Static task
static1
Behavioral task
behavioral1
Sample
b5e8dda4b5cddaf5b4f184f87f9bac2a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b5e8dda4b5cddaf5b4f184f87f9bac2a.exe
Resource
win10v2004-20240226-en
General
-
Target
b5e8dda4b5cddaf5b4f184f87f9bac2a
-
Size
122KB
-
MD5
b5e8dda4b5cddaf5b4f184f87f9bac2a
-
SHA1
32a4ddcf2736509488cac938ef6b9d0d31f4cee4
-
SHA256
30c78a2de1d0227c99aa4d06f973ad93505e2a79085407e77988daf68a82a478
-
SHA512
7b97b0a1fa8be95ff55769a36d1a3eab237c68b736c68d17481ba5f7053e0c0c7bcde2e8d111d8083cd6174530e0eaee7a0943c5f90270bef0a3f8139dd601cf
-
SSDEEP
3072:BCmddR1OA2M+FOCY2BROLiF/7uLoYutcBfA06tg0:BCIRcA2M+GMzSuatA0ex
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5e8dda4b5cddaf5b4f184f87f9bac2a
Files
-
b5e8dda4b5cddaf5b4f184f87f9bac2a.exe windows:5 windows x86 arch:x86
2bda5d4862cd6314a57f20bcc787f602
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
adsldpc
LdapGetDn
ADSIExecuteSearch
ChangeSeparator
LdapTypeToAdsTypeUTCTime
ADSICloseSearchHandle
LdapGetSubSchemaSubEntryPath
LdapAddExtS
AllocADsStr
LdapSearchST
ADSICreateDSObject
ADsDeleteDSObject
LdapOpenObject2
ADSIOpenDSObject
LdapOpenObject
ADsDeleteAttributeDefinition
GetDisplayName
ADSISetSearchPreference
?SetFSlashDisabler@CLexer@@QAEXH@Z
SchemaGetClassInfoByIndex
ADsDeleteClassDefinition
LdapTypeBinaryToString
ADsEnumAttributes
LdapCreatePageControl
ADSIGetColumn
LdapSearch
PathName
SchemaIsClassAContainer
ADsGetNextColumnName
winmm
midiOutGetDevCapsW
mci32Message
joy32Message
mmioStringToFOURCCW
waveInMessage
midiOutShortMsg
mmioDescend
DrvGetModuleHandle
waveOutSetVolume
mmioWrite
mixerMessage
mciGetErrorStringA
mmioSendMessage
mciDriverNotify
mixerGetID
joySetThreshold
midiStreamPosition
timeBeginPeriod
waveOutGetDevCapsW
midiInGetDevCapsA
mciFreeCommandResource
mixerGetLineInfoA
DriverCallback
midiOutPrepareHeader
mixerGetLineInfoW
mmsystemGetVersion
mmioRenameA
midiOutReset
mmioRenameW
OpenDriver
waveOutClose
midiOutGetID
midiInReset
mciGetDeviceIDFromElementIDA
midiInGetErrorTextA
kernel32
GetCPInfo
SetFirmwareEnvironmentVariableA
FindCloseChangeNotification
GetPrivateProfileStringW
FindFirstVolumeMountPointA
CompareFileTime
GlobalAlloc
GetThreadTimes
CreateTimerQueueTimer
lstrcat
GetModuleHandleA
SetVolumeMountPointW
EnumResourceTypesA
GetConsoleCommandHistoryW
GetConsoleHardwareState
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
HeapCreate
VerifyConsoleIoHandle
GetVersionExW
GetConsoleOutputCP
GetConsoleKeyboardLayoutNameA
BeginUpdateResourceA
IsBadHugeReadPtr
CallNamedPipeW
HeapUnlock
VirtualAlloc
Heap32ListNext
ZombifyActCtx
DeleteFiber
LZCreateFileW
lstrcmpA
GetSystemInfo
GetConsoleCommandHistoryA
MapViewOfFile
GetExpandedNameA
QueryInformationJobObject
Thread32First
LockResource
WritePrivateProfileSectionW
lstrcpy
SetSystemTime
GlobalUnfix
GetCurrencyFormatA
lstrlenW
lstrlenA
LoadLibraryA
SetLastError
ReadConsoleOutputAttribute
FindNextChangeNotification
VirtualFree
PeekConsoleInputW
lstrcmpi
DeactivateActCtx
SetFileShortNameW
QueueUserAPC
HeapValidate
GetACP
GetStartupInfoA
msvcrt
__p__acmdln
_wspawnlp
_abnormal_termination
_strupr
wcstoul
_strnset
_getwch
fsetpos
_local_unwind2
strcspn
__fpecode
_rotl
_finite
_mbsstr
__iob_func
swprintf
__CxxQueryExceptionSize
wctomb
__p__commode
_scprintf
log10
exit
__lc_handle
vfwprintf
_mktime64
__set_app_type
wcsftime
_wexecvp
Sections
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ