Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_6514599453d1ea9225e47ff89612fd3e_xiaoba.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-23_6514599453d1ea9225e47ff89612fd3e_xiaoba.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_6514599453d1ea9225e47ff89612fd3e_xiaoba
-
Size
152KB
-
MD5
6514599453d1ea9225e47ff89612fd3e
-
SHA1
15216fb15bf508f93fe12f3b2af6e09f113d9f7e
-
SHA256
f2ae89dd89c5789f444023d27b7e2b7ce2bb3341e32242e1fffc7084a9de903f
-
SHA512
b74aba5c4853b48b247dc42985d80ccbc2bd3c62219b95a0b0990af15308cf474442c4f9326e686d8e2b23e383a1a171770a4c2d24dace91aa2d225cf9bfcca9
-
SSDEEP
1536:Tq0AeYAENCyudauTeku0ICCBJ5RCZ1F7bXLQfV7fr5xr5xstmy:TSAHbW0fCBJ+ZPr8fVj1xrUtX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-23_6514599453d1ea9225e47ff89612fd3e_xiaoba
Files
-
2024-05-23_6514599453d1ea9225e47ff89612fd3e_xiaoba.exe windows:4 windows x86 arch:x86
dded5e9f298d31ebd888169818686af7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchange
LCMapStringA
LoadLibraryA
GetProcAddress
SetStdHandle
IsBadCodePtr
FreeLibrary
GetModuleFileNameA
IsBadReadPtr
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
GetProcessHeap
GetCommandLineA
GetStringTypeW
GetStringTypeA
SetUnhandledExceptionFilter
GetModuleHandleA
SetFilePointer
LCMapStringW
Sleep
SetErrorMode
lstrcatA
lstrcpyA
lstrcpynA
lstrlenA
CloseHandle
GetCurrentThreadId
LocalAlloc
LocalFree
InitializeCriticalSection
TlsAlloc
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
TlsFree
LeaveCriticalSection
GlobalLock
GlobalReAlloc
GlobalAlloc
EnterCriticalSection
TlsSetValue
LocalReAlloc
TlsGetValue
InterlockedDecrement
GetVersion
SetLastError
GetLastError
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
GetProcessVersion
lstrcmpA
GlobalFlags
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetCurrentProcess
ReadFile
WriteFile
FlushFileBuffers
RtlUnwind
RaiseException
HeapSize
TerminateProcess
GetACP
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
user32
GetSubMenu
GrayStringA
DrawTextA
TabbedTextOutA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA
SetWindowsHookExA
CallNextHookEx
GetKeyState
SendMessageA
UnhookWindowsHookEx
LoadStringA
GetNextDlgTabItem
GetParent
GetFocus
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
GetSystemMetrics
GetWindowRect
GetWindowPlacement
IsIconic
SystemParametersInfoA
RegisterWindowMessageA
SetWindowPos
SetWindowLongA
GetWindowLongA
GetWindow
SetForegroundWindow
GetForegroundWindow
GetLastActivePopup
GetMessagePos
GetMessageTime
DefWindowProcA
RemovePropA
CallWindowProcA
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetDlgCtrlID
GetWindowTextA
GetDlgItem
GetMenuItemID
GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
EnableWindow
CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
IsWindowEnabled
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameA
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
gdi32
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
GetStockObject
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
GetDeviceCaps
DeleteObject
DeleteDC
SaveDC
RestoreDC
SelectObject
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
comctl32
ord17
Sections
.text Size: 100KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE