P:\Target\x86\ship\dw\x-none\dwtrig20.pdb
Static task
static1
Behavioral task
behavioral1
Sample
262372ce5998ce0f80e57f4b759d3cdff340a2b54589dbd75502851d7f13bacf.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
262372ce5998ce0f80e57f4b759d3cdff340a2b54589dbd75502851d7f13bacf.exe
Resource
win10v2004-20240611-en
General
-
Target
262372ce5998ce0f80e57f4b759d3cdff340a2b54589dbd75502851d7f13bacf
-
Size
691KB
-
MD5
177aacccce5d4492ee5c401d9ee5bf14
-
SHA1
fcea4c7e06d1084c27bb5fc3923f7d4f595c8d11
-
SHA256
262372ce5998ce0f80e57f4b759d3cdff340a2b54589dbd75502851d7f13bacf
-
SHA512
e214799441687c0f50758f4a4a8a16d1d07e5e0b505e62e3f39c6f5e419df3396f9356c52e67316802be67189ece35bf7d8c6501561782f728fd982375ccf81d
-
SSDEEP
12288:iuoCJd4+kkQAzPqZ4iYaI7XHgZIKhJgeaXcCXEA55Ym6RRhFoi1iWb:ixCJd0kFuZ4iYFLHgZRJ8c2D55WRRIdW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 262372ce5998ce0f80e57f4b759d3cdff340a2b54589dbd75502851d7f13bacf
Files
-
262372ce5998ce0f80e57f4b759d3cdff340a2b54589dbd75502851d7f13bacf.exe windows:6 windows x86 arch:x86
cb27fa4539907986330c5d9119a5c301
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
advapi32
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
EventWrite
RegEnumKeyW
RegOpenKeyExA
RegQueryValueExA
RegGetValueW
EventRegister
EventUnregister
RegEnumValueW
RegQueryValueExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegQueryInfoKeyW
SetSecurityDescriptorDacl
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorDacl
GetLengthSid
EqualSid
CreateWellKnownSid
CopySid
AddAccessDeniedAce
AddAccessAllowedAce
GetTokenInformation
OpenProcessToken
kernel32
ReleaseMutex
GetSystemTimeAsFileTime
GetLocalTime
GetTickCount64
RaiseFailFastException
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileSize
ReadFile
GlobalMemoryStatusEx
GetSystemDirectoryW
GetNativeSystemInfo
GetProductInfo
GetModuleHandleW
GetProcAddress
GetTimeZoneInformation
GetUserGeoID
GetUserDefaultUILanguage
GetSystemDefaultLCID
GetUserDefaultLCID
CreateDirectoryW
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
CreateProcessW
GetTickCount
GlobalFree
LCIDToLocaleName
CreateMutexA
OpenMutexA
GlobalAlloc
GetACP
IsValidLocale
RaiseException
LeaveCriticalSection
HeapAlloc
HeapFree
GetProcessHeap
GetCommandLineW
HeapSetInformation
HeapReAlloc
HeapSize
EncodePointer
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitProcess
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
IsWow64Process
InterlockedDecrement
GetCurrentThread
HeapCreate
QueryPerformanceCounter
IsProcessorFeaturePresent
Sleep
GetCPInfo
GetOEMCP
IsValidCodePage
FreeLibrary
InterlockedExchange
LoadLibraryW
GetStringTypeW
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
LCMapStringW
SetStdHandle
WriteConsoleW
CreateFileW
FlushFileBuffers
GetFileAttributesW
GetLongPathNameW
GetShortPathNameW
GetSystemWindowsDirectoryW
lstrcmpiW
CompareStringW
CompareStringEx
GetVersionExW
GetSystemDefaultLocaleName
GetUserDefaultLocaleName
EnterCriticalSection
GetLastError
CloseHandle
WriteFile
SetFileAttributesW
DeleteFileW
DeleteCriticalSection
InitializeCriticalSectionEx
lstrlenW
GetModuleFileNameW
CreateEventW
WaitForSingleObject
SetEvent
RtlCaptureStackBackTrace
SetLastError
LocalAlloc
LocalFree
LoadLibraryA
GetTempPathW
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
GetModuleFileNameA
GetShortPathNameA
LocaleNameToLCID
ole32
CoCreateGuid
CoRevokeClassObject
StringFromCLSID
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateInstance
StringFromIID
CoRegisterClassObject
oleaut32
SysAllocString
SysFreeString
LoadRegTypeLi
LoadTypeLi
Sections
.text Size: 230KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 211KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 246KB - Virtual size: 248KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ