Static task
static1
Behavioral task
behavioral1
Sample
967dc3f2ad3c692f9fba7893ba65585ccbd39555772e93898b0625025e2a7a73.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
967dc3f2ad3c692f9fba7893ba65585ccbd39555772e93898b0625025e2a7a73.exe
Resource
win10v2004-20240426-en
General
-
Target
967dc3f2ad3c692f9fba7893ba65585ccbd39555772e93898b0625025e2a7a73
-
Size
6.0MB
-
MD5
370052514f65a5f75c36685cc918419e
-
SHA1
085027848486952961757f5e74374d7999084fc6
-
SHA256
967dc3f2ad3c692f9fba7893ba65585ccbd39555772e93898b0625025e2a7a73
-
SHA512
37e04c2d1298fb584dd1a601cf29bafb94e6b4e576d52123f6eeecb0872807d2daac6a5805a4b13b799ec0bb4f880bd28e7625c29ad98946deddbba6efa8afbe
-
SSDEEP
98304:bMYHnKuCT+vqPIx1Z4zgZkI6iLiskb7EQCSGs5mx6dyUkFbgo2WUOLXxpbPG/CRr:mTT+hxWg+Lb7ESG2Wdgo2IDxpbLnGm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 967dc3f2ad3c692f9fba7893ba65585ccbd39555772e93898b0625025e2a7a73
Files
-
967dc3f2ad3c692f9fba7893ba65585ccbd39555772e93898b0625025e2a7a73.exe windows:6 windows x64 arch:x64
1cd1102d90411f12a73afeb1214598fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
oleaut32
SysAllocStringLen
VariantClear
SysStringLen
user32
GetParent
GetDesktopWindow
SetWindowLongPtrW
GetWindowLongPtrW
OffsetRect
CopyRect
GetWindowRect
SetTimer
SetWindowPos
LoadStringW
CharUpperW
SetWindowTextW
EndDialog
ShowWindow
DestroyWindow
PostMessageW
MessageBoxW
SendInput
KillTimer
SendMessageW
DialogBoxParamW
LoadIconW
GetDlgItem
shell32
ShellExecuteExW
CommandLineToArgvW
kernel32
FindFirstFileW
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwindEx
GetStdHandle
GetCommandLineW
ExpandEnvironmentStringsW
DecodePointer
CloseHandle
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
LocalFree
lstrlenW
AttachConsole
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
LoadLibraryExW
FormatMessageW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
RemoveDirectoryW
SetFileAttributesW
SetFileTime
GetTempPathW
SetLastError
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetSystemDirectoryW
GetModuleHandleW
GetProcAddress
FindClose
RtlUnwind
FindNextFileW
GetFileAttributesW
GetFileInformationByHandle
GetModuleHandleA
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
GetCurrentProcess
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
Sleep
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetVersion
InitializeCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventW
CreateSemaphoreW
EncodePointer
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
OutputDebugStringW
RaiseException
RtlPcToFileHeader
Sections
.text Size: 275KB - Virtual size: 274KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 193KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ