Static task
static1
Behavioral task
behavioral1
Sample
f737f9fd8f64e1c851e04812babd85a301afcc18b21ba5afbc5af9e699f74328.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f737f9fd8f64e1c851e04812babd85a301afcc18b21ba5afbc5af9e699f74328.exe
Resource
win10v2004-20240611-en
General
-
Target
f737f9fd8f64e1c851e04812babd85a301afcc18b21ba5afbc5af9e699f74328
-
Size
3.0MB
-
MD5
fa44aeed9d087f475ba9844d3abf601c
-
SHA1
f39dad915f76a23c897c5621f3f36db5d8d074e6
-
SHA256
f737f9fd8f64e1c851e04812babd85a301afcc18b21ba5afbc5af9e699f74328
-
SHA512
1bdc6b3914d79fb676edc1945b592bbd9b9abe1a2d26aed4484e53645411522fdf98976cb77c6ee95901ab42acbbee47fe78adaa94fe4c06058adbbf1949f826
-
SSDEEP
98304:1WxnQjL2TM4tuNZv6SFbgZocilgknJ1g9+8LMRuT:1WeG8TB9SMq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f737f9fd8f64e1c851e04812babd85a301afcc18b21ba5afbc5af9e699f74328
Files
-
f737f9fd8f64e1c851e04812babd85a301afcc18b21ba5afbc5af9e699f74328.exe windows:5 windows x86 arch:x86
33cad3c4dcfa32e50442d1412d415563
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
WaitForMultipleObjects
Sleep
VirtualAlloc
VirtualFree
GetVersionExA
WaitForSingleObject
CreateEventA
SetEvent
ResetEvent
InitializeCriticalSection
GetExitCodeProcess
CreateProcessA
GetCommandLineW
GetVersionExW
lstrcmpiW
HeapAlloc
GetCurrentProcess
HeapFree
TerminateProcess
GetFileInformationByHandle
CreateFileA
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA
InterlockedExchange
SetStdHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LCMapStringA
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
InterlockedCompareExchange
FreeEnvironmentStringsA
HeapSize
ExitProcess
HeapCreate
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetFileAttributesA
GetFileAttributesW
GetModuleHandleA
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
FindClose
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
GetTempPathA
GetTempPathW
GetCurrentDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryA
SetCurrentDirectoryW
DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
GetModuleHandleW
GetProcAddress
RemoveDirectoryA
RemoveDirectoryW
SetFileAttributesA
SetFileAttributesW
SetLastError
CreateFileW
SetFileTime
CloseHandle
GetSystemDirectoryW
FormatMessageA
FormatMessageW
LocalFree
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
AreFileApisANSI
GetLastError
WideCharToMultiByte
MultiByteToWideChar
TlsGetValue
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
CreateThread
ExitThread
HeapReAlloc
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
DeleteCriticalSection
user32
CharUpperW
LoadStringA
LoadStringW
SendMessageA
CharUpperA
GetSystemMetrics
LoadIconA
EndDialog
KillTimer
SetTimer
PostMessageA
DestroyWindow
MessageBoxW
DialogBoxParamW
DialogBoxParamA
GetDlgItem
GetWindowLongA
SetWindowLongA
ShowWindow
SetWindowTextW
SetWindowTextA
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteExA
oleaut32
VariantClear
SysStringLen
SysAllocStringLen
Sections
.text Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 366KB - Virtual size: 366KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ