P:\MhkhtMHbzzqSCl\xnnelghdldi\ZGglyOLgsHsfzA\qNcazcmnsASbJ.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cc9c2cd0c9a6b6e6823145105d4bf740.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cc9c2cd0c9a6b6e6823145105d4bf740.exe
Resource
win10v2004-20240226-en
General
-
Target
cc9c2cd0c9a6b6e6823145105d4bf740
-
Size
50KB
-
MD5
cc9c2cd0c9a6b6e6823145105d4bf740
-
SHA1
8d3d3fdbf6b7e88f23d00d072b3a28dcba631e2c
-
SHA256
9f2fb0b3545bd3e4e4f2138a5d4557eb23b7cfbb01f89931e0bcb0d01d064f6d
-
SHA512
13be18942804a905f028fa7f7ea1792f99c509a8ccdb302cfed27e870c2cf11b4b3cc20cd0305031097049cc1fc0918e58d94366bf9fef200f7ea3a9e0380dc2
-
SSDEEP
1536:AuXMB8PCuLs04QzLR7CPQ4bbeXmlv9bjj:ZM9uPTubeWjPj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cc9c2cd0c9a6b6e6823145105d4bf740
Files
-
cc9c2cd0c9a6b6e6823145105d4bf740.exe windows:5 windows x86 arch:x86
aaa98f0288d319474d08a0284a759a5f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
shlwapi
PathMatchSpecA
UrlGetPartW
ntdll
memset
strcspn
kernel32
GetComputerNameExW
EnumSystemLocalesA
lstrcatA
lstrcmpiW
CompareStringA
HeapUnlock
GetStringTypeExW
RemoveDirectoryW
DeleteCriticalSection
lstrlenW
GetWindowsDirectoryA
GetThreadTimes
GetFullPathNameA
SetCurrentDirectoryW
AddAtomW
HeapFree
InitializeCriticalSection
CompareStringW
gdi32
CreateFontIndirectW
GetROP2
SetMapMode
GetWindowOrgEx
GetTextAlign
CreateFontA
SetViewportExtEx
SetTextColor
SetROP2
GetTextMetricsA
StartPage
SetTextAlign
comctl32
ImageList_AddMasked
ImageList_GetIcon
ImageList_Create
msvcrt
exit
user32
MapDialogRect
CreateDialogParamA
EnableWindow
IsZoomed
IsWindow
InvalidateRgn
GetShellWindow
CopyAcceleratorTableW
ShowOwnedPopups
LoadAcceleratorsW
SetForegroundWindow
DeferWindowPos
mouse_event
GetClassInfoW
GetUserObjectInformationW
GetScrollRange
DrawTextA
CloseDesktop
PostQuitMessage
IsCharUpperA
SendDlgItemMessageA
wsprintfW
SetUserObjectInformationW
GetWindowDC
SendNotifyMessageW
RedrawWindow
IsIconic
DestroyAcceleratorTable
Exports
Exports
?v_afpxdwqXVJ_jlq@@YGPAHPAJF@Z
?H_D__NLz_gLYEUWQNIVUEC@@YGXPAKK@Z
?Tt_ZIYp__v_z_lh@@YGEN_N@Z
?GFDie_gUt_@@YGPAXPAJPAF@Z
?Aslhw_XG__W_@@YGGNE@Z
?_SBvfbpcoGMMHBV@@YGXM@Z
?FEZJGhea_hbJWJTMIIg_@@YGJM@Z
?_D__KnmaaovgmZGc_apjX_@@YGPAID@Z
?GXSKXKZXTR___k_mx__@@YGPAIGPAK@Z
?_upd_atb_kTOT_Xyu@@YGPAMGD@Z
?_y_f_jet@@YGNDJ@Z
?cd___resDMTJCJIND@@YGMPANPAK@Z
?ITKV_DMV@@YGIGPAK@Z
?BNCQJ__REWBY__HvkiM_Vp@@YGPAFG@Z
?zjwwvv_haibkuYF@@YGPAEII@Z
?lQLW__MK@@YG_NEPAD@Z
?lwlo_h_knuq_nju_l@@YGPAHJ@Z
?__uktcCPb_chuVND_ykXX@@YGXPAE_N@Z
?QBihl_aWWDHR@@YGMPAJPAG@Z
?_GIQfit_wK_YNJESS@@YGIPAK@Z
?wbblf_uqr_a_kIH@@YG_NJ@Z
?O_aqkamueulJUeauNBXMSp@@YGJF@Z
?vVQUAYNFf_zpgnykq_el@@YGPANF@Z
?Vuabo_wjphZU_ARCVu_baA@@YGGKPAG@Z
?L_R_ZOQNECcI@@YGKPAGPAD@Z
?q_nLWGHJLHA@@YG_NND@Z
?whylsplhyLJ@@YGNE@Z
?g_zGXQBO_@@YGPAXFE@Z
?iqyknsKSIDSrHN_c_yn@@YGDIG@Z
?vpHQE_E@@YGPAKPAK@Z
?xan_tCCRF_BL@@YGEK@Z
?HRXG_DOX@@YGPAXPA_NPAI@Z
?auys__yqs_@@YGPAHPAF@Z
?kEIYNY_CBYQQYHS_S_og@@YGIPADK@Z
?vJXTXLQ@@YGDF@Z
?qvKXdbEXASjiQ_TPV@@YG_NPA_N@Z
?uufqka_@@YGJPADH@Z
?sppENLZ__GOZCMO@@YGKGPA_N@Z
?abM__JHR_Zhqx_qT_YVRK@@YGPADPAGPAE@Z
?RSFIF_P_Vtqybwom@@YGXPAI@Z
?KVYK_ENQORHS_D@@YGPAXPAJ@Z
?___R_IOY__H__IGCrti@@YGPADJ@Z
?EBGEPDFDX_ADMPL@@YGPAGK@Z
?WDRT_T_gr_nfMLP_@@YG_NEI@Z
?rvnBM___R_R__JPRIMU_Id@@YGEE@Z
?rgw_sgMUjjk_@@YGE_NPAE@Z
?sgn_____JAKP_fndbh_g_o@@YGXDH@Z
?KSX_NLMYGD@@YGDH@Z
?D_LK_VP@@YGPAIKH@Z
?sSW_FosZOKRISLJ@@YGPAEPA_N@Z
?_S___PM_Zs_@@YGJPAG@Z
?zxonwYXLp@@YGJDH@Z
?SV_DZJ_I_EWfG_BOBIGI@@YGIJ@Z
?JKnvlATJYEFDA_@@YGPAEDM@Z
?BXfw_l_jwKZ@@YG_ND@Z
?MSPOEXKCGHorqobd@@YGPAGPAG@Z
?eggVTht_zd@@YGPAJKPAN@Z
?PB_WOcfcQHW@@YG_NMPAJ@Z
?_CAW_C_IN___GCy_acz_@@YGXK@Z
?d___dikRW_@@YGPAHMH@Z
?KVCSZF_v_@@YGGPAG@Z
?_rm_uy_f____x_USo_yai@@YGPAKG@Z
?lx_alyduxyuvndrk_u@@YGXHE@Z
?QHt_tbh@@YGPAXMM@Z
?a__s_SUVII_Y__IJPP_B@@YGEJ@Z
?_B__TV__XJS_HTpwywaQ@@YGPAEPAN@Z
?fhc_bg_uPsXOV@@YGXEM@Z
?SJTZA_X_@@YGPAHPAEI@Z
?m__wk_BLDLzY_OYN_ZR@@YGPAGPAIPAE@Z
?_j_spopm@@YGMMPAM@Z
?Nxdt__EBYHGC_UBGUBP_TS@@YGPA_NPAH@Z
?_WQSv_cyoe_bm_j_Yhhsv@@YGGE@Z
?EUNpebdn@@YGPAIFPAG@Z
?EVOMQZdpph_x_ooND@@YGDPAE@Z
?oxoorwqcEEJMBGOmdo_rLI@@YGXPAF@Z
?JWRAKMx_F__ns_TSFUCxve@@YGH_N@Z
?_ga_sceLER_YY@@YGPAHH@Z
?_es_G_GRFtgM@@YGXPAEF@Z
?_wd_kQHJ__EK@@YG_NHD@Z
?_JYqdzbr_m__f@@YGHPAD@Z
?n__gat_DJY_Wh@@YGDPADJ@Z
?ZJQ__FN_ILRCG@@YGIDI@Z
?_OYBMPAahk_zd@@YGPAGPAHI@Z
?xztNEVHE_ZD_@@YGXM@Z
?_YJNbxktv@@YGDG@Z
?TTAMCXSC_KXJQ__LD@@YGFH@Z
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ldata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.crt Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 507B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ