Behavioral task
behavioral1
Sample
ce19fb7b310dfcd23b68ad087340febf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ce19fb7b310dfcd23b68ad087340febf.exe
Resource
win10v2004-20240226-en
General
-
Target
ce19fb7b310dfcd23b68ad087340febf
-
Size
259KB
-
MD5
ce19fb7b310dfcd23b68ad087340febf
-
SHA1
5da9761bcbe7c469dbf01427a2407e1807ffdc23
-
SHA256
6bc6d5180d6f847eeca71c274c44d17e7ecba67b20a86c21eb55e687645204e9
-
SHA512
5bdaf1b2b0d4a673f0f0f21c722d020ae80dcbf57313d039cf8837786e330cd837a1aba256159081c8c6e94c8beee27ec9943beecd91db8e7fbb7ec1ca5dfbf1
-
SSDEEP
6144:sTWe9o2bxVyFWkZzJxtejEfWZDkThADnmJRrtZB59:6XoImYuzheQWZAZ
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce19fb7b310dfcd23b68ad087340febf
Files
-
ce19fb7b310dfcd23b68ad087340febf.exe windows:4 windows x86 arch:x86
0fee85a1ecfb1030eb55b9e28b61941d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
GetProcAddress
user32
GetSystemMetrics
LoadMenuIndirectA
GetDlgItemTextA
TrackPopupMenu
RegisterClassW
GetKeyboardType
SetCursor
IsMenu
RegisterWindowMessageA
InvalidateRect
SendDlgItemMessageW
CharLowerW
wsprintfA
GetDlgItemInt
WinHelpW
MessageBoxW
DialogBoxParamW
LoadBitmapW
GetSubMenu
DialogBoxIndirectParamW
GetMenuItemInfoA
GetIconInfo
ShowCursor
wvsprintfW
EmptyClipboard
InvalidateRgn
CheckMenuItem
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
mssip32
CryptSIPGetSignedDataMsg
CryptSIPGetRegWorkingFlags
gdi32
DeleteObject
CreateICA
CreateDIBPatternBrush
GetEnhMetaFileW
GetEnhMetaFileA
SetMetaFileBitsEx
CreateScalableFontResourceA
CreateFontW
CreatePen
CreateCompatibleDC
GdiGetBatchLimit
AddFontResourceA
CreateRectRgn
CreatePatternBrush
CreateDIBPatternBrushPt
filemgmt
DllGetClassObject
DllCanUnloadNow
DllRegisterServer
CacheSettingsDlg
Sections
UPX1 Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.c Size: 5KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 75KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.RvaZz Size: 5KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 138KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.C Size: 3KB - Virtual size: 559KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.WurWBH Size: 3KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ