Behavioral task
behavioral1
Sample
cdb6f1b6d417ce0ef5883d40bcbec44c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
cdb6f1b6d417ce0ef5883d40bcbec44c.exe
Resource
win10v2004-20240226-en
General
-
Target
cdb6f1b6d417ce0ef5883d40bcbec44c
-
Size
125KB
-
MD5
cdb6f1b6d417ce0ef5883d40bcbec44c
-
SHA1
cde4a90a17965e1dd47b27428729f6b40932ea09
-
SHA256
cabcfa592c56419c027b9e3906feaf968f31ed48744b5eaf0b2193c544878690
-
SHA512
0b8d1b452aec53cab77b78c72bb674535b0aca7605b5314f8c8bae41696468ec0ce558d156880ba9e7d22b99701a4e101cac498c1364c534efbc49422b97a683
-
SSDEEP
3072:tc2mQbCioXxMshHlQ8nD1p0X4zDr9u+t/IuxNIbL9nW:tRbshHz1pbD8+VziE
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cdb6f1b6d417ce0ef5883d40bcbec44c
Files
-
cdb6f1b6d417ce0ef5883d40bcbec44c.exe windows:4 windows x86 arch:x86
d35ba1f2a4b2c012a429cdd911025c7c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
CopyFileA
CloseHandle
CreateFileA
CreateDirectoryA
GetWindowsDirectoryA
GetLongPathNameA
GetModuleFileNameA
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
SetEvent
WaitForSingleObject
CreateThread
CreateEventA
Sleep
lstrcmpiA
GetCommandLineA
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
WideCharToMultiByte
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
ReadFile
SetFilePointer
ReleaseMutex
GetVersion
GetLastError
CreateMutexA
TerminateProcess
TerminateThread
ExitProcess
DeleteFileA
OpenProcess
FindFirstFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
WriteFile
LockResource
SizeofResource
LoadResource
FindResourceA
HeapCreate
SetStdHandle
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
InterlockedDecrement
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetEnvironmentVariableA
GetCPInfo
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
VirtualAlloc
SetUnhandledExceptionFilter
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
HeapReAlloc
GetCurrentProcess
VirtualFree
GetVersionExA
GetSystemDirectoryA
LocalFree
RtlUnwind
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetStartupInfoA
RaiseException
HeapFree
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapAlloc
advapi32
RegCreateKeyExA
RegDeleteValueA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegNotifyChangeKeyValue
ole32
CoRegisterClassObject
CoUninitialize
CoInitialize
CLSIDFromProgID
CoRevokeClassObject
CoCreateInstance
oleaut32
shell32
ShellExecuteA
urlmon
URLDownloadToFileA
user32
MessageBoxA
FindWindowA
SendMessageA
LoadCursorA
SetCursor
DefWindowProcA
CreateWindowExA
SetWindowLongA
GetMessageA
DispatchMessageA
CharNextA
ws2_32
Sections
UPX0 Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE