Static task
static1
Behavioral task
behavioral1
Sample
be8f9b8c050023af4307b818dd61fa48.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
be8f9b8c050023af4307b818dd61fa48.exe
Resource
win10v2004-20240226-en
General
-
Target
be8f9b8c050023af4307b818dd61fa48
-
Size
86KB
-
MD5
be8f9b8c050023af4307b818dd61fa48
-
SHA1
cdf80f4dd0b752315e7a079813d4b91aa681afc3
-
SHA256
9182b1308b26eae1a84aeb124d893654fb50ab6d68a1f65a7265c71af762b474
-
SHA512
d3857c69dea645447de818414fb0cae6e2a2b02e57552c83304903b85c3aa807fc82df111641640bc17374828b63481a1162d6f9591227c7a1bfa95b7cf131da
-
SSDEEP
1536:wIWJhWrHF+c+3qAAq1/L1I/Z/KnX/L9PjWlho1cpzXdaNBO6USiIFYWh2jDXCY:bWJ8rHF+c+3XAQLe/oRr4iciNBD2XCY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource be8f9b8c050023af4307b818dd61fa48
Files
-
be8f9b8c050023af4307b818dd61fa48.exe windows:5 windows x86 arch:x86
633a97ad6196800eb259e1c2d7bcc7d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateWaitableTimerA
GetConsoleOutputCP
GetCurrentProcessId
RemoveLocalAlternateComputerNameA
GetConsoleKeyboardLayoutNameW
SetCommState
CreateMailslotA
RequestDeviceWakeup
QueryPerformanceCounter
ReadDirectoryChangesW
GetConsoleAliasExesW
GetConsoleInputWaitHandle
Process32First
ReadConsoleA
FreeLibrary
GetStartupInfoA
HeapCreate
LocalHandle
GetCurrentThreadId
VirtualQuery
VirtualAlloc
GlobalFindAtomW
GetTickCount
GetSystemTimeAsFileTime
ConnectNamedPipe
LoadLibraryA
UnregisterConsoleIME
GetNextVDMCommand
EnterCriticalSection
RtlFillMemory
_lopen
samlib
SamiChangePasswordUser2
SamDeleteGroup
SamGetCompatibilityMode
SamCreateUser2InDomain
SamLookupIdsInDomain
SamQueryDisplayInformation
SamiEncryptPasswords
SamQueryInformationAlias
SamConnectWithCreds
SamRemoveMemberFromAlias
SamAddMemberToGroup
SamQueryInformationGroup
SamCreateGroupInDomain
SamTestPrivateFunctionsDomain
SamQueryInformationDomain
SamFreeMemory
SamTestPrivateFunctionsUser
adsldpc
LdapTypeToAdsTypeGeneralizedTime
AdsTypeToLdapTypeCopyDNWithBinary
ADsCloseSearchHandle
ADsDeleteAttributeDefinition
InitObjectInfo
ADsGetFirstRow
SchemaGetStringsFromStringTable
ADsDeleteDSObject
ADsAbandonSearch
LdapParsePageControl
BuildADsParentPathFromObjectInfo2
LdapModifyExtS
ADSIGetPreviousRow
ADSIModifyRdn
ADsGetPreviousRow
AllocADsMem
advapi32
ConvertSidToStringSidW
LsaEnumerateTrustedDomainsEx
LsaGetQuotasForAccount
AccessCheck
CredFree
RegisterTraceGuidsW
SystemFunction001
RegSetValueExA
I_ScGetCurrentGroupStateW
AdjustTokenPrivileges
BuildTrusteeWithNameA
GetAuditedPermissionsFromAclA
GetUserNameA
CryptDuplicateKey
AccessCheckByTypeResultListAndAuditAlarmByHandleW
CryptDuplicateHash
SystemFunction015
InitiateSystemShutdownExW
ureg
?Initialize@REGISTRY_VALUE_ENTRY@@QAEEPBVWSTRING@@KW4_REG_TYPE@@PBEK@Z
?DeleteKey@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@PBVWSTRING@@PAK@Z
?DoesValueExist@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PBVWSTRING@@11PAK@Z
?SaveKeyToFile@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@PBVWSTRING@@PAK@Z
?EnableRootNotification@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAXKE@Z
?QueryValues@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PBVWSTRING@@1PAVARRAY@@PAK@Z
??0REGISTRY_VALUE_ENTRY@@QAE@XZ
?IsAccessAllowed@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@KPAK@Z
??1REGISTRY@@UAE@XZ
?LoadHive@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@PBVWSTRING@@PAK@Z
?UnLoadHive@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@PAK@Z
?QueryKeyInfo@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PBVWSTRING@@1PAVREGISTRY_KEY_INFO@@PAK@Z
?RestoreKeyFromFile@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@PBVWSTRING@@EPAK@Z
?SetKeySecurity@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@KPAXPAKE@Z
?Initialize@REGISTRY_KEY_INFO@@QAEEPBVWSTRING@@0K0PAU_SECURITY_ATTRIBUTES@@@Z
?CreateKey@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@1PAKE@Z
?DeleteValueEntry@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@PBVWSTRING@@PAK@Z
??0REGISTRY@@QAE@XZ
?QuerySubKeysInfo@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PBVWSTRING@@1PAVARRAY@@PAK@Z
?Initialize@REGISTRY@@QAEEPBVWSTRING@@PAK@Z
??0REGISTRY_KEY_INFO@@QAE@XZ
?UpdateKeyInfo@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PAVREGISTRY_KEY_INFO@@PAK@Z
?DoesKeyExist@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PBVWSTRING@@1PAK@Z
?QueryKeySecurity@REGISTRY@@QAEEW4_PREDEFINED_KEY@@PBVREGISTRY_KEY_INFO@@KPAPAXPAK@Z
Sections
.text Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ