madTraceProcess
Static task
static1
Behavioral task
behavioral1
Sample
b146388ae937b87e6bbfcfddec96815411009e7e0c0ad7c498b01a1000255ee4.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b146388ae937b87e6bbfcfddec96815411009e7e0c0ad7c498b01a1000255ee4.exe
Resource
win10v2004-20240611-en
General
-
Target
b146388ae937b87e6bbfcfddec96815411009e7e0c0ad7c498b01a1000255ee4
-
Size
3.9MB
-
MD5
0af738582954b633c9ae021a025e9b5e
-
SHA1
2551c81d6b9c36de14d73fb2f094e73bc90ba5df
-
SHA256
b146388ae937b87e6bbfcfddec96815411009e7e0c0ad7c498b01a1000255ee4
-
SHA512
76632b0867a6f417fd9bbd8b1ca0e8d8c8ca6554223d376bf5392f334bbb08d9cd86963c9a4c01d5022f2a8b23703aeaabe409bb6bb8e858d1facce8f868f614
-
SSDEEP
98304:KN7ADKFrwQguWlV4HYocOgFMw8i3HGo6Ua:KN7ADKFMQguWlV46ViH/T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b146388ae937b87e6bbfcfddec96815411009e7e0c0ad7c498b01a1000255ee4
Files
-
b146388ae937b87e6bbfcfddec96815411009e7e0c0ad7c498b01a1000255ee4.exe windows:4 windows x86 arch:x86
89bd9c0221917331540c6b8d6bb079de
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
oleaut32
SysFreeString
GetErrorInfo
SafeArrayPtrOfIndex
advapi32
RegQueryValueExA
SetSecurityDescriptorDacl
user32
GetKeyboardType
CreateWindowExW
MessageBoxTimeoutA
kernel32
GetACP
TlsSetValue
lstrlenW
RtlUnwind
Sleep
MulDiv
GetVersionExA
GetConsoleWindow
TryAcquireSRWLockExclusive
gdi32
UnrealizeObject
version
VerQueryValueW
wsock32
WSACleanup
shell32
ShellExecuteExA
SHGetPathFromIDListA
ole32
CoTaskMemFree
CLSIDFromString
wininet
HttpSendRequestExA
comctl32
_TrackMouseEvent
comdlg32
PrintDlgA
ws2_32
WSACloseEvent
psapi
GetProcessImageFileNameA
msvcrt
_onexit
iphlpapi
GetInterfaceInfo
Exports
Exports
Sections
.text Size: 2.4MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bluem2 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bluem2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ