Static task
static1
Behavioral task
behavioral1
Sample
ce9c630b38ec39ca9af8e7a89cd2d5b65c614ba15971a945c89d00f29f4000ff.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ce9c630b38ec39ca9af8e7a89cd2d5b65c614ba15971a945c89d00f29f4000ff.exe
Resource
win10v2004-20240226-en
General
-
Target
ce9c630b38ec39ca9af8e7a89cd2d5b65c614ba15971a945c89d00f29f4000ff
-
Size
112KB
-
MD5
5f86f31ba44153ae69fd612cdbfce7b5
-
SHA1
d00c376d757cdb0e2a671f61f60ed35bbc5c3ee5
-
SHA256
ce9c630b38ec39ca9af8e7a89cd2d5b65c614ba15971a945c89d00f29f4000ff
-
SHA512
11cc9390262c5481c3171c8fc3d2198a51d7b252508161fabe945d8dc7d78929ea43d62f170ae6abc053cdcdf295ae96e4ab6a3c566249c46b9863b25d3719eb
-
SSDEEP
1536:gAXaPDv21QAldl9hhluffQhoXpxQ9onMsytkIFmAG/m:gAXa7v21QALNuIMpC9oMyIQ/m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce9c630b38ec39ca9af8e7a89cd2d5b65c614ba15971a945c89d00f29f4000ff
Files
-
ce9c630b38ec39ca9af8e7a89cd2d5b65c614ba15971a945c89d00f29f4000ff.exe windows:4 windows x86 arch:x86
be0eaafe1f97eb7f7a6c2438e53fae22
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
bc32fn
ZNDIR
BCXGetDirList2
ZBCMSG
SetOutParmsPrinter10
SetPrintPageParms3
MakeDirectory
SplitPath3
SetOutDev4
SetOutParmsFile16
SetOutParmsEmail19
SetOutParmsCoverFax
SetOutParmsFax2
GetOutParmsPrinter4
GetOutParmsFile6
GetOutParmsEmail11
GetOutParmsCoverFax2
GetOutParmsFax6
ZBCERR
BCGetFileSize
SkipLRBlk
pFrmtBuffer
VARLIST
TABOffset
RPEE
RFLV
RPED
RADDR
CheckProto
ZNPRINTERS
GetPrinters2
WSP
GetPrinterInfo5
WS
StrAdd
FormatNumber
szTmpBuf
AllocLocalData
pvTerminateProgram
FreeLocalData
DBDatabase
DBClose
DBXAccess
BcxExit
ZPREXTEND
bPrintFileName
bGetActualArgsExv
ZEXVARG
PropertiesEx
ZTRADVER
ZMINVER
ZMINVERUX
pszCurrentModule
GetLineArgs
SkipRightBlk
StrToUpper
CallDllFunction2
PHB
AddSl
pInfoExe
GetIDSInfo
CallBCFunction
bOptimizeSearch
iNewFrmSpec
pszSUBProto
psArgv
iArgc
CallAllPrograms
PROGC
ZNOMEXE
BcMain2
BCXCopy
bc32ui
DefineCellGrid15
InsertRowGrid9
GetXMLData4
RunPrintJob
WgsMessageBoxEx
WgsSetUncheckedKeys
WgsSetDefinedKeys
WgsSetEnabledKeys
DefinePrintJob4
CopyPrintJob
UpdateXMLData2
ExitSub
DefinePos4
LoadControlStruct
DefineEdit11
DefineLabel3
DefineGroupBox3
EntrySub2
DelPrintJob
SetCellGrid8
BlobAdd
BlobMid
BlobInstr
BlobCmpString
FreeBlob
pszDecodMessage
wKeyFlags
RTAB
RRA
RIF
RO
SetButtonEnable
ZGRIGHE_TOT
DefineComposite3
DefineVarsEx2
InsertVarsEx2
KillProcess
WgsRestoreWindow
DefineComboOptionsArray
DefineRadioOptions3
DefineRadioButton
DefineTVDouble
ExecProcess4
GettingRowGrid2
SetRadioEnable
DefineFormat
DefineTVString
InsertColGrid9
DefineXMLElement3
DefineXMLAttr3
TraceDebug2
pszID
DefineWindow10
DefineGrid27
DefineAdvGridCollapseGroup
DefineButtonIvt
RRI
RCI
RunWindow6
ZVIDCOMPVIS
WgsRestoreInputData
ZGRIGA
DBCreateVars2
DBDefineStructs
CANVID
EntryInitProgramData
cRowsRI
cColsRI
RI
KYM
ExitInitProgramData
EntryTerminateProgram
DBRemoveVars
RCCHAN
WgsInitData
ExitTerminateProgram
szProgramName
ABC
RCSRCH
SearchSTR
WgsExitAppThread
WgsInitID
ZDECOD
kernel32
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
GetProcAddress
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
LoadLibraryA
LCMapStringA
LCMapStringW
ExitProcess
Sections
.text Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ