Static task
static1
Behavioral task
behavioral1
Sample
cc0bf8f58f6c34f7cdb10b932ab903027d2f26c5329ece5f9828aaf57cc57f7a.exe
Resource
win7-20240215-en
General
-
Target
cc0bf8f58f6c34f7cdb10b932ab903027d2f26c5329ece5f9828aaf57cc57f7a
-
Size
632KB
-
MD5
6a220f95a82a37f827b0a3e7a7292cfe
-
SHA1
18e395753472a37e34f16d1f83d7aa766c196357
-
SHA256
cc0bf8f58f6c34f7cdb10b932ab903027d2f26c5329ece5f9828aaf57cc57f7a
-
SHA512
8aa7fb85be1d05c52a9674391d3bbdbc675e985d1f5d35fa26418e7e839c0a94e7ea972e74db280138ad6e6714f3e856d9a2ac6b888b4c53da969db908a01669
-
SSDEEP
12288:wWP+XPmsfCLcRb1THkmfxYij9xuC7Rg1R6:0XPmiCLcXlX0
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cc0bf8f58f6c34f7cdb10b932ab903027d2f26c5329ece5f9828aaf57cc57f7a
Files
-
cc0bf8f58f6c34f7cdb10b932ab903027d2f26c5329ece5f9828aaf57cc57f7a.exe windows:5 windows x86 arch:x86
5ee00c650a4a4cef1dc48731c81da337
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFlags
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GetCPInfo
GetOEMCP
GetModuleHandleW
WritePrivateProfileStringA
FlushFileBuffers
SetEndOfFile
GetCurrentProcess
GetFullPathNameA
EnterCriticalSection
FileTimeToLocalFileTime
RtlUnwind
GetSystemTimeAsFileTime
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
GetCommandLineA
GetStartupInfoA
VirtualAlloc
HeapReAlloc
Sleep
ExitProcess
ExitThread
CreateThread
HeapSize
GetACP
IsValidCodePage
GetConsoleCP
GetConsoleMode
HeapCreate
VirtualFree
GetStdHandle
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
SleepEx
VerifyVersionInfoA
VerSetConditionMask
GetSystemDirectoryA
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
WaitForSingleObject
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
lstrcmpA
GetCurrentProcessId
GetModuleFileNameA
FileTimeToSystemTime
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
LoadLibraryA
SetLastError
MultiByteToWideChar
FreeLibrary
lstrcmpW
GetModuleHandleA
GetProcAddress
GetVersionExA
GetFileInformationByHandle
GetDriveTypeA
DeleteFileA
WriteFile
SetFileTime
GetFileAttributesA
CreateDirectoryA
LocalFileTimeToFileTime
lstrcpyA
lstrlenA
lstrcatA
GetCurrentDirectoryA
SystemTimeToFileTime
ReadFile
SetFilePointer
FindFirstFileA
FindClose
CreateFileA
GetLastError
CloseHandle
WideCharToMultiByte
LoadResource
LockResource
SizeofResource
FindResourceA
SetErrorMode
InterlockedDecrement
user32
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
IsWindow
GetWindowTextA
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
GetKeyState
SetMenu
LoadCursorA
SetForegroundWindow
IsWindowVisible
PostMessageA
GetSubMenu
GetMenuItemID
MessageBoxA
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
PtInRect
GetMenu
GetWindowLongA
SetWindowLongA
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetSysColorBrush
SetCursor
GetMessageA
UnregisterClassA
EnableWindow
SendMessageA
GetParent
GetWindowRect
TranslateMessage
GetCursorPos
ValidateRect
PostQuitMessage
GetWindowThreadProcessId
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
wsprintfA
GetClientRect
IsIconic
GetSystemMetrics
DestroyMenu
GetMenuItemCount
ReleaseDC
GetDC
GetActiveWindow
IsWindowEnabled
ShowWindow
SetWindowTextA
RegisterWindowMessageA
LoadIconA
WinHelpA
gdi32
SetMapMode
DeleteObject
RestoreDC
SaveDC
GetDeviceCaps
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
shell32
ShellExecuteA
oleaut32
VariantClear
VariantInit
VariantChangeType
shlwapi
PathFindExtensionA
PathFindFileNameA
oleacc
CreateStdAccessibleObject
LresultFromObject
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
RegCreateKeyExA
RegSetValueExA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
wldap32
ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46
ws2_32
setsockopt
ntohl
htonl
gethostname
ioctlsocket
listen
accept
recvfrom
sendto
getaddrinfo
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
WSACleanup
WSAStartup
WSASetLastError
__WSAFDIsSet
WSAGetLastError
select
recv
send
WSAIoctl
bind
getsockname
ntohs
crypt32
CertFreeCertificateContext
Sections
.text Size: 419KB - Virtual size: 419KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ