Behavioral task
behavioral1
Sample
c6bddd1275e61c8f802e0a69685f3734.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c6bddd1275e61c8f802e0a69685f3734.exe
Resource
win10v2004-20240226-en
General
-
Target
c6bddd1275e61c8f802e0a69685f3734
-
Size
188KB
-
MD5
c6bddd1275e61c8f802e0a69685f3734
-
SHA1
434a24eb75ac380fc3f50fd9696400d6f4c01676
-
SHA256
cb76ff0d60a6582b6037cbf6ccfb364cbc6da83c82a295968156ebd8273e3a5e
-
SHA512
0f8ff2d1c51f0c81b8f771c9a476289ab044bc2b0ad6f58c40b70939999c55d454cfb4d8cf0b3142dd8640168c8e70e6eaae1a7bcbb0216b420f234a0829970f
-
SSDEEP
3072:9U9fyWzy5CPbqUa1uGwp7c5tgHms/5OxLlOjL6pBS1alN6666R1aTaAyj:9U9fHzHNaMGw08RROxLO6vS1alN6666v
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c6bddd1275e61c8f802e0a69685f3734
Files
-
c6bddd1275e61c8f802e0a69685f3734.exe windows:4 windows x86 arch:x86
93de6c9c3b5fa27c060629de38e76b4b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
GetModuleHandleA
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
GetModuleFileNameA
GetSystemInfo
GetVersionExA
HeapCreate
InitializeCriticalSection
GetLastError
CreateDirectoryA
GetFileAttributesA
GetWindowsDirectoryA
GetProcAddress
DeleteFileA
CopyFileA
GetCurrentThreadId
HeapDestroy
DeleteCriticalSection
GetLocalTime
MultiByteToWideChar
MoveFileExA
GetVersion
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
lstrlenW
WideCharToMultiByte
HeapValidate
LoadLibraryA
CreateMutexA
FreeLibrary
HeapReAlloc
Sleep
GetThreadLocale
GetStartupInfoA
ExitProcess
GetCommandLineA
DebugBreak
SetFilePointer
WriteFile
SetEndOfFile
GetFileSize
GetProcessHeap
HeapAlloc
ReadFile
HeapFree
lstrcpyA
lstrcpynA
CompareStringA
CreateFileA
GetFileTime
FileTimeToSystemTime
lstrcmpA
CloseHandle
lstrcatA
SystemTimeToFileTime
CompareFileTime
FindResourceA
SizeofResource
LoadResource
LockResource
lstrlenA
ReleaseMutex
RtlUnwind
advapi32
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
comctl32
gdi32
DeleteDC
GetObjectA
DeleteObject
BitBlt
CreateSolidBrush
CreateCompatibleDC
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
GetStockObject
ole32
CLSIDFromProgID
OleLockRunning
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
CoInitialize
OleInitialize
OleUninitialize
CoUninitialize
oleaut32
shell32
SHAppBarMessage
Shell_NotifyIconA
ExtractIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA
SHFileOperationA
urlmon
URLDownloadToCacheFileA
user32
GetClassInfoExA
SetWindowLongA
CreateWindowExA
DefWindowProcA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
CallWindowProcA
GetSysColor
SetFocus
IsChild
GetFocus
ReleaseDC
EndPaint
BeginPaint
RedrawWindow
GetClassNameA
CreateAcceleratorTableA
ReleaseCapture
SetCapture
InvalidateRgn
SetDlgItemTextA
CharUpperA
DialogBoxParamA
EndDialog
IsDlgButtonChecked
EnableWindow
GetDlgItemTextA
PostMessageA
LoadStringA
DestroyIcon
TrackPopupMenuEx
LoadCursorA
GetSubMenu
LoadMenuA
CheckDlgButton
EnumWindows
IsWindowEnabled
IsWindowVisible
FindWindowA
DestroyMenu
GetActiveWindow
MessageBoxA
ShowWindow
GetClientRect
GetSysColorBrush
GetWindowRect
ScreenToClient
GetDlgCtrlID
KillTimer
IsWindow
GetDC
FillRect
InvalidateRect
RegisterClassExA
GetWindowLongA
GetParent
GetWindow
SystemParametersInfoA
TrackPopupMenu
SetWindowPos
GetDesktopWindow
UpdateWindow
CharLowerBuffA
PeekMessageA
wsprintfA
CharNextA
RegisterWindowMessageA
IsDialogMessageA
PostQuitMessage
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
GetMessageA
TranslateMessage
DispatchMessageA
GetCursorPos
LoadIconA
SendMessageA
CreatePopupMenu
AppendMenuA
SetForegroundWindow
SetMenuDefaultItem
MapWindowPoints
wininet
DeleteUrlCacheEntry
Sections
UPX0 Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE