Static task
static1
Behavioral task
behavioral1
Sample
c426cd17e3e25a1dd58e353424963cbab6c954c577d25dbd87084147cd525874.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c426cd17e3e25a1dd58e353424963cbab6c954c577d25dbd87084147cd525874.exe
Resource
win10v2004-20240611-en
General
-
Target
c426cd17e3e25a1dd58e353424963cbab6c954c577d25dbd87084147cd525874
-
Size
2.0MB
-
MD5
85e038bbb7cbf58e0196f8cbf3f5f009
-
SHA1
546d96e8c92383a14496d5a720c6725afeda8d8d
-
SHA256
c426cd17e3e25a1dd58e353424963cbab6c954c577d25dbd87084147cd525874
-
SHA512
1304db391fb87a1be727448e28b27ffe8ff72ed40c93384a2a96dd0170d1f6102bca7657aa8a45ba9aa356143ecdf97de8c1a8ab3bdf646f63dd7c060244ad6b
-
SSDEEP
49152:alOLHKzenCm8EM8ib0zrlxHlRtc3wFrZGzxUX2:aMHKz+CPw3l5SwFrO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c426cd17e3e25a1dd58e353424963cbab6c954c577d25dbd87084147cd525874 -
NSIS installer 1 IoCs
resource yara_rule sample nsis_installer_2
Files
-
c426cd17e3e25a1dd58e353424963cbab6c954c577d25dbd87084147cd525874.exe windows:5 windows x86 arch:x86
b50af7b8c19c3e1ea861351887d7fc34
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
UrlUnescapeA
PathIsUNCA
StrStrA
PathFileExistsA
crypt32
CertCreateCertificateContext
CertGetNameStringA
CertFreeCertificateContext
CertNameToStrA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
wininet
InternetGetConnectedState
InternetOpenA
InternetConnectA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetErrorDlg
InternetSetOptionA
InternetQueryOptionA
DeleteUrlCacheEntry
InternetOpenUrlA
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetGetLastResponseInfoA
HttpQueryInfoA
InternetQueryDataAvailable
InternetCrackUrlA
InternetCanonicalizeUrlA
kernel32
SetErrorMode
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
VirtualQuery
ExitProcess
GetTimeFormatA
GetDateFormatA
GetCommandLineA
GetStartupInfoA
RtlUnwind
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
HeapCreate
GetACP
IsValidCodePage
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetStdHandle
SetHandleCount
LCMapStringA
LCMapStringW
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
WritePrivateProfileStringA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetVersion
GetOEMCP
GetCPInfo
GlobalFlags
GetFileTime
GetFileSizeEx
GetFileAttributesA
GetTickCount
GetFullPathNameA
GetConsoleMode
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
InterlockedExchange
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
CompareStringA
lstrcmpW
GetThreadLocale
GetModuleFileNameW
LocalAlloc
GetCurrentProcessId
SetLastError
MulDiv
GlobalUnlock
GlobalLock
GetDiskFreeSpaceA
CreateThread
GetExitCodeProcess
CreateProcessA
InterlockedIncrement
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
InitializeCriticalSection
GetPrivateProfileStringA
DeleteCriticalSection
LoadLibraryExA
RaiseException
lstrlenW
IsDBCSLeadByte
WaitForSingleObject
CreateMutexA
LoadLibraryW
GlobalFree
Sleep
DeviceIoControl
GlobalAlloc
GetTempPathA
GetVersionExA
CreateToolhelp32Snapshot
GetModuleHandleA
GetModuleFileNameA
GetSystemInfo
Process32Next
TerminateProcess
OpenProcess
WriteFile
GetWindowsDirectoryA
GetProcessHeap
Process32First
HeapFree
GetCurrentProcess
HeapAlloc
CreateFileA
CopyFileA
DeleteFileA
lstrlenA
GetSystemDirectoryA
CloseHandle
OpenMutexA
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryA
FindResourceA
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
MultiByteToWideChar
LocalFree
FormatMessageA
GlobalMemoryStatus
VirtualFree
user32
PostThreadMessageA
DestroyMenu
UnregisterClassA
LoadCursorA
GetSysColorBrush
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetCursor
GetMessageA
TranslateMessage
GetCursorPos
ValidateRect
MessageBeep
GetNextDlgGroupItem
GetActiveWindow
GetProcessWindowStation
GetUserObjectInformationW
GetSystemMetrics
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatA
CharUpperA
PostQuitMessage
ReleaseCapture
SetCapture
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
SetRect
IsRectEmpty
CopyAcceleratorTableA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
ModifyMenuA
EnableMenuItem
CheckMenuItem
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassNameA
SetPropA
GetPropA
wsprintfA
GetDesktopWindow
MessageBoxA
SendMessageA
EnableWindow
CharNextA
RegisterWindowMessageA
PostMessageA
CharNextW
GetKeyState
GetAsyncKeyState
LoadIconA
GetClientRect
IsIconic
DrawIcon
SetWindowPos
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
IsWindowEnabled
GetLastActivePopup
GetWindowLongA
GetParent
GetWindowThreadProcessId
UnhookWindowsHookEx
GetWindow
GetDlgCtrlID
CopyRect
PtInRect
OffsetRect
GetDlgItem
IsWindow
GetWindowRect
GetWindowPlacement
SystemParametersInfoA
RemovePropA
GetFocus
SetFocus
GetWindowTextA
GetForegroundWindow
SetActiveWindow
DispatchMessageA
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
SetMenu
SetForegroundWindow
IsWindowVisible
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
IntersectRect
gdi32
GetViewportExtEx
GetMapMode
GetWindowExtEx
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetDeviceCaps
GetStockObject
GetObjectA
GetBkColor
GetTextColor
GetClipBox
SetTextColor
SetBkColor
CreateBitmap
CreateRectRgnIndirect
GetRgnBox
SaveDC
RestoreDC
SetMapMode
DeleteObject
comdlg32
GetFileTitleA
winspool.drv
ClosePrinter
OpenPrinterA
DocumentPropertiesA
advapi32
RegEnumKeyA
RegOpenKeyA
RegQueryValueA
CloseServiceHandle
ControlService
OpenServiceA
OpenSCManagerA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
LookupAccountSidA
GetTokenInformation
OpenProcessToken
CryptGetKeyParam
CryptGetUserKey
CryptReleaseContext
CryptGetProvParam
CryptAcquireContextA
RegQueryValueExA
SetNamedSecurityInfoA
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
RegCloseKey
shell32
ShellExecuteA
comctl32
InitCommonControlsEx
oledlg
ord8
ole32
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
CoCreateInstance
StringFromGUID2
CoUninitialize
CoInitialize
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
oleaut32
SysFreeString
SysAllocStringLen
VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VarUI4FromStr
RegisterTypeLi
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantChangeType
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
urlmon
URLDownloadToFileA
Sections
.text Size: 409KB - Virtual size: 409KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 136KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6.7MB - Virtual size: 6.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ