Static task
static1
Behavioral task
behavioral1
Sample
a13f0639c9499d28b62643ceddc67d0ef819c27ea8d3c8739c413f412f82d8ce.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a13f0639c9499d28b62643ceddc67d0ef819c27ea8d3c8739c413f412f82d8ce.exe
Resource
win10v2004-20240508-en
General
-
Target
a13f0639c9499d28b62643ceddc67d0ef819c27ea8d3c8739c413f412f82d8ce.exe
-
Size
408KB
-
MD5
0560631b08f979cc657bf38d905484e0
-
SHA1
d46ea09e7dca9a5e1eb90829852d04c88fc044a4
-
SHA256
a13f0639c9499d28b62643ceddc67d0ef819c27ea8d3c8739c413f412f82d8ce
-
SHA512
bb7317fc8c21b5bd2e748ab08874fda6a3eb6dd80eb1fbbd31008758e7c594e0220cd60536d0da7bcbca8ef147e10090ec23a5bf77075cabbf86b0e9c629f05b
-
SSDEEP
12288:h7+OeO+OeNhBBhhBBRhyBVLAaTeEWuKaLfmlFuA:hAhyDLAapWuKaLW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a13f0639c9499d28b62643ceddc67d0ef819c27ea8d3c8739c413f412f82d8ce.exe
Files
-
a13f0639c9499d28b62643ceddc67d0ef819c27ea8d3c8739c413f412f82d8ce.exe.exe windows:5 windows x86 arch:x86
3b7f953295b7893f34e9a0b26ca60300
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
GetModuleFileNameA
LockResource
GetVersionExA
lstrcpynA
lstrcpynW
MulDiv
GetTickCount
CopyFileA
GetTempFileNameA
GetTempPathA
DeleteFileA
Sleep
EnterCriticalSection
LeaveCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetFileAttributesA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
FlushFileBuffers
SetStdHandle
SetLastError
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
UpdateResourceA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
SetFilePointer
GetFileType
SetHandleCount
ReadFile
HeapSize
HeapReAlloc
HeapCreate
GetStdHandle
WriteFile
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDBCSLeadByte
lstrcmpiA
lstrlenA
InterlockedIncrement
InterlockedDecrement
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
BeginUpdateResourceA
GetCurrentProcess
FlushInstructionCache
UnmapViewOfFile
CreateFileMappingA
MapViewOfFileEx
CloseHandle
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetStartupInfoA
GetCommandLineA
ExitProcess
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualProtect
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
EndUpdateResourceA
FreeEnvironmentStringsA
GetCurrentThreadId
QueryPerformanceCounter
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
user32
GetDlgItemTextA
RegisterWindowMessageA
CheckMenuItem
UnregisterClassA
wvsprintfA
SetWindowLongA
SetForegroundWindow
GetWindowTextA
GetActiveWindow
ReleaseDC
GetDC
PostQuitMessage
InvalidateRect
GetTopWindow
IsDialogMessageA
GetWindowTextLengthA
PostMessageA
LoadStringW
SetFocus
SendMessageA
TranslateAcceleratorA
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
GetMenu
SetWindowPos
GetDlgItem
GetParent
SetDlgItemTextA
MapWindowPoints
SetWindowTextA
EndDialog
MessageBoxA
LoadStringA
LoadMenuA
LoadAcceleratorsA
DialogBoxParamA
CallWindowProcA
GetWindowLongA
CreateWindowExA
DestroyWindow
GetClassInfoExA
LoadCursorA
LoadImageA
RegisterClassExA
DefWindowProcA
CharNextA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
gdi32
DeleteDC
CreateFontA
DeleteObject
GetDeviceCaps
comdlg32
ReplaceTextA
GetOpenFileNameA
GetSaveFileNameA
FindTextA
advapi32
RegCreateKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
shell32
DragQueryFileA
DragAcceptFiles
ShellExecuteA
DragFinish
ole32
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
oleaut32
VarUI4FromStr
shlwapi
PathFileExistsA
comctl32
InitCommonControlsEx
ord6
Sections
.text Size: 231KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ