Gorgeous
Probka
Static task
static1
Behavioral task
behavioral1
Sample
c222122fe3e1206ba2363c17fb37ae2f8e271840e17b3bb9ba5359f2793f9574.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c222122fe3e1206ba2363c17fb37ae2f8e271840e17b3bb9ba5359f2793f9574.exe
Resource
win10v2004-20240226-en
Target
c222122fe3e1206ba2363c17fb37ae2f8e271840e17b3bb9ba5359f2793f9574
Size
234KB
MD5
ec0883bd8594cc34092a5e9a70a1b249
SHA1
4ba9c7d411006de1bf589eac2fa179d1d7120468
SHA256
c222122fe3e1206ba2363c17fb37ae2f8e271840e17b3bb9ba5359f2793f9574
SHA512
2cd9f53f426d1d083df8b81001c67d211546c79d6c4b66947d37cd603b5d65e38a137822b0b1e8b1149f55f1df1433f61aa64ca5ed4f6502353f0b5b879ce379
SSDEEP
3072:ikQyq9LPYIV2c4cWS3/gzrJibspWivFYMmgESdWylzs0i2EbrXlY5ql5Gw:ikI9LP5VGaIzkAvFYZgdWis0iVfpl
Checks for missing Authenticode signature.
Processes:
resource |
---|
c222122fe3e1206ba2363c17fb37ae2f8e271840e17b3bb9ba5359f2793f9574 |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
FindResourceExW
FindResourceW
LoadResource
SystemTimeToTzSpecificLocalTime
InterlockedIncrement
SetConsoleTextAttribute
GetCurrentProcess
GetModuleHandleExW
CancelWaitableTimer
ConnectNamedPipe
SetFileTime
GlobalAlloc
GlobalFindAtomA
GetSystemTimeAdjustment
GetFileAttributesA
TerminateProcess
FileTimeToSystemTime
GetLocaleInfoA
GetTimeZoneInformation
GlobalUnlock
GetConsoleOutputCP
SetLastError
SetFileAttributesA
GetAtomNameA
OpenWaitableTimerW
AddVectoredExceptionHandler
AddAtomW
GetTapeParameters
GlobalUnWire
VirtualProtect
LocalFree
lstrcpyW
CompareStringW
CompareStringA
WriteConsoleOutputCharacterW
GetCompressedFileSizeA
GetEnvironmentVariableW
GetStartupInfoW
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetLastError
HeapFree
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FatalAppExitA
VirtualAlloc
HeapReAlloc
HeapSize
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
SetStdHandle
WriteConsoleA
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
CreateFileA
CloseHandle
FlushFileBuffers
SetEnvironmentVariableA
GetMonitorInfoA
EnumDependentServicesW
ObjectPrivilegeAuditAlarmA
Gorgeous
Probka
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ