Static task
static1
Behavioral task
behavioral1
Sample
c863688c503bc6675de82f63c3643067.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c863688c503bc6675de82f63c3643067.exe
Resource
win10v2004-20240226-en
General
-
Target
c863688c503bc6675de82f63c3643067
-
Size
220KB
-
MD5
c863688c503bc6675de82f63c3643067
-
SHA1
fd0afb7f0520edc555680dcb6caccef43dca2076
-
SHA256
98de8c7c4b63a09ab862d987014cb82a95455fab0b34632f529dc39c849192e2
-
SHA512
bf346babe7f869ff3cf39e2b8bda75c48f8f1cc67488586cb2a00b13835ce36f4e047d141f1fc3570edfa34cb62dfc2ddc49839fe32f54c173c08c5b4919df04
-
SSDEEP
3072:Nm5zCY5UWQ6Zuwl0e3NvfI+D1IXNqv2Xhs6kIyAdbkPeILv02/zH+KDZSUT6hfot:YsGUYuwu4NBydppkWtCPDJTUfoV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c863688c503bc6675de82f63c3643067
Files
-
c863688c503bc6675de82f63c3643067.exe windows:4 windows x86 arch:x86
38252d72ddf6607dedcd987b1567e56d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
GetOpenFileNameW
PrintDlgA
PrintDlgW
PageSetupDlgA
ChooseFontW
LoadAlterBitmap
GetSaveFileNameA
GetFileTitleA
GetSaveFileNameW
ChooseColorW
FindTextA
ReplaceTextA
advapi32
CryptGetDefaultProviderA
StartServiceA
CryptDeriveKey
RegCloseKey
LookupPrivilegeValueA
LookupAccountNameW
RegOpenKeyA
CryptImportKey
RegQueryMultipleValuesA
RegConnectRegistryA
AbortSystemShutdownA
InitiateSystemShutdownA
RegEnumKeyW
RegSetValueA
wininet
DeleteUrlCacheGroup
FtpCommandA
SetUrlCacheConfigInfoW
InternetSetDialStateA
SetUrlCacheEntryInfoA
InternetCrackUrlA
InternetCombineUrlW
SetUrlCacheEntryInfoW
gdi32
GetCharABCWidthsA
GdiGetBatchLimit
CreateScalableFontResourceA
SelectPalette
GetKerningPairsW
GdiSetBatchLimit
EnumFontFamiliesW
CopyEnhMetaFileW
PolyBezier
GetStockObject
CreateRectRgn
GetSystemPaletteUse
SetPolyFillMode
GetBitmapBits
GetTextMetricsA
kernel32
TerminateProcess
EnterCriticalSection
GetStartupInfoA
GetTickCount
ExitProcess
VirtualAlloc
IsValidLocale
WriteProfileStringA
FreeEnvironmentStringsA
InitializeCriticalSection
LCMapStringW
CompareStringW
EnumSystemLocalesA
InterlockedExchange
UnmapViewOfFile
GetDriveTypeW
GetTimeZoneInformation
GetUserDefaultLCID
GetCurrentProcess
GetLastError
GetStringTypeW
GetCPInfo
GetCompressedFileSizeA
CreateFileA
HeapReAlloc
GetMailslotInfo
GetOEMCP
GetEnvironmentStrings
GetFileType
VirtualQuery
lstrcatW
GetModuleFileNameA
DeleteCriticalSection
TlsAlloc
GetStringTypeA
SetEnvironmentVariableA
SetHandleCount
GetCurrentThreadId
OpenSemaphoreW
GetCommandLineW
PulseEvent
IsBadWritePtr
GetLocaleInfoA
GlobalHandle
SetLocalTime
GetSystemTimeAsFileTime
LoadLibraryA
SleepEx
GetDateFormatA
WriteProfileSectionW
ReadFile
IsValidCodePage
TlsGetValue
LeaveCriticalSection
QueryPerformanceCounter
GetModuleFileNameW
FreeEnvironmentStringsW
GetModuleHandleA
GetStdHandle
HeapSize
MultiByteToWideChar
VirtualFree
GetTimeFormatA
VirtualProtect
GetACP
GetProcAddress
GetVersionExA
GetEnvironmentStringsW
GetSystemInfo
HeapCreate
GetCurrentProcessId
HeapAlloc
EnumCalendarInfoW
GetCalendarInfoA
WriteFile
GetCommandLineA
ReadConsoleOutputCharacterW
TlsSetValue
RtlUnwind
SetLastError
GetCurrentThread
FillConsoleOutputCharacterW
CompareStringA
WideCharToMultiByte
UnhandledExceptionFilter
LCMapStringA
TlsFree
GetLocaleInfoW
GetStartupInfoW
HeapFree
HeapDestroy
Sections
.text Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 109KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ