D:\Dev\VisualStudioProjects\Koalageddon\_Build\Release\IntegrationWizard32.pdb
Resubmissions
21-05-2024 14:05
240521-rd4fzage63 3Static task
static1
Behavioral task
behavioral1
Sample
IntegrationWizard32.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
IntegrationWizard32.exe
Resource
win10v2004-20240226-en
General
-
Target
IntegrationWizard32.exe
-
Size
614KB
-
MD5
8d188050b9e4c0a5f0f24fcea65b1133
-
SHA1
3b1d04ee1adec2cd53d8721aee45fc112b5700da
-
SHA256
6c2e59b3ecc0e453a141e7229e25cafeb286ebe27c0c68096c18bfb3ce97b50a
-
SHA512
e220c535bd4bcc6897eb892e5731ad6e78ffb6d642dffb2ae104e8b5d642cdb53bd2a8e3e90ca62c7b199f85559467f2af0ebee62c1e75b3ca5e2e90c1b53ba8
-
SSDEEP
12288:8iB7dH1DCGUOdUQ0W+c2B7iQnPnaUwwi99Jygpji//y1z79clq1HIJA+lv:845NUdvaUwwD6i//Y39tZIJAS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource IntegrationWizard32.exe
Files
-
IntegrationWizard32.exe.exe windows:6 windows x86 arch:x86
3db2ee350b7dbe0381d54d990a176f86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
LoadResource
FindResourceW
GetEnvironmentVariableW
GetCurrentProcess
GetLastError
WideCharToMultiByte
DeleteFileW
HeapSize
SizeofResource
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
LockResource
WriteConsoleW
OpenProcess
K32GetModuleFileNameExW
GetModuleFileNameW
CreateToolhelp32Snapshot
Process32FirstW
lstrcmpiW
Process32NextW
CloseHandle
TerminateProcess
WaitForSingleObject
Sleep
MultiByteToWideChar
GetCurrentProcessId
GetDynamicTimeZoneInformation
WriteConsoleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteFile
GetStdHandle
GetConsoleMode
GetFileAttributesW
LocalFree
FormatMessageA
QueryPerformanceCounter
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CopyFileW
GetFileInformationByHandleEx
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
GetExitCodeThread
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
InitializeSListHead
RtlUnwind
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
SetStdHandle
GetFileType
GetTimeZoneInformation
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileSizeEx
FlushFileBuffers
GetConsoleOutputCP
ReadFile
ReadConsoleW
GetCurrentThreadId
user32
MessageBoxW
MessageBoxA
advapi32
RegSetValueExW
SetNamedSecurityInfoW
SetEntriesInAclW
GetNamedSecurityInfoW
CreateWellKnownSid
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyExW
RegGetValueW
shell32
ShellExecuteW
SHGetKnownFolderPath
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
comctl32
ord345
Sections
.text Size: 408KB - Virtual size: 407KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 99KB - Virtual size: 99KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ