Static task
static1
Behavioral task
behavioral1
Sample
83a99d4fc2c5f1a52fb16071546178d7.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
83a99d4fc2c5f1a52fb16071546178d7.exe
Resource
win10v2004-20240226-en
General
-
Target
83a99d4fc2c5f1a52fb16071546178d7
-
Size
125KB
-
MD5
83a99d4fc2c5f1a52fb16071546178d7
-
SHA1
7580c3139d8cc571fa0e1944a5134ae82c9e2a69
-
SHA256
3ba43edc1d0170eb10d9c378a5bc914d07865b2284a200f75682522352b626b5
-
SHA512
6ceb30917aa46145ebba27ba49a0face0ba3cdb89bc7f1ff2fb0c6ab256ea205657468c150c11e480f303ea8a90dcc027c0e612adb3026e16a6f2e3a7a2510a3
-
SSDEEP
3072:kdPpaVj2FLa0ea0DS+W/vQ9Zqhiwso+OfYYpowBkflH:32yS/XQnqWZ8npoweH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83a99d4fc2c5f1a52fb16071546178d7
Files
-
83a99d4fc2c5f1a52fb16071546178d7.exe windows:1 windows x86 arch:x86
d40a573b19253c5773c6265e170a2179
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
c60runx
Cla$ACCEPTED
Cla$ADDqueue
Cla$CHOICE
Cla$CLEAR
Cla$clearstr
Cla$CLOSEwindow
Cla$code
Cla$COMMAND
Cla$comparestr
Cla$DEBUGHOOK
Cla$DecDistinct
Cla$DISPLAY
Cla$DISPOSEqueue
Cla$DPopLong
Cla$DPushLong
Cla$EndEventLoop
Cla$ERRORCODE
Cla$EVENT
Cla$FIELD
Cla$FILEERRORMSG
Cla$FILE_GETfk
Cla$FILE_NEXT
Cla$FILE_SET_PROPERTY
Cla$FREEqueue
Cla$FREEqueuea
Cla$freestr
Cla$freewindow
Cla$GETqueuekey
Cla$GETqueueptr
Cla$HIDE
Cla$init
Cla$KEYCODE
Cla$longtostr
Cla$MessageBox
Cla$NEWqueue
Cla$OPENwindow
Cla$paopen
Cla$pmopen
Cla$POINTERqueue
Cla$PopCString
Cla$PopString
Cla$PopTemp
Cla$PushCString
Cla$PushLong
Cla$PushString
Cla$pwopen
Cla$RECORDSqueue
Cla$SELECT
Cla$SetPropS
Cla$Stack2DStack
Cla$StackCLIP
Cla$StackConcat
Cla$StackConcatR
Cla$StackDEFORMAT2
Cla$StackErrstr
Cla$StackFORMAT2
Cla$StackHeap
Cla$StackINSTRING
Cla$StackLEFT
Cla$StackLen
Cla$StackLOWER
Cla$StackRotate
Cla$START
Cla$START1
Cla$StartEventLoop
Cla$StashBP
Cla$storestr
THR$GetInstance
Wsl$CloseDown
_exit
_free
_malloc
__sysinit
__sysstart
gen_infinity
$ACCESS:TMPTABLEFORLOOKUPS
$ACCESS:TMPTABLEFORQUERY
$GLO:COMPCODE
$GLO:COMPNAME
$GLO:DATABASENAME
$GLO:DBOWNER
$GLO:DBOWNERAUTONOTABLE
$GLO:SERVERNAME
$GLO:SPROGRAMOWNCODE
$GLOBALREQUEST
$GLOBALRESPONSE
$RELATE:TMPTABLEFORQUERY
$RELATE:XMLEXPORTTABLE
$TMPTABLEFORQUERY
$TMPTABLEFORUPDATE
$VCRREQUEST
$XMLEXPORTTABLE
ADDITEM@F13WINDOWMANAGER12TOOLBARCLASS
ASK@F13WINDOWMANAGER
CHANGEACTION@F13WINDOWMANAGER
CONSTRUCT@F10ERRORCLASS
CONSTRUCT@F10FUZZYCLASS
CONSTRUCT@F16ERRORSTATUSCLASS
CONSTRUCT@F8INICLASS
DELETEACTION@F13WINDOWMANAGER
DESTRUCT@F16ERRORSTATUSCLASS
DOCUMENTMASTER$DCM:RECORD
FETCH@F8INICLASSsbBw
GEN_INFINITY:INIT@F10ERRORCLASS8INICLASS
GEN_INFINITY:KILL@F
GETMYSQLDRIVER@F
INIT@F10ERRORCLASS16ERRORSTATUSCLASS
INIT@F10FUZZYCLASS
INIT@F13WINDOWMANAGER
INIT@F8INICLASSsbll
INSERTACTION@F13WINDOWMANAGER
KILL@F10FUZZYCLASS
KILL@F13WINDOWMANAGER
KILL@F8INICLASS
OPEN@F13WINDOWMANAGER
OPEN@F13WINDOWMANAGERBwBw
PRIMEFIELDS@F13WINDOWMANAGER
PRIMEUPDATE@F13WINDOWMANAGER
RESET@F13WINDOWMANAGERUc
RESTOREFIELD@F13WINDOWMANAGERl
RUN@F13WINDOWMANAGER
RUN@F13WINDOWMANAGERUsUc
SAVEONCHANGEACTION@F13WINDOWMANAGER
SAVEONINSERTACTION@F13WINDOWMANAGER
SETALERTS@F13WINDOWMANAGER
SETOPTION@F10FUZZYCLASSUcUc
SETPROCEDURENAME@F10ERRORCLASSOsb
SETRESPONSE@F13WINDOWMANAGERUc
TAKEACCEPTED@F13WINDOWMANAGER
TAKECLOSEEVENT@F13WINDOWMANAGER
TAKECOMPLETED@F13WINDOWMANAGER
TAKEDISABLEBUTTON@F13WINDOWMANAGERlUc
TAKEEVENT@F13WINDOWMANAGER
TAKEFIELDEVENT@F13WINDOWMANAGER
TAKENEWSELECTION@F13WINDOWMANAGER
TAKENOTIFY@F13WINDOWMANAGERlll
TAKEREJECTED@F13WINDOWMANAGER
TAKESELECTED@F13WINDOWMANAGER
TAKEWINDOWEVENT@F13WINDOWMANAGER
TMPTABLEFORLOOKUPS$TTL:RECORD
TMPTABLEFORQUERY$TTQ:RECORD
TYPE$TOOLBARCLASS
UPDATE@F13WINDOWMANAGER
UPDATE@F8INICLASSsbBw
VMT$ERRORCLASS
VMT$ERRORSTATUSCLASS
VMT$FUZZYCLASS
VMT$INICLASS
VMT$TOOLBARCLASS
XMLEXPORTTABLE$XML:BYCOMPCODE
XMLEXPORTTABLE$XML:RECORD
importexportdll
ACCEPTDATEFORDELETINGDOCUMENTS@F
AUTOSYNCDATAWITHOFLINE@F
CALLIMPORTTODATABASE@Fsb
CHECKEXPORTEDFILES@Fsb
EXPORTEDDOCUMENTSTOXMLFILE@Fsb
IMPORTEXPORTDLL:INIT@F10ERRORCLASS8INICLASS
IMPORTEXPORTDLL:KILL@F
MAIL@F
SETDEFAULTPATH@F
SETMAILADDRESS@F
SETSVGMASTERS@F
inventory
FILLCOMPONENTADDRESS@F
INVENTORY:INIT@F10ERRORCLASS8INICLASS
INVENTORY:KILL@F
masterentry
FILLDEFINATIONSQUEUE@F
FILLFUNCTIONADDRESSQUEUE@F
FILLSETTINGSINQUEUE@F
MASTERENTRY:INIT@F10ERRORCLASS8INICLASS
MASTERENTRY:KILL@F
menus
MENUS:INIT@F10ERRORCLASS8INICLASS
MENUS:KILL@F
PICKLISTDOCUMENTMASTER@Fl
registersandreports
REGISTERSANDREPORTS:INIT@F10ERRORCLASS8INICLASS
REGISTERSANDREPORTS:KILL@F
returndata
RETURNSTRING@Fl
user32
SystemParametersInfoA
validationfunctions
AUTHORISE_TR@F
GETDOCUMENTMASTERCODESTRING@Fl
READALLTABLEDEFINATIONS@F
READINIFILE@F
VALIDATIONFUNCTIONS:INIT@F10ERRORCLASS8INICLASS
VALIDATIONFUNCTIONS:KILL@F
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cwtls Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.cwdebug Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ