Static task
static1
Behavioral task
behavioral1
Sample
d626bde12582a6a93fd6f85fbd501b62.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d626bde12582a6a93fd6f85fbd501b62.exe
Resource
win10v2004-20240226-en
General
-
Target
d626bde12582a6a93fd6f85fbd501b62
-
Size
846KB
-
MD5
d626bde12582a6a93fd6f85fbd501b62
-
SHA1
c5503dbd2c6132470332984a8ea6c8df59b38148
-
SHA256
c9bb411a81ecb9376296930ce66e3a4fc700daa915e2eb77cb0dcc9586b0632c
-
SHA512
08096d5e3a612eb4213ec0688a9f757d10320f889193efe78f26d6bf990103300c4217e963ffc79337b82a79a201a9a5e6312e6cae44b1262901d59330bc70a4
-
SSDEEP
6144:kFYnvmw4fTlJmytIjDnSNC2/6cy05llyf2UnN8uKFhAbHMFz:kSvA/mDjGNC2iTIlov8uKF2wF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d626bde12582a6a93fd6f85fbd501b62
Files
-
d626bde12582a6a93fd6f85fbd501b62.exe windows:4 windows x86 arch:x86
3097ded9568dd074bece0d9642a34005
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
xpprt1
?prepareOpStack
?ehIsError
?ehSetContext
?setjmp
?exeNativeError
?exeStackUnwind
?momSOn
?symContextInit
__vft18ConUndefinedObject10AtomObject
?conNAllocL
?symPublicConst
?symRefItemConst
?momSOff
CURDRIVE
CURDIR
?getRFPC
?domAdd
SET
?conSendItem
?conAssignRefWMember
APPDESKTOP
ACREATE
?domAssign
SLEEP
?retNil
?conNRelease
?conNReleaseL
?frameExit
?ehUnwind
?nomClassLock
?nomClassUnlock
?retObject
?conNewNil
?conGetClass
?nomCreateClass
?nomDefineVar
?nomDefineMethod
?nomEndClassDefinition
?conNewExtObject
?nomCallInitClass
?conRelease
?passParameter
?conGetSelfClass
?conMemberToItem
?retStackItem
DBSELECTAREA
?retStackValue
DBGOTOP
?getRCFC
?domValXEql
DBCLOSEAREA
DBCLOSEALL
MSGBOX
EOF
?domNot
_QUIT
?setCWArea
?restWArea
DATE
DTOC
GETENV
UPPER
SUBSTR
?andShortCut
FILE
?domXEql
?domAnd
FSIZE
?domGCmp
ORDLISTCLEAR
ORDLISTADD
?pushCodeBlock
_EARLYBOUNDCODEBLOCK
DBCREATEINDEX
ALLTRIM
LEFT
DTOS
__vft20ConStringConstObject10AtomObject
DBSETFILTER
TRIM
SPACE
?domNEql
?orShortCut
?domOr
DBSKIP
INT
?domValEql
?conNewLogic
CHR
?symGetItemConst
OS
MEMORY
STR
DISKSPACE
SETAPPWINDOW
NATIONMSG
?domRefElem
?domAddEqu
?domGetElem
?domNegate
AEVAL
__vft14ConLogicObject10AtomObject
SETAPPFOCUS
APPEVENT
CTOD
VAL
LEN
PADR
DBSEEK
FOUND
?getRFCC
?domEql
?getWFPC
?domInc
REPLICATE
LTRIM
?domMul
?conNewString
?conNewCon
?conNNewNil
?domDiv
__vft19ConNumericIntObject10AtomObject
MONTH
YEAR
?domSub
EMPTY
DAY
?domDec
PADL
RECNO
?domGECmp
?domLECmp
DBGOTO
DBCLEARRELATION
ALIAS
DBSETRELATION
?getRFIC
?getRFCS
RIGHT
ARRAY
?domSubEqu
VALTYPE
?domSubStr
XBPBITMAP
XBPMETAFILE
GRAPATHBEGIN
GRABOX
GRAPATHEND
GRAPATHCLIP
SELECT
__vft21ConNumericFloatObject10AtomObject
AADD
RUNSHELL
DOW
?floadTos
STRZERO
?domValNEql
RTRIM
?domValGCmp
AT
__vft14ConStringShort10AtomObject
DBELOAD
ALERT
DBEBUILD
DBESETDEFAULT
DBEINFO
POSTAPPEVENT
CMONTH
EVAL
CDOW
STRTRAN
DBUSEAREA
NETERR
DBGOBOTTOM
THREAD
ASC
DBCOMMITALL
_iniExitProcedureList
___iniStart
___iniGetDLLInitHook
__This_executable_needs_version_1_90_0
___xpprt1Version
DLLLOAD
DLLCALL
DLLUNLOAD
XBPBASEDIALOG
XBPBASECRT
XBPBASECOMBOBOX
XBPBASELISTBOX
XBPBASEPUSHBUTTON
XBPBASESPINBUTTON
XBPBASEMENUBAR
XBPBASEMENU
XBPBASESLE
XBPBASEMLE
XBPBASETREEVIEW
XBPBASETREEVIEWITEM
XBPBASE3STATE
XBPBASETABPAGE
XBPBASESCROLLBAR
XBPBASECHECKBOX
XBPBASERADIOBUTTON
XBPBASESTATIC
XBPBASEPRESSPACE
SETMOUSE
ACLONE
BAND
?pushDynamicCodeBlock
ASCAN
SHELLLINKRESOLVE
FOPEN
FREADSTR
FCLOSE
PCOUNT
?domLCmp
GRAQUERYTEXTBOX
?conOpNewInt
L2BIN
CONVTOANSICP
SETAPPEVENT
BIN2L
?domMod
?domValLCmp
LOADRESOURCE
PROCNAME
THREADID
DOSERROR
ERRORBLOCK
ERROR
BREAK
WORKSPACELIST
?setSWArea
DBCOMMIT
?ehUnsetContext
?ehGetBreakContainer
DBRROLLBACK
DBSESSION
ISFUNCTION
?executeMacro
DOSERRORMESSAGE
APPTYPE
ROW
COL
SETPOS
_BREAK
ERRORLEVEL
ISMETHOD
PROCLINE
CONFIRMBOX
ROOTCRT
TONE
QOUT
OUTERR
APPNAME
TIME
VERSION
VAR2CHAR
QQOUT
MLCOUNT
MEMOLINE
Sections
.text Size: 661KB - Virtual size: 660KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpp Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 57KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE