w66lW9uZYFKhNh0wze5arzIxw8BujL37:V2f6W1d5N6aeAph05mzau
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a9b813bb2d22fa24b0384ae39007b5da
Files
-
a9b813bb2d22fa24b0384ae39007b5da.exe windows:5 windows x86 arch:x86
89b15414ffc63daedfcdec0d459846d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
ceil
wcscpy
wcsncmp
_controlfp
_except_handler3
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_itow
_snprintf
_wtol
_strnicmp
sscanf
wcstombs
sprintf
strchr
strncmp
atof
_ftol
isspace
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
malloc
free
wcscmp
_local_unwind2
swscanf
swprintf
wcsncat
wcschr
memmove
wcstok
atoi
wcsncpy
wcsstr
_wcsicmp
wcslen
_snwprintf
wcscat
_wcsupr
advapi32
RegSetValueExW
A_SHAInit
A_SHAUpdate
A_SHAFinal
LsaStorePrivateData
LsaRetrievePrivateData
LsaNtStatusToWinError
CryptGetUserKey
CryptGetKeyParam
CryptVerifySignatureW
CryptEncrypt
CryptDecrypt
CryptDestroyKey
MD5Final
MD5Update
MD5Init
I_ScSendTSMessage
RegSetKeySecurity
AddAccessAllowedAceEx
RegDeleteKeyW
RegOpenCurrentUser
CryptReleaseContext
CryptGetProvParam
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptSetHashParam
CryptCreateHash
CryptAcquireContextW
GetCurrentHwProfileW
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetFileSecurityA
CryptGenRandom
CryptDeriveKey
RegCloseKey
RegQueryValueExW
RegOpenKeyW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegOpenKeyExW
CreateProcessAsUserW
DuplicateTokenEx
CloseServiceHandle
ControlService
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
EqualSid
GetTokenInformation
CryptImportKey
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
CredFree
CredDeleteW
CredEnumerateW
CopySid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetUserNameW
OpenThreadToken
ReportEventW
RegisterEventSourceW
EnumServicesStatusW
ImpersonateLoggedOnUser
RegQueryValueExA
CheckTokenMembership
DeregisterEventSource
LsaGetUserName
RevertToSelf
LookupAccountSidW
IsValidSid
SetTokenInformation
LogonUserW
LookupAccountNameW
OpenProcessToken
SynchronizeWindows31FilesAndWindowsNTRegistry
QueryWindows31FilesMigration
AdjustTokenPrivileges
SystemFunction036
RegQueryInfoKeyA
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
QueryServiceConfigW
RegNotifyChangeKeyValue
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
AllocateLocallyUniqueId
CryptSignHashW
CryptSetProvParam
kernel32
CreateSemaphoreW
GetCurrentThread
WaitForSingleObjectEx
CreateThread
LoadResource
FindResourceW
SetThreadExecutionState
ResetEvent
GetComputerNameW
GetSystemDirectoryW
SetLastError
TransactNamedPipe
SetNamedPipeHandleState
GetTickCount
CreateFileW
GlobalGetAtomNameW
SetEnvironmentVariableW
VirtualLock
VirtualQuery
GetDriveTypeW
Beep
OpenMutexW
OpenEventW
LeaveCriticalSection
EnterCriticalSection
DisconnectNamedPipe
TerminateProcess
GetCurrentProcess
SearchPathW
lstrcatW
LocalReAlloc
ExpandEnvironmentStringsW
TerminateThread
ResumeThread
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
DeleteFileW
WriteProfileStringW
ReadFile
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
SetThreadPriority
SetPriorityClass
MoveFileExW
WaitForMultipleObjectsEx
GetExitCodeProcess
SleepEx
ReleaseSemaphore
FindClose
FindFirstFileW
GetWindowsDirectoryW
SetTimerQueueTimer
GetComputerNameA
VerifyVersionInfoW
VerSetConditionMask
WriteFile
WaitNamedPipeW
WaitForMultipleObjects
ConnectNamedPipe
DuplicateHandle
OpenProcess
GetOverlappedResult
GetVersionExA
lstrcmpW
UnregisterWait
CreateNamedPipeW
CreateRemoteThread
CreateActCtxW
GetModuleFileNameW
SetErrorMode
SetUnhandledExceptionFilter
GetPrivateProfileStringW
LocalSize
VirtualAlloc
FreeLibrary
GetEnvironmentVariableW
DebugBreak
CreateFileA
InitializeCriticalSection
ProcessIdToSessionId
SetInformationJobObject
AssignProcessToJobObject
TerminateJobObject
PostQueuedCompletionStatus
PulseEvent
GetQueuedCompletionStatus
CreateIoCompletionPort
CreateJobObjectW
ActivateActCtx
DeactivateActCtx
InterlockedCompareExchange
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
LoadLibraryW
InterlockedExchange
GetProcAddress
DelayLoadFailureHook
GetModuleHandleW
GetProfileStringW
GetShortPathNameW
lstrcpynW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetUserDefaultLCID
GetTimeFormatW
WTSGetActiveConsoleSessionId
GetCurrentProcessId
GetCurrentThreadId
GetVersionExW
FormatMessageW
lstrcmpiW
GetProfileIntW
lstrcpyW
BaseInitAppcompatCacheSupport
SetFilePointer
GetFileSize
lstrcmpiA
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
lstrcpynA
GetSystemDefaultUILanguage
HeapFree
LoadLibraryExW
GetProcessHeap
HeapAlloc
GetSystemTime
SystemTimeToFileTime
WideCharToMultiByte
GetACP
MultiByteToWideChar
lstrcpyA
lstrlenA
RegisterWaitForSingleObject
WaitForSingleObject
CreateProcessW
SetWaitableTimer
ReleaseMutex
SetEvent
UnregisterWaitEx
CloseHandle
GlobalAlloc
GlobalFree
GetLastError
LocalFree
lstrlenW
Sleep
GetSystemDirectoryA
SizeofResource
LockResource
FindResourceExW
CreateMutexA
GlobalMemoryStatus
GetVolumeInformationW
GetDriveTypeA
GetLogicalDriveStringsA
lstrcmpA
lstrcatA
GetSystemInfo
GetExitCodeThread
SetThreadAffinityMask
GetProcessAffinityMask
LocalAlloc
CreateEventW
CreateWaitableTimerW
VirtualQueryEx
OpenProfileUserMapping
CloseProfileUserMapping
BaseCleanupAppcompatCacheSupport
CreateMutexW
QueueUserWorkItem
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
CreateSemaphoreA
CreateEventA
ExitProcess
VirtualFree
VirtualProtect
FlushInstructionCache
GetSystemTimeAsFileTime
gdi32
RemoveFontResourceW
AddFontResourceW
user32
SetProcessWindowStation
DispatchMessageW
PeekMessageW
GetSystemMetrics
wsprintfA
GetWindowRect
MsgWaitForMultipleObjects
PostQuitMessage
SendNotifyMessageW
MessageBoxW
FindWindowW
DefWindowProcW
RegisterClassW
RegisterWindowMessageW
TranslateMessage
GetMessageW
CreateWindowExW
SetThreadDesktop
RegisterDeviceNotificationW
CloseDesktop
GetUserObjectInformationW
OpenInputDesktop
RegisterHotKey
UnregisterHotKey
ReplyMessage
SetTimer
GetMessageTime
KillTimer
CreateDesktopW
SetUserObjectSecurity
PostThreadMessageW
GetAsyncKeyState
SetUserObjectInformationW
SetWindowPlacement
DeleteMenu
GetSystemMenu
GetWindowPlacement
DialogBoxParamW
CallNextHookEx
GetWindowTextW
EnumWindows
SetFocus
wsprintfW
SetDlgItemTextW
SetCursor
LoadCursorW
CheckDlgButton
IsDlgButtonChecked
CloseWindowStation
CreateWindowStationW
OpenDesktopW
SwitchDesktop
SetWindowTextW
LoadStringW
SetWindowLongW
EndDialog
GetDlgItemTextW
GetWindowLongW
DestroyWindow
SetForegroundWindow
GetDesktopWindow
GetParent
GetKeyState
LoadImageW
SetLastErrorEx
wvsprintfW
DialogBoxIndirectParamW
UpdatePerUserSystemParameters
SetWindowStationUser
MBToWCSEx
LockWindowStation
UnlockWindowStation
SetLogonNotifyWindow
LoadLocalFonts
RecordShutdownReason
RegisterLogonProcess
ShowWindow
CreateDialogParamW
SendMessageW
GetDlgItem
SystemParametersInfoW
EnumDisplayMonitors
ExitWindowsEx
PostMessageW
UpdateWindow
SetWindowPos
SetWindowsHookW
UnhookWindowsHook
rpcrt4
RpcGetAuthorizationContextForClient
RpcFreeAuthorizationContext
RpcRevertToSelf
RpcImpersonateClient
UuidCreate
RpcServerRegisterIfEx
RpcServerUseProtseqEpW
RpcServerListen
RpcServerRegisterIf
I_RpcMapWin32Status
NdrServerCall2
ntdll
NtReplyWaitReceivePort
NtAcceptConnectPort
NtCreatePort
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
NtLockProductActivationKeys
RtlTimeToTimeFields
NtUnmapViewOfSection
NtMapViewOfSection
NtOpenSection
NtCompleteConnectPort
NtReplyPort
RtlOpenCurrentUser
NtClose
NtQueryValueKey
NtOpenKey
RtlInitUnicodeString
RtlSetEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlCompareUnicodeString
NtQuerySecurityObject
RtlQueryInformationAcl
RtlGetAce
NtOpenEvent
NtQueryInformationJobObject
NtFilterToken
DbgPrint
NtInitiatePowerAction
RtlInitString
RtlSetProcessIsCritical
RtlSetThreadIsCritical
RtlCheckProcessParameters
DbgBreakPoint
NtQueryInformationProcess
RtlUnhandledExceptionFilter
NtOpenProcessToken
NtOpenThreadToken
NtPrivilegeCheck
NtPrivilegeObjectAuditAlarm
NtQuerySystemTime
RtlTimeToSecondsSince1980
NtCreateKey
NtSetValueKey
RtlRegisterWait
NtOpenDirectoryObject
NtQuerySystemInformation
RtlDosPathNameToNtPathName_U
NtCreatePagingFile
NtCreateEvent
NtSetInformationProcess
RtlNtStatusToDosError
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlEqualSid
NtDuplicateObject
NtDuplicateToken
NtSetInformationThread
RtlLengthSid
RtlCopySid
RtlGetDaclSecurityDescriptor
NtAllocateLocallyUniqueId
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlAllocateHeap
NtPowerInformation
NtSetSystemPowerState
NtRaiseHardError
RtlDeleteCriticalSection
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryVolumeInformationFile
NtSetSecurityObject
RtlAdjustPrivilege
NtOpenFile
NtFsControlFile
RtlAllocateAndInitializeSid
RtlDestroyEnvironment
RtlFreeHeap
NtQueryInformationToken
NtShutdownSystem
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlInitializeCriticalSection
RtlCreateEnvironment
userenv
ord140
UnregisterGPNotification
DestroyEnvironmentBlock
CreateEnvironmentBlock
RegisterGPNotification
GetUserProfileDirectoryW
ord130
LoadUserProfileW
UnloadUserProfile
ord152
ord150
ord131
WaitForMachinePolicyForegroundProcessing
ord118
WaitForUserPolicyForegroundProcessing
ord117
ord151
GetAllUsersProfileDirectoryW
nddeapi
ord611
ord612
ord613
ord603
crypt32
CertComparePublicKeyInfo
CryptExportPublicKeyInfo
CertFindExtension
CertFreeCertificateContext
CertSetCertificateContextProperty
CertCreateCertificateContext
CryptVerifyMessageSignature
CryptImportPublicKeyInfo
CryptSignMessage
CertCloseStore
CryptDecryptMessage
CertGetCertificateContextProperty
CertAddCertificateContextToStore
CertOpenStore
CertVerifySubjectCertificateContext
CertGetIssuerCertificateFromStore
CertDuplicateCertificateContext
CryptImportPublicKeyInfoEx
CertEnumCertificatesInStore
secur32
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
GetUserNameExW
LsaRegisterLogonProcess
winsta
WinStationQueryLogonCredentialsW
WinStationIsHelpAssistantSession
_WinStationNotifyDisconnectPipe
WinStationAutoReconnect
_WinStationWaitForConnect
_WinStationNotifyLogoff
_WinStationNotifyLogon
WinStationCheckLoopBack
WinStationShutdownSystem
WinStationSetInformationW
WinStationConnectW
WinStationReset
WinStationQueryInformationW
WinStationGetMachinePolicy
WinStationEnumerate_IndexedW
_WinStationFUSCanRemoteUserDisconnect
WinStationNameFromLogonIdW
_WinStationCallback
WinStationDisconnect
profmap
RemapAndMoveUserW
InitializeProfileMappingApi
regapi
RegUserConfigQuery
RegDefaultUserConfigQueryW
ws2_32
WSAStartup
WSACleanup
getaddrinfo
authz
AuthziInitializeAuditEventType
AuthziInitializeAuditParams
AuthziInitializeAuditEvent
AuthziFreeAuditEventType
AuthzAccessCheck
AuthzFreeHandle
AuthzInitializeResourceManager
AuthzFreeResourceManager
AuthziLogAuditEvent
AuthzFreeAuditEvent
psapi
EnumProcessModules
GetModuleBaseNameW
EnumProcesses
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
setupapi
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
Sections
.text Size: 456KB - Virtual size: 455KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE