Static task
static1
Behavioral task
behavioral1
Sample
ae20581b1e6aae4419e8eef99bfaf673.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ae20581b1e6aae4419e8eef99bfaf673.exe
Resource
win10v2004-20240226-en
General
-
Target
ae20581b1e6aae4419e8eef99bfaf673
-
Size
4.5MB
-
MD5
ae20581b1e6aae4419e8eef99bfaf673
-
SHA1
9e2cefe2b3343672586a02e307d712501cb5bbfb
-
SHA256
41c9c17ba21a3e0d4aee4506afbfd8565e9ab9ea30b908f8c7c0ecc41ca9969b
-
SHA512
b1e003ee99ab795fc0793f4c53d6f8bafbd8268f5e19002a8b64a2f6fde17004cc3be8188242e7826125c587cf392f4b464e8387f8ec21b17763befbe59c9e80
-
SSDEEP
98304:cWvFRlq1pnUipfhmaRfHqQUReYNa1Htepe5hFXWRIVZ3dcU:/1qLn/DmaRfTU3Na1HE0bmRIGU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae20581b1e6aae4419e8eef99bfaf673
Files
-
ae20581b1e6aae4419e8eef99bfaf673.exe windows:5 windows x86 arch:x86
55f8e466e609e883100b05c6925e87a2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
UuidToStringW
RpcStringFreeW
shlwapi
PathFindFileNameW
StrCmpIW
SHDeleteKeyW
SHDeleteValueW
PathRemoveExtensionW
SHGetValueW
SHSetValueW
user32
CreateWindowExW
GetSystemMetrics
LoadIconW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowRect
PostQuitMessage
FindWindowExA
SendMessageW
DefWindowProcW
ShowWindow
MessageBoxW
MessageBoxIndirectW
GetWindowThreadProcessId
GetShellWindow
RegisterClassExW
LoadCursorW
PostMessageW
kernel32
GetConsoleCP
QueryPerformanceCounter
HeapCreate
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
IsProcessorFeaturePresent
HeapSize
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedIncrement
GetCPInfo
GetTimeZoneInformation
IsDebuggerPresent
VirtualFree
VirtualAlloc
GetFileSize
FindFirstFileW
SetFilePointer
VirtualQuery
GetCurrentProcess
GetCurrentThread
WriteFile
OpenProcess
WideCharToMultiByte
GetVersionExW
TerminateProcess
ReadFile
CreateFileW
MultiByteToWideChar
GetConsoleMode
SetLastError
FindClose
Process32FirstW
RemoveDirectoryW
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTickCount
GetTempPathW
CreateProcessW
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
GetModuleHandleA
FindResourceA
FreeResource
LoadResource
LoadLibraryW
SizeofResource
LockResource
ExitProcess
CreateMutexW
CreateDirectoryW
GetModuleHandleW
Sleep
CopyFileW
GetModuleFileNameW
FindResourceW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
MapViewOfFile
RaiseException
OpenEventA
OpenFileMappingA
LocalFree
InterlockedDecrement
GetVersion
MoveFileExW
GetCurrentThreadId
GetStringTypeW
RtlUnwind
HeapReAlloc
SetStdHandle
WriteConsoleW
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
LoadLibraryA
InterlockedExchange
FreeLibrary
GetLastError
SetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineA
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
LocalAlloc
advapi32
SetEntriesInAclW
SetSecurityInfo
AllocateAndInitializeSid
GetSecurityInfo
DuplicateTokenEx
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenThreadToken
OpenProcessToken
FreeSid
shell32
SHGetSpecialFolderPathW
SHChangeNotify
ShellExecuteW
ole32
CoCreateGuid
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
VariantClear
VariantInit
Sections
.text Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13.1MB - Virtual size: 13.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ