Static task
static1
Behavioral task
behavioral1
Sample
64f70b81290b3729647f22209e61b8b1222276344b11e4e22af324f7a17570ba.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
64f70b81290b3729647f22209e61b8b1222276344b11e4e22af324f7a17570ba.exe
Resource
win10v2004-20240226-en
General
-
Target
64f70b81290b3729647f22209e61b8b1222276344b11e4e22af324f7a17570ba
-
Size
1.8MB
-
MD5
5a2170b4d950c8195467e758d3f181de
-
SHA1
e8fc18d10b3e39d96d78c06c23701bf7cdaa1fcb
-
SHA256
64f70b81290b3729647f22209e61b8b1222276344b11e4e22af324f7a17570ba
-
SHA512
9b5e9acc612a0ba5b904562ee2f57e9ef0908d5d24e4ae7d08e30ca073902522bd37f6ca93f2feafe60656968835d82237cbe289e24d3bbc07f17ad5cf909ad4
-
SSDEEP
49152:D6bHnLT3G4XEKiUhKa29Z42VJCbGT/4+xKriyOI0qXH:D6znLT3G4XxiKP29Z42VIW/4+o5Op8
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 64f70b81290b3729647f22209e61b8b1222276344b11e4e22af324f7a17570ba
Files
-
64f70b81290b3729647f22209e61b8b1222276344b11e4e22af324f7a17570ba.exe windows:4 windows x86 arch:x86
166e19b1356921e83fbc9713bc288994
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoW
VerQueryValueW
VerQueryValueA
kernel32
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceA
FindResourceW
FlushInstructionCache
FormatMessageA
FormatMessageW
FreeResource
GetACP
GetComputerNameA
GetComputerNameW
GetConsoleCP
GetConsoleOutputCP
GetCPInfoExW
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentThread
GetDateFormatW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDriveTypeW
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFileTime
GetFileType
GetFullPathNameW
GetLastError
GetLocaleInfoA
GetLocaleInfoW
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetPriorityClass
GetProcAddress
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadLocale
GetThreadPriority
GetVersionExA
GetVersionExW
GetVolumeInformationW
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatus
GlobalUnlock
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapSize
IsBadReadPtr
IsDBCSLeadByteEx
IsValidLocale
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFree
LocalSize
FileTimeToSystemTime
lstrcmpA
lstrcmpiW
lstrlenW
MapViewOfFile
MultiByteToWideChar
OpenFileMappingA
OpenFileMappingW
OpenProcess
QueryPerformanceFrequency
RaiseException
ReadFile
ReadProcessMemory
ReleaseMutex
RemoveDirectoryA
RemoveDirectoryW
ResetEvent
ResumeThread
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetLastError
SetNamedPipeHandleState
SetThreadLocale
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsGetValue
TlsSetValue
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WideCharToMultiByte
WriteFile
HeapReAlloc
GetOEMCP
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetEnvironmentVariableA
TlsAlloc
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
GetVersion
GetStartupInfoA
RtlUnwind
GetStringTypeW
LCMapStringA
LCMapStringW
FileTimeToLocalFileTime
FileTimeToDosDateTime
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
ExitThread
ExitProcess
EnumSystemLocalesW
EnumCalendarInfoW
DuplicateHandle
DeleteFileW
DeleteFileA
DeleteCriticalSection
CreateThread
CreateProcessW
CreateProcessA
CreatePipe
CreateMutexW
CreateMutexA
CreateFileW
CreateFileMappingW
CreateFileMappingA
GetCommandLineA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetCommandLineW
LocalAlloc
GetConsoleMode
CreateEventW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
LockResource
GetStringTypeA
user32
SetWindowLongW
SetWindowPos
SetWindowTextA
SetWindowTextW
ShowWindow
SystemParametersInfoW
TranslateMessage
UnregisterClassA
WindowFromPoint
SetActiveWindow
SendMessageW
SendMessageTimeoutA
SendMessageA
ScreenToClient
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterClassW
RegisterClassA
PostThreadMessageW
PostThreadMessageA
PostQuitMessage
PostMessageW
SetTimer
PeekMessageW
PeekMessageA
OpenClipboard
OffsetRect
MsgWaitForMultipleObjects
MessageBeep
LoadStringW
LoadImageW
LoadImageA
LoadCursorW
KillTimer
IsWindowVisible
IsWindowUnicode
IsIconic
IsDialogMessageW
InvalidateRect
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowTextA
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetSystemMenu
SetForegroundWindow
SetRect
SetFocus
SetCursor
SetClipboardData
PostMessageA
GetSysColorBrush
GetMessageW
GetMessageA
GetKeyState
GetIconInfo
GetFocus
GetDC
GetCursorPos
GetClientRect
GetClassNameA
GetCapture
FrameRect
FindWindowA
FillRect
EnumWindows
EnableWindow
EmptyClipboard
DrawTextW
DrawTextA
DrawIconEx
DrawFrameControl
DrawFocusRect
DispatchMessageW
DestroyWindow
DefWindowProcW
DefWindowProcA
GetKeyboardType
SetCapture
gdi32
SetTextColor
SetMapMode
SetBkMode
SetBkColor
SelectObject
SelectClipRgn
MoveToEx
LineTo
GetTextMetricsW
GetTextFaceA
GetTextExtentPoint32W
GetTextExtentPoint32A
GetStockObject
GetRgnBox
GetObjectW
GdiFlush
GetDeviceCaps
advapi32
AllocateAndInitializeSid
StartServiceW
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegEnumKeyA
RegDeleteValueW
RegDeleteValueA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
QueryServiceStatus
OpenServiceW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenProcessToken
OpenSCManagerW
shell32
CommandLineToArgvW
oleaut32
VariantInit
VariantCopy
VariantClear
ws2_32
select
WSACleanup
WSAGetLastError
sendto
WSAStartup
Sections
.text Size: 760KB - Virtual size: 757KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 292KB - Virtual size: 292KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.SHORT9 Size: 799KB - Virtual size: 800KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE