Static task
static1
Behavioral task
behavioral1
Sample
168afff5bca73298edce9df018e56a3cd8a69da0482e6182854cf3be3ecf08be.exe
Resource
win7-20240221-en
General
-
Target
168afff5bca73298edce9df018e56a3cd8a69da0482e6182854cf3be3ecf08be
-
Size
4.2MB
-
MD5
98a852cda788440cab54d1dfb36423e3
-
SHA1
8d9e1e673cc8aa0868e48ee10387276d997f3e0c
-
SHA256
168afff5bca73298edce9df018e56a3cd8a69da0482e6182854cf3be3ecf08be
-
SHA512
360fe04274200c63c0e5628cff45f5e2b854106a3cdb0c760630f0601269275cf6296ff40d66af4de4d3fc620a8b69e74d500e88136cc8d6831fcede3bece5a5
-
SSDEEP
98304:6uyrGypqI+jQNI2yZdVf1PPEbZeKJfOVA1nr687HqeA:urGyDNIhzK8AxHKL
Malware Config
Signatures
Files
-
168afff5bca73298edce9df018e56a3cd8a69da0482e6182854cf3be3ecf08be.exe windows:5 windows x86 arch:x86
c759b7fd0dfe508d1b8a0bc5f7e876f1
Code Sign
15:1c:74:4d:fe:cd:7a:e0:73:85:87:56:b1:37:47:8eCertificate
IssuerCN=522a143c46533d0e442f37555c2422100a1455182550573d31351d0f013134332d19,POSTALCODE=10815,ST=0b1c1115005f5c4e161100021c001003011215104d0a110f+ST=0b1c1115494a5c05125116195f151d00521f0d135111515d03161110070d03151709010f5103081c0b00040b545d06080b0b050e060b08091d5301090612055b0c0b0a070bNot Before15-04-2024 15:50Not After15-04-2025 15:50SubjectCN=522a143c46533d0e442f37555c2422100a1455182550573d31351d0f013134332d19,POSTALCODE=10815,ST=0b1c1115005f5c4e161100021c001003011215104d0a110f+ST=0b1c1115494a5c05125116195f151d00521f0d135111515d03161110070d03151709010f5103081c0b00040b545d06080b0b050e060b08091d5301090612055b0c0b0a070b6c:04:b1:c2:ae:ad:7f:1a:f4:18:3a:dc:10:76:b2:a1:ee:3f:0b:3c:a7:51:09:ea:32:df:b5:ac:4a:c7:44:7cSigner
Actual PE Digest6c:04:b1:c2:ae:ad:7f:1a:f4:18:3a:dc:10:76:b2:a1:ee:3f:0b:3c:a7:51:09:ea:32:df:b5:ac:4a:c7:44:7cDigest Algorithmsha256PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
C:\wunerexopi-lucabewakabuti yonixip_vubaza.pdb
Imports
kernel32
DebugActiveProcess
SetThreadContext
FindVolumeClose
GetConsoleAliasExesLengthA
GetConsoleAliasA
GetCurrentProcess
WriteConsoleInputA
CreateHardLinkA
GetNumberFormatA
GetWindowsDirectoryA
GetUserDefaultLangID
GlobalFindAtomA
LoadLibraryW
TerminateThread
GetLocaleInfoW
ReadConsoleInputA
ReadProcessMemory
WriteConsoleW
GetCompressedFileSizeA
GetLastError
ChangeTimerQueueTimer
GetThreadLocale
RemoveDirectoryA
CopyFileA
VirtualAllocEx
GetNumaHighestNodeNumber
LoadLibraryA
LocalAlloc
SetCalendarInfoW
GetCommMask
AddAtomA
GetModuleFileNameA
GetOEMCP
FindFirstChangeNotificationA
VirtualProtect
FindNextVolumeA
SetFileAttributesW
GetVolumeInformationW
SetEndOfFile
CreateFileW
ReadConsoleW
OutputDebugStringW
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
HeapFree
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetCurrentThreadId
IsDebuggerPresent
GetStdHandle
GetFileType
GetProcessHeap
ExitProcess
GetModuleHandleExW
AreFileApisANSI
HeapSize
CloseHandle
WriteFile
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
ReadFile
SetStdHandle
FlushFileBuffers
user32
GetMenuInfo
winhttp
WinHttpReadData
Sections
.text Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4.0MB - Virtual size: 44.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ