Static task
static1
Behavioral task
behavioral1
Sample
399dfe72dd1ada3d01f1ab5a5bce6f2f1181c2995caa0f19e3b03e4dd2f905d5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
399dfe72dd1ada3d01f1ab5a5bce6f2f1181c2995caa0f19e3b03e4dd2f905d5.exe
Resource
win10v2004-20240426-en
General
-
Target
399dfe72dd1ada3d01f1ab5a5bce6f2f1181c2995caa0f19e3b03e4dd2f905d5
-
Size
4.3MB
-
MD5
4ff314342c0e8fec976ac63d1e08cbb6
-
SHA1
b5fadd75bc7e0a057a756fb4f89472beff7120ec
-
SHA256
399dfe72dd1ada3d01f1ab5a5bce6f2f1181c2995caa0f19e3b03e4dd2f905d5
-
SHA512
3352e7e952d941a17b3d1b184cf8af4cfce3a81b646649dfd464218e32556b419ebe63d7142c078c65df2240952121fc58e2a9e23210071904ee19fef4c6c93a
-
SSDEEP
98304:4sUX9qjOqt9XM4nLW4HgWcLZwIqbKd4datiAhUMJAoMdzuG1/6Z70:jUX9m5K4AWOZwvmIkhUMQ/6x0
Malware Config
Signatures
-
Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL -
Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_SandboxProductID -
Detects executables referencing combination of virtualization drivers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 399dfe72dd1ada3d01f1ab5a5bce6f2f1181c2995caa0f19e3b03e4dd2f905d5
Files
-
399dfe72dd1ada3d01f1ab5a5bce6f2f1181c2995caa0f19e3b03e4dd2f905d5.exe windows:6 windows x86 arch:x86
7501d191ef725ef14f4c5d2745b8cfc3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CopyFileA
GetCommandLineW
GetCurrentThreadId
WideCharToMultiByte
GetTickCount64
CreateMutexA
SetLastError
ExpandEnvironmentStringsW
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
GetWindowsDirectoryW
lstrcmpiA
GetComputerNameExA
GetComputerNameA
lstrcmpiW
Sleep
FreeLibrary
LoadLibraryA
GetProcessHeap
IsWow64Process
GetSystemFirmwareTable
K32GetModuleBaseNameW
K32EnumProcesses
GlobalMemoryStatusEx
GetPhysicallyInstalledSystemMemory
GetDiskFreeSpaceExW
CloseHandle
GetCurrentProcess
GetLastError
GetFileAttributesA
LocalAlloc
LocalFree
VerifyVersionInfoW
VerSetConditionMask
ResumeThread
OpenMutexW
CreateProcessW
GetCurrentProcessId
CreateFileW
GetTempFileNameW
GetTempPathW
CreateThread
MultiByteToWideChar
GetModuleFileNameW
GetModuleFileNameA
GetModuleHandleW
WriteConsoleW
SetEndOfFile
DeleteFileW
GetFullPathNameW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
lstrcpyW
CreateMutexW
HeapAlloc
GetConsoleOutputCP
WaitForSingleObject
VirtualAlloc
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetSystemInfo
GetModuleHandleA
GetProcAddress
InitializeCriticalSectionAndSpinCount
FindResourceW
LoadResource
FreeResource
SizeofResource
LockResource
ExitProcess
GetACP
LoadLibraryW
GetCurrentDirectoryW
GetTickCount
MulDiv
GetFileSize
ReadFile
WriteFile
SetFilePointer
DuplicateHandle
SystemTimeToFileTime
GetFileType
DosDateTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocalTime
GetTempPathA
CreateFileA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
InitializeCriticalSection
DeleteCriticalSection
GetTempFileNameA
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
FormatMessageA
WaitForSingleObjectEx
GetExitCodeThread
GetNativeSystemInfo
GetStringTypeW
QueryPerformanceCounter
QueryPerformanceFrequency
EncodePointer
DecodePointer
InitializeCriticalSectionEx
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
CompareStringEx
GetCPInfo
InitOnceExecuteOnce
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
SetFileCompletionNotificationModes
SetEvent
CreateEventW
GetSystemDirectoryW
FormatMessageW
MoveFileExW
GetEnvironmentVariableA
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
SleepEx
GetFileSizeEx
RtlUnwind
InterlockedPushEntrySList
RaiseException
LoadLibraryExW
GetModuleHandleExW
SetConsoleCtrlHandler
ExitThread
FreeLibraryAndExitThread
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
GetFileAttributesExW
SetFilePointerEx
HeapFree
GetConsoleMode
ReadConsoleW
user32
wvsprintfW
SetCursor
LoadCursorW
SendMessageW
GetKeyState
DestroyWindow
ReleaseDC
GetDC
SetTimer
KillTimer
GetActiveWindow
GetWindow
SetFocus
BeginPaint
EndPaint
IsRectEmpty
GetUpdateRect
IsWindow
IsWindowVisible
IntersectRect
MapWindowPoints
CreateWindowExW
InvalidateRect
GetMessageW
TranslateMessage
DispatchMessageW
SetCapture
ReleaseCapture
GetParent
DefWindowProcW
EnableWindow
RegisterClassW
UnionRect
RegisterClassExW
CallWindowProcW
SetPropW
GetPropW
FillRect
InvalidateRgn
CreateAcceleratorTableW
GetGUIThreadInfo
ClientToScreen
MoveWindow
DrawTextW
SetRect
CharPrevW
CreateCaret
ShowCaret
HideCaret
GetCaretPos
SetCaretPos
GetSysColor
GetCaretBlinkTime
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
GetFocus
OffsetRect
SetWindowPos
SetWindowLongW
GetCursorPos
GetClientRect
PtInRect
ScreenToClient
GetWindowLongW
SetForegroundWindow
IsZoomed
FindWindowW
ShowWindow
SetWindowRgn
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClassInfoExW
IsIconic
LoadIconW
MessageBoxW
wsprintfW
PostMessageW
PostQuitMessage
TrackPopupMenu
AppendMenuW
CreatePopupMenu
CharNextW
advapi32
RegEnumKeyExW
GetUserNameW
RegCloseKey
RegOpenKeyExW
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
OpenProcessToken
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
RegOpenKeyExA
RegQueryValueExA
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExW
shell32
SHGetFolderPathW
SHCreateDirectoryExA
Shell_NotifyIconW
ShellExecuteW
CommandLineToArgvW
SHGetSpecialFolderPathW
ole32
CLSIDFromString
OleLockRunning
CoCreateInstance
CLSIDFromProgID
CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
CoInitialize
CreateStreamOnHGlobal
oleaut32
SysFreeString
SysAllocString
VariantClear
VariantInit
gdiplus
GdipGetFamily
GdipDeleteFontFamily
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipCloneBrush
GdipAlloc
GdipFree
GdipCreateLineBrushI
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdiplusShutdown
GdipDrawString
GdipDrawImageRectI
GdipGraphicsClear
GdipDrawImage
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageWidth
GdipGetImageHeight
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdiplusStartup
GdipCreateBitmapFromScan0
GdipDeleteBrush
shlwapi
PathCombineW
PathFileExistsA
PathFindFileNameA
ws2_32
gethostname
__WSAFDIsSet
WSASetLastError
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
WSAIoctl
inet_ntop
socket
accept
inet_pton
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
select
ntohs
htons
htonl
sendto
recvfrom
recv
connect
getpeername
WSAGetLastError
getsockopt
bind
closesocket
listen
send
setsockopt
ioctlsocket
getsockname
iphlpapi
GetAdaptersInfo
mpr
WNetGetProviderNameW
comctl32
_TrackMouseEvent
ord17
imm32
ImmSetCompositionFontW
ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext
gdi32
ExtSelectClipRgn
GetCharABCWidthsW
BitBlt
TextOutW
GdiFlush
GetObjectA
CreatePatternBrush
SetBkMode
SetWindowOrgEx
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
Rectangle
CreatePen
CreateFontIndirectW
SetTextColor
RoundRect
LineTo
MoveToEx
CreatePenIndirect
CreateSolidBrush
ExtTextOutW
SetBkColor
SetStretchBltMode
StretchBlt
CreateDIBSection
CombineRgn
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
GetDeviceCaps
GetTextMetricsW
GetStockObject
GetObjectW
DeleteObject
CreateRoundRectRgn
SaveDC
RestoreDC
GetTextExtentPoint32W
bcrypt
BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
secur32
DecryptMessage
EncryptMessage
FreeContextBuffer
QueryContextAttributesA
DeleteSecurityContext
CompleteAuthToken
AcceptSecurityContext
InitializeSecurityContextA
FreeCredentialsHandle
AcquireCredentialsHandleA
crypt32
CertCloseStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptStringToBinaryW
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertOpenStore
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.config Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 154KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 1.4MB - Virtual size: 5.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE