Static task
static1
Behavioral task
behavioral1
Sample
d385bae408ae425df7519410b9b3604b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d385bae408ae425df7519410b9b3604b.exe
Resource
win10v2004-20240226-en
General
-
Target
d385bae408ae425df7519410b9b3604b
-
Size
423KB
-
MD5
d385bae408ae425df7519410b9b3604b
-
SHA1
216aecc4f5838cd7e403997c7ff5883f8d077758
-
SHA256
66153d11ffdb009bd3afe7df38004bf2f817041877b1f80e7ce71daafd30e7e4
-
SHA512
aa0f71feb3e6cbf0b5ec544d95cc96a8945808a537be233c320ea74d46a668078b1f70545b5a9244d303c2663764096a235cdf579524aac1e9b3fe5a5697a166
-
SSDEEP
6144:+5WLrUCCZKhHyOQyPQ8HwRGcuS8EedF+JUwnzwQ40Qigk/t/:DrUC6KsjyLiGo8EeOJUwzwQ406O
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d385bae408ae425df7519410b9b3604b
Files
-
d385bae408ae425df7519410b9b3604b.exe windows:4 windows x86 arch:x86
cf7c8a2c60581bd3c03c207f8f6aba04
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
InterlockedIncrement
GetEnvironmentStringsW
GetModuleHandleA
DeleteCriticalSection
SetHandleCount
GetLocaleInfoA
GetStartupInfoA
GetCommandLineW
GetProcessHeap
SetLocalTime
SetConsoleWindowInfo
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentThread
GetEnvironmentStrings
EnterCriticalSection
LCMapStringA
FormatMessageW
SetLastError
InterlockedExchange
QueryPerformanceCounter
GetStdHandle
GetTickCount
VirtualQuery
IsValidCodePage
VirtualAlloc
CreateEventA
WriteFile
HeapReAlloc
SetEnvironmentVariableA
GetCurrentThreadId
LCMapStringW
GetDateFormatA
GetLocaleInfoW
TlsFree
HeapDestroy
FreeLibrary
HeapFree
TlsSetValue
ReadConsoleInputA
SetComputerNameA
TlsAlloc
RtlUnwind
TerminateProcess
MultiByteToWideChar
IsValidLocale
EnumSystemLocalesA
CompareStringW
ExitProcess
LoadLibraryA
GetTimeZoneInformation
GetModuleFileNameA
GetCommandLineA
TlsGetValue
FreeEnvironmentStringsW
IsDebuggerPresent
GetVersionExA
GetStringTypeA
SetThreadPriority
UnhandledExceptionFilter
HeapAlloc
GetLastError
GetProcAddress
Sleep
GetSystemDirectoryW
MoveFileExW
InitializeCriticalSection
GetCPInfo
GetUserDefaultLCID
GetFileAttributesA
lstrcpynW
GetACP
VirtualFree
SetTimeZoneInformation
GetFileType
LeaveCriticalSection
GetTimeFormatA
EnumDateFormatsA
FreeEnvironmentStringsA
GetOEMCP
GetCurrentProcess
SetUnhandledExceptionFilter
HeapSize
HeapCreate
EnumDateFormatsW
InterlockedDecrement
SetConsoleCtrlHandler
CompareStringA
GetDiskFreeSpaceW
GetStringTypeW
SetThreadContext
OpenSemaphoreA
advapi32
CryptGetDefaultProviderA
CryptDestroyKey
RegOpenKeyExW
LookupPrivilegeNameW
CryptGenRandom
RegQueryValueW
LookupAccountNameA
LookupPrivilegeValueA
CryptSetProviderW
CryptHashSessionKey
RegEnumValueA
RegCreateKeyW
RegReplaceKeyA
RegOpenKeyExA
CryptHashData
LookupPrivilegeDisplayNameW
user32
DdeFreeDataHandle
DdeUninitialize
TrackPopupMenu
EnumPropsW
GetForegroundWindow
DrawIcon
SetClipboardData
DispatchMessageA
ChangeClipboardChain
EditWndProc
GetCaretPos
DlgDirSelectExW
GetClassNameA
TranslateMessage
UnhookWindowsHook
CreateMDIWindowW
LoadStringW
PeekMessageA
DrawTextA
WinHelpA
wininet
CreateUrlCacheContainerW
SetUrlCacheEntryGroupA
SetUrlCacheConfigInfoW
GopherOpenFileA
InternetWriteFileExA
shell32
SHFileOperationW
SHFormatDrive
comdlg32
PageSetupDlgA
LoadAlterBitmap
Sections
.text Size: 126KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 279KB - Virtual size: 279KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ