Static task
static1
Behavioral task
behavioral1
Sample
e9f8365c17670538eb0514ebeaefccfb801e58c809df657b05d42f0c78e484d8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e9f8365c17670538eb0514ebeaefccfb801e58c809df657b05d42f0c78e484d8.exe
Resource
win10v2004-20240611-en
General
-
Target
e9f8365c17670538eb0514ebeaefccfb801e58c809df657b05d42f0c78e484d8
-
Size
1.4MB
-
MD5
c0f5fd4a7eead930b4f0496fe7d5f417
-
SHA1
b3dfa90551b0eccbbb95ca58dd2b780008458735
-
SHA256
e9f8365c17670538eb0514ebeaefccfb801e58c809df657b05d42f0c78e484d8
-
SHA512
43669e6ec02a1ced37bfe2e8b4d2f26f1caa8e6eea02b4cde82e97deb41a54ef0911c28d3c422132b482ec3ae580252d3ac0c0a2c909acc419b4cee8713639e4
-
SSDEEP
24576:h95M0rZEL59hZOIgHIVh3cWNsMcK2bEcRNrHDaHSXbALG9xLxJGAl6upkJ:hw5xOjH09cWl4DaHXSxLx4ADaJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e9f8365c17670538eb0514ebeaefccfb801e58c809df657b05d42f0c78e484d8
Files
-
e9f8365c17670538eb0514ebeaefccfb801e58c809df657b05d42f0c78e484d8.exe windows:6 windows x86 arch:x86
968ec868a8b6d06db3aad7297c632965
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEnvironmentVariableW
WriteConsoleW
SleepEx
VerSetConditionMask
GetModuleHandleA
VerifyVersionInfoW
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LocalFree
LocalAlloc
SetPriorityClass
CreateFileA
DeviceIoControl
GetVersionExW
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetLocalTime
ExpandEnvironmentStringsA
GetEnvironmentVariableA
PeekNamedPipe
GetFileType
GetStdHandle
WaitForSingleObjectEx
QueryPerformanceFrequency
QueryPerformanceCounter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
GetTempPathW
FindFirstFileExW
GetCurrentDirectoryW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetSystemDirectoryW
MultiByteToWideChar
WideCharToMultiByte
WriteFile
SetFilePointer
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExW
MoveFileW
GetTickCount
CopyFileW
DecodePointer
DeleteFileW
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
CreateDirectoryW
GetDriveTypeW
ReadFile
GetFileSize
CreateFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetCurrentProcess
WaitForMultipleObjects
TerminateProcess
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
LoadLibraryW
GetProcAddress
FreeLibrary
Sleep
FindFirstFileW
FindClose
K32GetModuleFileNameExW
OpenProcess
GetCurrentProcessId
CreateMutexW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
GetStringTypeW
GetLocaleInfoW
SetStdHandle
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetFileSizeEx
GetConsoleCP
ReadConsoleW
GetConsoleMode
ExitProcess
SetFilePointerEx
FreeLibraryAndExitThread
ExitThread
CreateThread
GetFileInformationByHandle
LoadLibraryExW
RtlUnwind
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
LockFileEx
CreateFileMappingA
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileA
GetVersionExA
LoadLibraryA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
UnlockFileEx
SetEndOfFile
GetFullPathNameA
InitializeCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
InterlockedCompareExchange
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
SetFileTime
InitializeSListHead
RaiseException
IsValidCodePage
GetCurrentThreadId
GetStartupInfoW
FormatMessageW
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
EnterCriticalSection
LeaveCriticalSection
CompareStringW
LCMapStringW
IsProcessorFeaturePresent
user32
MonitorFromWindow
GetMonitorInfoW
CharLowerBuffA
wsprintfW
SendMessageW
MessageBoxW
GetWindowRect
GetClientRect
SetWindowRgn
IsZoomed
IsIconic
ShowWindow
PostQuitMessage
MessageBoxA
ScreenToClient
PostMessageW
gdi32
CreateRoundRectRgn
DeleteObject
advapi32
CryptDestroyHash
CryptAcquireContextW
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptHashData
CryptCreateHash
OpenProcessToken
GetTokenInformation
LookupAccountSidW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
CryptGetHashParam
CryptDestroyKey
shell32
SHCreateDirectoryExW
ShellExecuteW
SHGetPathFromIDListW
SHFileOperationW
SHBrowseForFolderW
ole32
CoTaskMemFree
CoSetProxyBlanket
OleUninitialize
OleInitialize
CoInitialize
CoCreateInstance
CoInitializeSecurity
CoUninitialize
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
duilib
?SetParaFormat@CRichEditUI@DuiLib@@QAE_NAAUPARAFORMAT2@@@Z
?SetTextColor@CRichEditUI@DuiLib@@QAEXK@Z
?IsReadOnly@CRichEditUI@DuiLib@@QAE_NXZ
?HandleMessage@WindowImplBase@DuiLib@@UAEJIIJ@Z
?OnFinalMessage@WindowImplBase@DuiLib@@UAEXPAUHWND__@@@Z
??1WindowImplBase@DuiLib@@UAE@XZ
??0WindowImplBase@DuiLib@@QAE@XZ
?SetForeImage@CControlUI@DuiLib@@QAEXPB_W@Z
?SetBkColor@CControlUI@DuiLib@@QAEXK@Z
?HandleMessage@CWindowWnd@DuiLib@@MAEJIIJ@Z
?SendMessageW@CWindowWnd@DuiLib@@QAEJIIJ@Z
?SetIcon@CWindowWnd@DuiLib@@QAEXI@Z
?CreateControl@WindowImplBase@DuiLib@@UAEPAVCControlUI@2@PB_W@Z
??BCWindowWnd@DuiLib@@QBEPAUHWND__@@XZ
?MessageHandler@CPaintManagerUI@DuiLib@@QAE_NIIJAAJ@Z
?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@PB_W@Z
?GetRoundCorner@CPaintManagerUI@DuiLib@@QBE?AUtagSIZE@@XZ
?GetCaptionRect@CPaintManagerUI@DuiLib@@QAEAAUtagRECT@@XZ
??8CDuiString@DuiLib@@QBE_NPB_W@Z
??BCDuiString@DuiLib@@QBEPB_WXZ
??1CDuiString@DuiLib@@QAE@XZ
??0CDuiString@DuiLib@@QAE@PB_WH@Z
?Offset@CDuiRect@DuiLib@@QAE_NHH@Z
??0CDuiRect@DuiLib@@QAE@ABUtagRECT@@@Z
??0CDuiRect@DuiLib@@QAE@XZ
?Create@CWindowWnd@DuiLib@@QAEPAUHWND__@@PAU3@PB_WKKHHHHPAUHMENU__@@@Z
?MessageLoop@CPaintManagerUI@DuiLib@@SAXXZ
?SetInstance@CPaintManagerUI@DuiLib@@SAXPAUHINSTANCE__@@@Z
?GetMessageMap@WindowImplBase@DuiLib@@MBEPBUDUI_MSGMAP@2@XZ
?Close@CWindowWnd@DuiLib@@UAEXI@Z
?GetStyle@WindowImplBase@DuiLib@@UAEJXZ
?GetSuperClassName@CWindowWnd@DuiLib@@MBEPB_WXZ
?GetZIPFileName@WindowImplBase@DuiLib@@UBE?AVCDuiString@2@XZ
?HandleCustomMessage@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?MessageHandler@WindowImplBase@DuiLib@@UAEJIIJAA_N@Z
?OnChar@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnClick@WindowImplBase@DuiLib@@MAEXAAUtagTNotifyUI@2@@Z
?OnClose@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnCreate@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnDestroy@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKeyDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnKillFocus@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnLButtonDown@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnLButtonUp@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseHover@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseMove@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnMouseWheel@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcActivate@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcCalcSize@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnNcPaint@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnSetFocus@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?OnWindowPosChanging@WindowImplBase@DuiLib@@UAEJIIJAAH@Z
?ResponseDefaultKeyEvent@WindowImplBase@DuiLib@@MAEJI@Z
?CenterWindow@CWindowWnd@DuiLib@@QAEXXZ
?FindControl@CPaintManagerUI@DuiLib@@QBEPAVCControlUI@2@UtagPOINT@@@Z
shlwapi
PathFileExistsW
PathFindFileNameW
SHCreateStreamOnFileEx
ws2_32
__WSAFDIsSet
WSAIoctl
setsockopt
socket
htons
WSACleanup
accept
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
connect
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
select
getpeername
ioctlsocket
gethostname
WSAStartup
bind
wldap32
ord46
ord41
ord14
ord216
ord145
ord219
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord208
iphlpapi
GetAdaptersInfo
bcrypt
BCryptGenRandom
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ