Static task
static1
Behavioral task
behavioral1
Sample
d794e631544ee6c6931efcb48d71c4d7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d794e631544ee6c6931efcb48d71c4d7.exe
Resource
win10v2004-20240226-en
General
-
Target
d794e631544ee6c6931efcb48d71c4d7
-
Size
6.9MB
-
MD5
d794e631544ee6c6931efcb48d71c4d7
-
SHA1
99f5d5be1ee9df7b6add541870899c4935c8fd58
-
SHA256
4daa9447e1d7421a0cb96c1d736741a040a3048008be98e1fa825401491041d8
-
SHA512
f466a1ca47a390bf07044b733d58e2f474a2d9cf037acea887c0578ef51fd01f03289e594f8afbd86d0d49197d9c42ef9f3c935d73fc45169254c55746cb9bbf
-
SSDEEP
196608:ftraDWj6jD0rBfPg8d55riRJ4jTYFa5JyTg0:fqWj6ihX5WRbiyF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d794e631544ee6c6931efcb48d71c4d7
Files
-
d794e631544ee6c6931efcb48d71c4d7.exe windows:5 windows x86 arch:x86
2a0f282a42fcd88136fc66ff74c9721c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imagehlp
ImageEnumerateCertificates
ImageGetCertificateData
ws2_32
WSACleanup
WSAStartup
wininet
InternetConnectW
InternetOpenW
InternetCrackUrlW
InternetReadFile
HttpSendRequestW
InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
rpcrt4
RpcStringFreeW
UuidToStringW
shlwapi
PathRemoveFileSpecW
PathRemoveExtensionW
PathFindFileNameW
SHEnumValueA
SHDeleteValueW
SHGetValueW
SHDeleteKeyW
SHSetValueW
StrStrIW
kernel32
GetACP
TlsSetValue
TlsGetValue
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CompareStringW
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
InterlockedExchange
GetLastError
EnterCriticalSection
TlsAlloc
TlsFree
GetModuleHandleW
GetTickCount
InitializeCriticalSection
Sleep
MultiByteToWideChar
DeleteCriticalSection
CreateDirectoryW
CopyFileW
CloseHandle
DeleteFileW
CreateThread
GetVersion
CreateProcessW
WaitForSingleObject
GetSystemDirectoryW
GetTempPathW
WaitForMultipleObjects
GetModuleFileNameW
ExitProcess
HeapFree
GetProcessHeap
FindResourceW
LoadResource
SizeofResource
LockResource
HeapAlloc
OpenProcess
SetLastError
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
HeapReAlloc
GetFileSize
FindResourceA
FindFirstFileW
GetOEMCP
FreeResource
MoveFileExW
WriteFile
LoadLibraryW
GetFileAttributesW
ReadFile
CreateFileW
FindClose
LocalAlloc
RemoveDirectoryW
FindNextFileW
GetCurrentThreadId
LocalFree
CreateMutexW
MapViewOfFile
UnmapViewOfFile
SetEvent
OpenFileMappingW
OpenEventW
ReleaseMutex
GetCurrentProcess
GetVersionExW
TerminateProcess
WideCharToMultiByte
GetCommandLineW
GetConsoleCP
GetLocaleInfoW
GetDateFormatA
GetTimeFormatA
LCMapStringW
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineA
GetSystemTimeAsFileTime
GetCPInfo
DecodePointer
EncodePointer
GetStringTypeW
InterlockedCompareExchange
RaiseException
LoadLibraryA
FreeLibrary
GetConsoleMode
GetTimeZoneInformation
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
HeapSize
GetStdHandle
HeapCreate
QueryPerformanceCounter
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
FlushFileBuffers
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA
FormatMessageA
SetHandleCount
GetFileType
SetFilePointer
GetUserDefaultLCID
user32
CreateDialogParamW
ShowWindow
PostMessageW
SetForegroundWindow
MessageBoxIndirectW
SendMessageW
GetWindowRect
LoadCursorW
RegisterClassExW
LoadIconW
SetWindowPos
CreateWindowExW
GetSystemMetrics
SetWindowTextW
DestroyIcon
MessageBoxW
DestroyWindow
GetParent
IsDialogMessageW
SendDlgItemMessageW
IsWindow
DispatchMessageW
TranslateMessage
GetMessageW
DefWindowProcW
SetWindowLongW
GetWindowLongW
PostQuitMessage
FindWindowExA
SendMessageA
GetShellWindow
GetWindowThreadProcessId
FindWindowW
advapi32
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
RegCloseKey
RegOpenKeyA
GetSecurityInfo
AllocateAndInitializeSid
SetSecurityInfo
SetEntriesInAclW
FreeSid
RegOpenKeyExW
DuplicateTokenEx
shell32
ShellExecuteW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteA
ole32
CoInitializeEx
CoCreateInstance
CoCreateGuid
CoUninitialize
oleaut32
VariantInit
VariantClear
SysFreeString
SysAllocString
Sections
.text Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ