Static task
static1
Behavioral task
behavioral1
Sample
c798af8d39e6e2143f51fb43af33567b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c798af8d39e6e2143f51fb43af33567b.exe
Resource
win10v2004-20240226-en
General
-
Target
c798af8d39e6e2143f51fb43af33567b
-
Size
165KB
-
MD5
c798af8d39e6e2143f51fb43af33567b
-
SHA1
c49eea3150a618b6e21d3a0ee5da908859bc9720
-
SHA256
774c02f9f84f09351f200e1494af4236a4e59eedafdd5a1b0e83b8ca668b9a71
-
SHA512
93ed3ce73ee1154760150e1d10dddc9cfbcad6221a1bbaed11ac5bb22c1c9178a5a8785d097b02dfa88416a90943448aef7163a3961a113f8ab548bbcb11aada
-
SSDEEP
3072:WA+fmuuC8NDQKdq/Ez7z0yrAmolsRNpyjC+sVt4QvW7hyRHkAkZoenrGioI:WANuGNty430yMmowNp+mtQ7hscZL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c798af8d39e6e2143f51fb43af33567b
Files
-
c798af8d39e6e2143f51fb43af33567b.exe windows:5 windows x86 arch:x86
ff45f27501fb69fbf419281d4b7c5fe9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
InsertMenuA
SetWindowTextW
CascadeWindows
GetShellWindow
InSendMessageEx
DdeClientTransaction
LoadBitmapW
GetMenuBarInfo
mouse_event
CreateDesktopW
ReuseDDElParam
MessageBoxW
VkKeyScanA
MoveWindow
TrackPopupMenu
GetCursorInfo
OemKeyScan
DdeInitializeW
DdeSetUserHandle
MapVirtualKeyA
GetMenuStringA
ReleaseDC
DragDetect
GetWindowModuleFileName
GetWindowTextLengthW
MessageBoxIndirectW
BroadcastSystemMessageW
CharUpperBuffW
GetMenuInfo
gdi32
EngGetCurrentCodePage
GdiCleanCacheDC
EngWideCharToMultiByte
GdiEntry7
SetEnhMetaFileBits
GetBrushOrgEx
WidenPath
CopyEnhMetaFileA
GdiSwapBuffers
DPtoLP
GetGlyphIndicesW
StrokeAndFillPath
GetCharABCWidthsA
GdiConvertMetaFilePict
SelectObject
MaskBlt
SelectClipPath
GetWorldTransform
EngFreeModule
SelectFontLocal
GdiDeleteSpoolFileHandle
GetTextExtentPointW
SetDIBits
Polygon
RealizePalette
GdiAlphaBlend
GdiConvertDC
SetDCBrushColor
GdiResetDCEMF
EngMultiByteToUnicodeN
GdiEntry12
StrokePath
EngTextOut
ScaleViewportExtEx
SetSystemPaletteUse
StartDocA
GdiGetDC
ExtCreateRegion
CreatePolygonRgn
EnumFontsW
FONTOBJ_pvTrueTypeFontFile
UpdateColors
GetTextExtentPointI
CreateEllipticRgn
SetMagicColors
GdiSetBatchLimit
EnumFontFamiliesA
CancelDC
EqualRgn
GdiPrinterThunk
ExtSelectClipRgn
SetWorldTransform
GdiGradientFill
GdiDllInitialize
SetPixelV
EnumICMProfilesW
UnrealizeObject
ResetDCW
FONTOBJ_cGetAllGlyphHandles
GetObjectA
FixBrushOrgEx
EngEraseSurface
GdiAddFontResourceW
PlayMetaFileRecord
HT_Get8BPPMaskPalette
GetEnhMetaFileDescriptionW
kernel32
GetPrivateProfileSectionNamesA
OpenMutexW
SetVolumeMountPointA
ReplaceFileA
FindVolumeClose
GetConsoleAliasExesLengthW
CreateFileMappingW
lstrcmpW
lstrcpynA
CreateEventA
OpenWaitableTimerA
WaitForMultipleObjects
GetHandleInformation
GlobalFix
DeleteCriticalSection
lstrlenA
Thread32First
SetFileTime
LocalHandle
GetPrivateProfileStructW
GetNumberFormatW
ReadConsoleOutputA
GetNumberFormatA
CreateFiber
PostQueuedCompletionStatus
RequestWakeupLatency
FindFirstFileExA
FreeEnvironmentStringsA
FindAtomA
ReadDirectoryChangesW
SetComputerNameA
Module32Next
BuildCommDCBA
SetVolumeMountPointW
GetFullPathNameW
GlobalAddAtomA
SetComputerNameExW
SetTapeParameters
FreeUserPhysicalPages
SetConsoleActiveScreenBuffer
Process32Next
GetTapePosition
DefineDosDeviceW
WriteFileGather
Heap32ListFirst
WriteProcessMemory
CreateMailslotW
GetLogicalDriveStringsA
LockFile
SetMailslotInfo
LocalAlloc
EnumUILanguagesW
lstrcmpiA
DebugActiveProcess
CallNamedPipeA
GetFileAttributesA
UnmapViewOfFile
SetConsoleDisplayMode
IsBadCodePtr
GetSystemDirectoryA
EnumSystemCodePagesA
GetPrivateProfileSectionA
SystemTimeToTzSpecificLocalTime
MoveFileA
WritePrivateProfileStringW
CreateDirectoryA
OpenProcess
FindNextVolumeW
PeekConsoleInputA
WriteConsoleOutputAttribute
RaiseException
lstrcpy
HeapValidate
OpenEventW
Process32NextW
ClearCommError
EnumDateFormatsExA
PeekConsoleInputW
CreateFileA
GlobalHandle
WinExec
lstrcmp
GetTimeZoneInformation
GetFileInformationByHandle
CallNamedPipeW
GetEnvironmentVariableA
WritePrivateProfileSectionW
ReadFileEx
WriteFile
OpenSemaphoreW
WriteProfileSectionW
DeleteFiber
LeaveCriticalSection
GetComputerNameExW
SetConsoleWindowInfo
IsValidLocale
OutputDebugStringW
GetFileAttributesExW
LocalFlags
CancelIo
GetSystemTimeAsFileTime
GetVolumeInformationA
SetInformationJobObject
DosDateTimeToFileTime
FindResourceExW
GetThreadLocale
SetConsoleCP
DnsHostnameToComputerNameW
GetModuleHandleW
DeleteVolumeMountPointA
GetProcAddress
GetProcessWorkingSetSize
GetThreadPriorityBoost
GetConsoleFontSize
GetProfileSectionA
ProcessIdToSessionId
CompareStringA
GetPrivateProfileSectionW
Process32FirstW
LockFileEx
FindFirstVolumeW
EnumCalendarInfoExA
GetPrivateProfileSectionNamesW
GetVolumeNameForVolumeMountPointW
CreateSemaphoreW
GetTempPathW
CancelDeviceWakeupRequest
GetWindowsDirectoryW
GetCurrentDirectoryW
lstrlenW
lstrcatW
TransmitCommChar
Toolhelp32ReadProcessMemory
DisableThreadLibraryCalls
VirtualAlloc
GlobalWire
GlobalUnWire
GetLargestConsoleWindowSize
DeleteFileW
VerifyVersionInfoW
ScrollConsoleScreenBufferW
CreateDirectoryExA
FatalAppExitA
OpenMutexA
GetFileSizeEx
ResetEvent
ConnectNamedPipe
WaitForDebugEvent
GetNamedPipeHandleStateA
CreateDirectoryExW
OpenSemaphoreA
GetLogicalDrives
lstrcpyn
GetCommandLineA
LCMapStringA
GetStdHandle
EnumTimeFormatsW
SetFileApisToANSI
VerLanguageNameA
GetSystemWindowsDirectoryA
GetLogicalDriveStringsW
SetCalendarInfoA
BeginUpdateResourceW
GetDiskFreeSpaceA
VirtualProtect
SetConsoleTitleA
CreateSemaphoreA
GetTapeStatus
GetTempPathA
SetThreadIdealProcessor
ResumeThread
SwitchToFiber
GetFileAttributesW
QueryPerformanceCounter
FatalAppExitW
GetBinaryTypeA
GetBinaryTypeW
ConvertThreadToFiber
WritePrivateProfileSectionA
SetConsoleCursor
CopyFileExA
CreateProcessW
BackupSeek
AllocConsole
GetCompressedFileSizeW
FindFirstFileW
GetVolumeInformationW
GetLocaleInfoA
MapViewOfFile
RtlFillMemory
Module32First
GetFileType
EnumUILanguagesA
lstrcatA
WriteConsoleInputA
EnumResourceTypesW
GetProfileStringW
GetProcessIoCounters
GetConsoleAliasesLengthA
ReadConsoleOutputCharacterA
IsProcessorFeaturePresent
lstrcpynW
ReadFile
WaitNamedPipeW
GetProcessShutdownParameters
FileTimeToDosDateTime
GetDiskFreeSpaceExW
SetNamedPipeHandleState
GetCommTimeouts
FindCloseChangeNotification
MultiByteToWideChar
FormatMessageW
UnlockFile
OpenJobObjectA
RtlUnwind
VirtualFreeEx
WriteConsoleInputW
LoadLibraryW
RemoveDirectoryA
GetCommMask
SetProcessWorkingSetSize
GetAtomNameW
VirtualProtectEx
GetSystemWindowsDirectoryW
EnumResourceLanguagesA
GetFullPathNameA
BindIoCompletionCallback
GetCalendarInfoW
SetLastError
OpenThread
IsValidLanguageGroup
HeapLock
GetConsoleAliasExesW
RegisterWaitForSingleObjectEx
MulDiv
IsDBCSLeadByteEx
InitializeCriticalSection
QueryDosDeviceW
GetProcessHeap
Module32NextW
VerifyVersionInfoA
FindNextFileA
HeapReAlloc
GetProfileIntW
ExpandEnvironmentStringsW
CopyFileW
GetProcessVersion
Sleep
GetConsoleWindow
LoadLibraryExW
GetCPInfoExA
QueryDosDeviceA
ContinueDebugEvent
OpenJobObjectW
WriteConsoleOutputCharacterA
EnumSystemCodePagesW
GetConsoleDisplayMode
FindNextVolumeMountPointW
FindNextFileW
SetCommTimeouts
ChangeTimerQueueTimer
GetLongPathNameW
GetOverlappedResult
SetUnhandledExceptionFilter
ReplaceFileW
GetWriteWatch
CreateTimerQueue
UnregisterWaitEx
CreatePipe
GetDiskFreeSpaceW
GlobalUnfix
SetFilePointer
CreateNamedPipeA
LocalUnlock
CopyFileExW
GlobalFree
GlobalAlloc
Heap32First
RemoveDirectoryW
EnumCalendarInfoExW
GetConsoleAliasW
SetCurrentDirectoryW
InitAtomTable
SetCommState
GetNamedPipeHandleStateW
IsBadReadPtr
GetThreadTimes
HeapCreate
PeekNamedPipe
UnregisterWait
BackupWrite
HeapSize
IsBadStringPtrA
SearchPathW
HeapFree
SetConsoleTextAttribute
lstrcpyA
GlobalMemoryStatus
SuspendThread
SetCommConfig
SetProcessAffinityMask
CreateIoCompletionPort
Module32FirstW
ReadConsoleW
TlsGetValue
RtlZeroMemory
SetTimeZoneInformation
ReleaseMutex
SetCurrentDirectoryA
EnumDateFormatsW
GlobalFindAtomA
CreateTapePartition
SetWaitableTimer
SetThreadPriorityBoost
SetLocaleInfoA
GetMailslotInfo
PrepareTape
FillConsoleOutputCharacterW
GetTapeParameters
CloseHandle
DeleteAtom
ExpandEnvironmentStringsA
GetConsoleTitleA
GetConsoleTitleW
FlushConsoleInputBuffer
DeleteTimerQueueEx
DnsHostnameToComputerNameA
WritePrivateProfileStructW
GetProcessHeaps
FreeEnvironmentStringsW
SetCommBreak
FormatMessageA
ReadConsoleA
GetStartupInfoA
SetConsoleCtrlHandler
GlobalSize
FlushFileBuffers
FreeResource
LocalSize
GetExitCodeProcess
GetTimeFormatA
Process32First
LoadLibraryA
ScrollConsoleScreenBufferA
SwitchToThread
GetCurrentProcess
GlobalLock
GetDefaultCommConfigA
SizeofResource
SetMessageWaitingIndicator
CreateFiberEx
HeapAlloc
lstrcmpiW
GetDriveTypeA
GetTempFileNameA
SetProcessShutdownParameters
EnterCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStructA
TryEnterCriticalSection
ReadConsoleOutputW
SetFilePointerEx
SetPriorityClass
GetPriorityClass
OpenFile
GenerateConsoleCtrlEvent
SetConsoleCursorPosition
DeviceIoControl
GetExitCodeThread
EndUpdateResourceW
GetVersionExA
AddConsoleAliasW
SetEnvironmentVariableA
Heap32ListNext
LoadResource
MoveFileExW
GetCommState
GetThreadSelectorEntry
MapUserPhysicalPagesScatter
IsSystemResumeAutomatic
GetStringTypeW
VirtualLock
GetFileTime
CreateMutexA
ClearCommBreak
FindFirstFileA
FindNextVolumeA
GetModuleFileNameW
GetConsoleAliasA
LocalLock
WaitForMultipleObjectsEx
BackupRead
LocalCompact
FindNextVolumeMountPointA
GetSystemDefaultUILanguage
FindFirstChangeNotificationW
GetSystemPowerStatus
GetModuleFileNameA
VerLanguageNameW
SetThreadPriority
GetProcessTimes
GetVersion
ExitProcess
GetEnvironmentStringsA
lstrlen
MoveFileExA
GetNamedPipeInfo
FindResourceW
LocalFree
MapUserPhysicalPages
RequestDeviceWakeup
shlwapi
PathQuoteSpacesW
IntlStrEqWorkerW
StrRetToStrW
PathCombineW
PathStripToRootW
StrFormatByteSizeW
PathRemoveBlanksW
UrlCanonicalizeA
PathCompactPathW
SHOpenRegStream2W
PathAddExtensionA
StrCmpNIW
StrRChrA
UrlGetLocationA
StrFormatKBSizeW
SHRegCloseUSKey
ChrCmpIA
ColorRGBToHLS
StrRChrIW
StrChrA
SHRegEnumUSValueA
PathMatchSpecW
ole32
OleCreateLink
OleCreateEmbeddingHelper
CoTaskMemFree
advapi32
I_ScSetServiceBitsW
OpenProcessToken
CryptSetHashParam
RegisterTraceGuidsW
IsTextUnicode
RegUnLoadKeyA
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCreateKeyW
GetTraceEnableLevel
WriteEncryptedFileRaw
Sections
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ