Static task
static1
Behavioral task
behavioral1
Sample
c7f3f160ccf918d97ed2b702fdf12c5c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c7f3f160ccf918d97ed2b702fdf12c5c.exe
Resource
win10v2004-20240226-en
General
-
Target
c7f3f160ccf918d97ed2b702fdf12c5c
-
Size
92KB
-
MD5
c7f3f160ccf918d97ed2b702fdf12c5c
-
SHA1
2d0b0ba9330c4356b5b2141e55c6dd525fd74045
-
SHA256
0cf5a3b831259d2df0d893c856fa40c7d5bc4648b1e9496999660a894c697f44
-
SHA512
badc9a94ec3dd847674aa0627797adb0cc4098e171176044b251fdde0f3c29e381aeac207dd8a9b49ca53ee078509f2bdb203e0fa3fe1e19d4125628d1d9709e
-
SSDEEP
1536:oJfgQ244OG5Uc780pmxP5zCRTgJWjCxuwxZZeBdCH8QU5z791/BsC0:6YQ2E7cw0pmZMWQjERgoGN91/BsV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c7f3f160ccf918d97ed2b702fdf12c5c
Files
-
c7f3f160ccf918d97ed2b702fdf12c5c.exe windows:5 windows x86 arch:x86
0a0a2880027dd0776546736eacb0711e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEndOfFile
SetFilePointer
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpiA
CreateFileA
CreateFileMappingA
CreateFileW
CreateMutexA
DeleteCriticalSection
DeleteFileA
DeleteFileW
DisableThreadLibraryCalls
EnterCriticalSection
ExpandEnvironmentStringsA
FindResourceA
FindResourceW
FormatMessageA
FreeLibrary
FreeResource
GetACP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetFileSize
GetFileSizeEx
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempFileNameW
GetTempPathA
GetTickCount
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
IsDBCSLeadByte
IsProcessorFeaturePresent
CloseHandle
LeaveCriticalSection
LoadLibraryA
LoadResource
LocalFree
LockResource
MapViewOfFile
MoveFileA
MoveFileW
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
ReadFile
ReleaseMutex
CompareStringA
RtlUnwind
ntdll
NtCreateFile
NtDeviceIoControlFile
NtWaitForSingleObject
RtlAnsiStringToUnicodeString
RtlExtendedLargeIntegerDivide
RtlFreeAnsiString
RtlFreeUnicodeString
RtlGUIDFromString
RtlInitString
RtlInitUnicodeString
RtlUnicodeStringToAnsiString
RtlUpcaseUnicodeStringToOemString
NtClose
user32
DialogBoxParamW
EnableWindow
EndDialog
EnumWindows
FindWindowW
GetClassNameW
GetDlgItem
GetDlgItemTextW
GetWindowLongW
GetWindowTextW
IsWindowVisible
CharNextW
LoadStringW
CharPrevW
MessageBoxW
PostMessageW
RegisterWindowMessageA
SendDlgItemMessageW
SendMessageW
SetDlgItemTextW
SetFocus
SetForegroundWindow
SetWindowLongW
ShowWindow
WinHelpW
wsprintfW
advapi32
OpenProcessToken
OpenThreadToken
RegCloseKey
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
SetThreadToken
shell32
SHGetFolderPathW
comdlg32
GetOpenFileNameW
ole32
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
PropVariantClear
PropVariantCopy
CLSIDFromString
Sections
.text Size: 4KB - Virtual size: 796B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 482B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ