Static task
static1
Behavioral task
behavioral1
Sample
b3eaf2bb2900d50963b62c08784bc866.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b3eaf2bb2900d50963b62c08784bc866.exe
Resource
win10v2004-20240226-en
General
-
Target
b3eaf2bb2900d50963b62c08784bc866
-
Size
3.7MB
-
MD5
b3eaf2bb2900d50963b62c08784bc866
-
SHA1
24619b0d8dcaac0ff24bebe9df84e3577e9ba2c0
-
SHA256
57d6e263e3b7ce3a47ca50a6380501fec71db0d4b42d3792cc2979986ac17cf6
-
SHA512
771c52c6e0d3f8de10de53f4534ed2769792fb68226822f22e61f5af91dd50db5dd7a9ca2fa401d864a612a0a3616698a1b2689931a695858cfcf69a859846a4
-
SSDEEP
98304:7INdBHQumqEHKG7rv5G8OgaWG49ZAR/8NapNEkq:cHVYKGfxG87NGt2apmkq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b3eaf2bb2900d50963b62c08784bc866
Files
-
b3eaf2bb2900d50963b62c08784bc866.exe windows:4 windows x86 arch:x86
97cbc6095adb7610ca87eae9eb25584d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFree
MulDiv
GlobalUnlock
GlobalLock
ResumeThread
GlobalAlloc
FreeResource
WaitForSingleObject
ResetEvent
SetEvent
GetCurrentProcessId
CreateEventW
GetDiskFreeSpaceExW
SetFileTime
CreateDirectoryW
DosDateTimeToFileTime
GetCurrentDirectoryW
GetPrivateProfileIntW
GetVolumeInformationW
DeviceIoControl
GetCurrentProcess
CreateFileW
GetLastError
ReadFile
lstrcpynW
InterlockedDecrement
InterlockedIncrement
DeleteFileW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
lstrlenA
MultiByteToWideChar
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenW
WideCharToMultiByte
GetStartupInfoW
GetModuleHandleW
SystemTimeToFileTime
RaiseException
InterlockedExchange
TlsAlloc
TlsFree
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
IsBadReadPtr
IsBadWritePtr
TlsSetValue
lstrcmpiA
lstrcmpA
CreateThread
ExpandEnvironmentStringsW
SearchPathW
GetExitCodeProcess
WaitForMultipleObjects
LocalAlloc
LocalFree
GetSystemTimeAsFileTime
GetProcessTimes
GetSystemInfo
GetProcessHeap
HeapAlloc
HeapFree
SetErrorMode
LoadLibraryExW
GetFileTime
FileTimeToLocalFileTime
GetWindowsDirectoryW
GetShortPathNameW
VirtualQuery
OpenProcess
ExitProcess
TerminateProcess
SetProcessWorkingSetSize
GetTempPathW
GetTempFileNameW
GetSystemTime
CopyFileW
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
DuplicateHandle
GetFileType
SetFilePointer
FlushInstructionCache
LoadLibraryW
FindResourceW
SizeofResource
LoadResource
LockResource
SetFileAttributesW
GetTickCount
GetFileAttributesW
SetEndOfFile
WriteFile
OutputDebugStringW
DebugBreak
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
CreateMutexW
GetVersionExW
GetFileSize
GetModuleFileNameW
MoveFileW
LoadLibraryA
FreeLibrary
GetProcAddress
Sleep
CreateProcessW
CloseHandle
MoveFileExW
user32
CreateDialogParamW
PostMessageW
WaitForInputIdle
SetForegroundWindow
ShowWindow
LoadStringW
GetDesktopWindow
DefWindowProcW
MessageBoxW
BringWindowToTop
IsIconic
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DestroyWindow
wvsprintfW
CharNextW
RegisterClassExW
wsprintfW
LoadCursorW
GetClassInfoExW
SetWindowLongW
GetWindowLongW
CallWindowProcW
MapVirtualKeyW
GetKeyNameTextW
GetWindowThreadProcessId
SubtractRect
FindWindowExW
MonitorFromPoint
MonitorFromWindow
GetMonitorInfoW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
CreateWindowExW
EnableWindow
SetTimer
InvalidateRect
GetDlgItem
SetDlgItemTextW
SetWindowPos
KillTimer
CopyRect
GetUpdateRect
SetRect
ReleaseDC
GetWindowDC
LoadImageW
GetWindowTextLengthW
GetDlgCtrlID
ReleaseCapture
SetCapture
GetDC
GetCapture
ClientToScreen
PtInRect
UpdateWindow
OffsetRect
IsWindowEnabled
GetSysColor
FillRect
DrawEdge
GetSystemMetrics
InflateRect
DrawFocusRect
SetCursor
DrawTextW
SetWindowRgn
GetWindow
SystemParametersInfoW
GetParent
GetMenu
AdjustWindowRectEx
IsWindow
EndPaint
RedrawWindow
MapWindowPoints
BeginPaint
GetClientRect
SendMessageW
PostQuitMessage
SetWindowTextW
GetWindowTextW
GetWindowRect
FindWindowW
gdi32
SetViewportOrgEx
GetObjectW
CreateFontW
SetBkMode
SetTextColor
GetStockObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteDC
CreateRectRgn
CombineRgn
DeleteObject
CreateFontIndirectW
GetCurrentObject
CreateDIBSection
CreateSolidBrush
GetDeviceCaps
CreateDIBPatternBrushPt
GetBitmapBits
CreatePatternBrush
OffsetViewportOrgEx
BitBlt
advapi32
InitializeSecurityDescriptor
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyW
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
RegGetKeySecurity
RegOpenKeyExW
FreeSid
SetSecurityDescriptorDacl
RegCloseKey
AddAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumKeyW
RegQueryInfoKeyW
RegSetKeySecurity
CopySid
GetTokenInformation
RegQueryValueExW
RegEnumKeyExW
shell32
SHFreeNameMappings
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW
SHGetSpecialFolderPathW
SHFileOperationW
SHAppBarMessage
SHGetFileInfoW
SHGetSpecialFolderLocation
SHChangeNotify
ole32
CreateStreamOnHGlobal
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitializeEx
OleUninitialize
OleInitialize
CoSetProxyBlanket
olepro32
ord251
oleaut32
SysFreeString
SysAllocString
SysAllocStringLen
VariantClear
comctl32
ImageList_Remove
ImageList_SetImageCount
ImageList_Create
ImageList_Add
_TrackMouseEvent
ImageList_Draw
ImageList_GetIconSize
InitCommonControlsEx
ImageList_Duplicate
msimg32
AlphaBlend
wininet
HttpQueryInfoW
FindCloseUrlCache
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
CommitUrlCacheEntryW
CreateUrlCacheEntryW
GetUrlCacheEntryInfoW
InternetCrackUrlW
InternetSetOptionW
InternetQueryOptionW
FtpCommandW
InternetGetLastResponseInfoW
InternetWriteFile
FtpGetFileSize
HttpOpenRequestW
HttpSendRequestExW
FtpOpenFileW
HttpEndRequestW
InternetReadFile
InternetReadFileExA
InternetSetStatusCallbackW
InternetSetOptionA
InternetConnectW
psapi
GetModuleFileNameExW
GetProcessMemoryInfo
EnumProcessModules
EnumProcesses
GetModuleBaseNameW
shlwapi
SHDeleteKeyW
StrStrIW
StrCmpNIW
SHDeleteValueW
SHEnumKeyExW
PathRemoveFileSpecW
PathFindExtensionW
PathMatchSpecW
PathCombineW
PathIsRootW
StrToIntExW
SHGetValueA
PathGetDriveNumberW
StrCatW
PathFileExistsW
PathAppendW
PathIsDirectoryW
SHGetValueW
SHSetValueW
PathIsURLW
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
wintrust
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminAcquireContext
urlmon
ObtainUserAgentString
msvcp60
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
msvcrt
isprint
isspace
tolower
_wcmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_wtoi64
time
_ui64tow
_wtol
_except_handler3
_vsnprintf
_vsnwprintf
strncat
_strlwr
wcspbrk
_ismbslead
towupper
towlower
iswspace
swprintf
rewind
fgets
_strnicmp
fprintf
abs
free
fwrite
_EH_prolog
__CxxFrameHandler
wcschr
_wtoi
wcsstr
memmove
??2@YAPAXI@Z
_wcslwr
wcsncpy
wcsrchr
wcscmp
strlen
memcpy
memset
_wcsicmp
wcslen
malloc
_snprintf
_snwprintf
strtok
_controlfp
_beginthreadex
wcsncmp
wcstok
strcat
sprintf
_wfopen
fseek
ftell
fread
fclose
memcmp
pow
_purecall
_ftol
wcscat
gmtime
strcmp
calloc
strncpy
strcpy
realloc
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
iswdigit
swscanf
_ltow
wcscpy
_wcsnicmp
wcsncat
atoi
__set_app_type
netapi32
Netbios
comdlg32
GetSaveFileNameW
GetOpenFileNameW
Sections
.text Size: 196KB - Virtual size: 193KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22.3MB - Virtual size: 22.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ