Static task
static1
Behavioral task
behavioral1
Sample
cb76daa9be73f08540567bfb51a256be452a30dd6177a53e3d492baf98273e9f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb76daa9be73f08540567bfb51a256be452a30dd6177a53e3d492baf98273e9f.exe
Resource
win10v2004-20240226-en
General
-
Target
cb76daa9be73f08540567bfb51a256be452a30dd6177a53e3d492baf98273e9f
-
Size
4.0MB
-
MD5
85115ffb50d943ed7f59a76182fa558a
-
SHA1
4d34fc3bcfe3a1d7d2e01733889f376ba402c296
-
SHA256
cb76daa9be73f08540567bfb51a256be452a30dd6177a53e3d492baf98273e9f
-
SHA512
8014939b4758c2c577ba3695d41c84b48cea58326e113393b42b6c95ee741743a9e608b30f7f478c19f614210d3f347ca49a16691f07f94bf088824461eee0da
-
SSDEEP
98304:LMYHnKuJ5JUxEw2p3qP4axBE4kiI6At5ZPqkLcUks8SLRwnFck4wQ5E:WmnD1g4axBBLAt7CecUk3SkFck4wV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cb76daa9be73f08540567bfb51a256be452a30dd6177a53e3d492baf98273e9f
Files
-
cb76daa9be73f08540567bfb51a256be452a30dd6177a53e3d492baf98273e9f.exe windows:6 windows x64 arch:x64
1cd1102d90411f12a73afeb1214598fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
oleaut32
SysAllocStringLen
VariantClear
SysStringLen
user32
GetParent
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
OffsetRect
CopyRect
GetWindowRect
SetTimer
SetWindowPos
LoadStringW
CharUpperW
SetWindowTextW
EndDialog
ShowWindow
DestroyWindow
PostMessageW
MessageBoxW
SendInput
KillTimer
SendMessageW
DialogBoxParamW
LoadIconW
GetDlgItem
shell32
ShellExecuteExW
CommandLineToArgvW
kernel32
FindFirstFileW
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwindEx
GetStdHandle
GetCommandLineW
ExpandEnvironmentStringsW
DecodePointer
CloseHandle
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
lstrlenW
AttachConsole
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
FormatMessageW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetSystemDirectoryW
GetModuleHandleW
GetProcAddress
FindClose
RtlUnwind
FindNextFileW
GetFileAttributesW
GetFileInformationByHandle
GetModuleHandleA
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
GetCurrentProcess
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
Sleep
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetVersion
InitializeCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventW
CreateSemaphoreW
EncodePointer
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
OutputDebugStringW
RaiseException
RtlPcToFileHeader
Sections
.text Size: 275KB - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 198KB - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ