Static task
static1
Behavioral task
behavioral1
Sample
1993cbac8d107d4df8b504a8d20706b3180d6a0e15e3a9928924f00259404fd1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1993cbac8d107d4df8b504a8d20706b3180d6a0e15e3a9928924f00259404fd1.exe
Resource
win10v2004-20240226-en
General
-
Target
1993cbac8d107d4df8b504a8d20706b3180d6a0e15e3a9928924f00259404fd1
-
Size
972KB
-
MD5
b285c5f8bcd3eaf6ff545a9f7ac459ee
-
SHA1
94565e04ce82ca8949c8fd56568271e6683dcd69
-
SHA256
1993cbac8d107d4df8b504a8d20706b3180d6a0e15e3a9928924f00259404fd1
-
SHA512
232146fcd43896ccb5987fbac50dda473b49d1295198cf2f05451374d7024617ce356d011c56d21ee92cb74129ac79965a2165e2c0d392251d6bebb7cb222e40
-
SSDEEP
24576:5tnjMeLHtjHExKfWfafV+q0PHQih4PRvcn4OJI000eOchX:5to4tQQBoLaPRvcn4OW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1993cbac8d107d4df8b504a8d20706b3180d6a0e15e3a9928924f00259404fd1
Files
-
1993cbac8d107d4df8b504a8d20706b3180d6a0e15e3a9928924f00259404fd1.exe .ps1 windows:5 windows x86 arch:x86 polyglot
e8b54b2178280cf0dfd5032be293a18c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineW
GetDateFormatW
SearchPathW
FindFirstFileW
FindFirstChangeNotificationW
SetErrorMode
CreateProcessW
CompareFileTime
FindCloseChangeNotification
GetPrivateProfileStringW
GetTimeFormatW
GetStartupInfoW
GetLongPathNameW
FindClose
ExpandEnvironmentStringsW
GetLocaleInfoW
GetVersion
SetFileAttributesW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetPrivateProfileSectionW
GetWindowsDirectoryW
GetModuleHandleA
LockResource
WritePrivateProfileSectionW
GetLocalTime
SizeofResource
GetCurrentProcess
LoadResource
FindResourceW
FreeResource
lstrcpyA
LocalSize
GetOEMCP
lstrcmpiA
GetLastError
CreateFileW
ReadFile
WriteFile
SetEndOfFile
lstrcpynA
lstrlenA
lstrcmpA
GetFileSize
lstrcmpW
CreateThread
lstrcpyW
LocalFree
CloseHandle
lstrcatW
lstrcmpiW
CreateEventW
LocalAlloc
ResetEvent
GetCurrentDirectoryW
GetPrivateProfileIntW
WritePrivateProfileStringW
lstrlenW
ExitThread
GetModuleFileNameW
GetFileAttributesW
lstrcpynW
FormatMessageW
SetEvent
WaitForSingleObject
LCMapStringW
GlobalFree
IsValidCodePage
GlobalUnlock
WideCharToMultiByte
GlobalAlloc
GetTickCount
GetModuleHandleW
GlobalLock
GlobalSize
GetCPInfo
GetLocaleInfoA
DeleteCriticalSection
QueryPerformanceFrequency
FreeLibrary
LoadLibraryA
EnterCriticalSection
GetProcAddress
IsDBCSLeadByteEx
MultiByteToWideChar
GetACP
MulDiv
LeaveCriticalSection
GetVersionExW
LoadLibraryW
InitializeCriticalSection
QueryPerformanceCounter
FindNextChangeNotification
user32
IsIconic
RegisterWindowMessageW
ShowWindowAsync
PostQuitMessage
GetMessageW
TranslateAcceleratorW
ShowOwnedPopups
GetDlgItemTextW
SetDlgItemTextW
EnableWindow
EndDeferWindowPos
MessageBoxExW
GetPropW
DispatchMessageW
CloseClipboard
GetUpdateRgn
SetTimer
HideCaret
ScreenToClient
IsChild
PostMessageW
KillTimer
MsgWaitForMultipleObjects
IsClipboardFormatAvailable
SetFocus
ShowCaret
GetKeyboardLayout
GetScrollInfo
GetClipboardData
SystemParametersInfoW
IsZoomed
IsWindowUnicode
ScrollWindow
DestroyCaret
AppendMenuA
CreateCaret
OpenClipboard
SetCaretPos
RegisterClipboardFormatW
UpdateWindow
SetClipboardData
GetDlgCtrlID
GetCaretBlinkTime
SetScrollInfo
GetMessageTime
EndPaint
ClientToScreen
DestroyWindow
SetCursor
GetWindowRect
MonitorFromPoint
TrackPopupMenu
FillRect
SetCapture
UnregisterClassW
DrawTextW
DrawTextA
GetKeyState
GetFocus
GetParent
LoadCursorW
GetClientRect
GetSubMenu
EnumWindows
LoadAcceleratorsW
IsDialogMessageW
GetWindowPlacement
TrackPopupMenuEx
CheckMenuRadioItem
IntersectRect
LoadMenuW
GetClassNameW
EnableMenuItem
ChangeClipboardChain
IsWindow
SetMenuDefaultItem
MessageBoxW
RegisterClassW
IsWindowVisible
CountClipboardFormats
SetClipboardViewer
CheckMenuItem
DrawAnimatedRects
SetActiveWindow
CharUpperBuffW
DialogBoxIndirectParamW
SetForegroundWindow
GetMenuStringW
GetMenu
CreateDialogIndirectParamW
SetRect
GetMenuState
FindWindowExW
DeferWindowPos
SetWindowTextW
GetSystemMenu
CharNextW
IsWindowEnabled
wsprintfA
IsCharLowerA
IsCharUpperW
CharLowerW
CharLowerA
CharUpperW
IsCharLowerW
InsertMenuW
IsCharAlphaNumericA
GetWindowTextLengthW
GetDlgItemInt
RemovePropW
wvsprintfW
BeginDeferWindowPos
LoadImageW
MessageBeep
CharPrevW
wsprintfW
SetPropW
TranslateMessage
SetDlgItemInt
LoadIconW
IsCharAlphaNumericW
PeekMessageW
GetDlgItem
EndDialog
SendDlgItemMessageW
LoadStringW
CheckDlgButton
IsDlgButtonChecked
CheckRadioButton
MessageBoxIndirectW
EmptyClipboard
BeginPaint
GetDoubleClickTime
CreateIconIndirect
GetIconInfo
GetDC
DrawFocusRect
InflateRect
RegisterClassExW
InvalidateRect
GetWindowLongW
ReleaseDC
SetWindowLongW
DestroyCursor
GetSysColor
SetWindowPos
GetCursorPos
ShowWindow
CreatePopupMenu
FrameRect
CreateWindowExW
MonitorFromRect
DefWindowProcW
CallWindowProcW
GetMonitorInfoW
DestroyMenu
MapWindowPoints
SendMessageW
GetSystemMetrics
ReleaseCapture
AdjustWindowRectEx
gdi32
SelectObject
DeleteObject
SetBkMode
CreatePalette
SetBkColor
CreateFontIndirectA
StretchBlt
GetDeviceCaps
CreateFontIndirectW
CreateDIBSection
Polygon
DeleteDC
SetTextColor
LineTo
GetTextExtentPoint32A
GetTextExtentExPointW
GetTextExtentPoint32W
CreateCompatibleDC
MoveToEx
CreateRectRgn
CombineRgn
CreateBitmap
TranslateCharsetInfo
SetMapMode
EndDoc
StartDocW
CreateFontW
DPtoLP
StartPage
EndPage
EnumFontsW
GetTextExtentExPointA
GetNearestColor
CreatePatternBrush
CreatePen
CreateCompatibleBitmap
Rectangle
ExtTextOutW
Ellipse
SelectPalette
BitBlt
GetObjectW
RoundRect
SetTextAlign
IntersectClipRect
GetStockObject
ExtTextOutA
GetTextMetricsW
RealizePalette
CreateSolidBrush
advapi32
IsTextUnicode
GetTokenInformation
OpenProcessToken
shell32
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetMalloc
SHGetDataFromIDListW
SHAppBarMessage
SHAddToRecentDocs
SHGetFolderPathW
ord180
SHGetSpecialFolderPathW
SHCreateDirectoryExW
Shell_NotifyIconW
DragAcceptFiles
DragQueryFileW
DragFinish
ShellExecuteExW
shlwapi
PathRelativePathToW
UrlUnescapeW
StrCmpNIA
StrChrA
StrDupW
UrlEscapeW
StrCmpW
StrNCatW
StrCatBuffA
StrCpyNW
StrDupA
StrStrIA
StrChrIA
PathIsPrefixW
PathMatchSpecW
StrRetToBufW
PathQuoteSpacesW
PathUnquoteSpacesW
PathFileExistsW
StrChrW
SHAutoComplete
StrTrimW
PathRemoveFileSpecW
PathFindFileNameW
StrCatBuffW
PathIsUNCW
PathIsDirectoryW
PathFindExtensionW
StrStrW
PathIsRelativeW
StrCatW
PathCanonicalizeW
PathGetDriveNumberW
PathIsRootW
PathAppendW
StrCmpNIW
PathCommonPrefixW
PathCompactPathExW
StrRChrW
StrFormatByteSizeW
StrChrIW
PathRenameExtensionW
StrStrIW
StrCmpNA
StrTrimA
PathUnExpandEnvStringsW
comdlg32
ChooseFontW
PrintDlgW
PageSetupDlgW
GetSaveFileNameW
GetOpenFileNameW
ChooseColorW
comctl32
ImageList_AddMasked
ord8
CreateStatusWindowW
ImageList_Create
ImageList_Destroy
InitCommonControlsEx
imm32
ImmSetCompositionFontA
ImmReleaseContext
ImmGetCompositionStringW
ImmSetCompositionWindow
ImmNotifyIME
ImmGetContext
ole32
CoInitialize
CoUninitialize
RegisterDragDrop
DoDragDrop
OleUninitialize
OleInitialize
RevokeDragDrop
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
msvcrt
qsort
strncpy
memmove
strncat
clock
iscntrl
sscanf
_swab
swscanf
mktime
wcsftime
_ismbblead
memset
memcpy
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__getmainargs
_cexit
_exit
_XcptFilter
exit
_acmdln
_initterm
isspace
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_controlfp
toupper
isupper
strstr
strncmp
islower
_purecall
atoi
sprintf
isalpha
ispunct
strchr
??2@YAPAXI@Z
tolower
??3@YAXPAX@Z
isdigit
isalnum
_amsg_exit
__CxxFrameHandler
msvcp60
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
Sections
.text Size: 687KB - Virtual size: 686KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 138KB - Virtual size: 167KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ