e:\work\20220420_6.0.6039.2722.R001\Bin\IsaSetup.pdb
Static task
static1
Behavioral task
behavioral1
Sample
7c671cc10d3bf8436f973d4204d735130f1212b16ca31b6f259a767dd4382cb5.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7c671cc10d3bf8436f973d4204d735130f1212b16ca31b6f259a767dd4382cb5.exe
Resource
win10v2004-20240508-en
General
-
Target
7c671cc10d3bf8436f973d4204d735130f1212b16ca31b6f259a767dd4382cb5
-
Size
6.9MB
-
MD5
a253286d3522a18a7efd144d4cfc8423
-
SHA1
e639be2b1c371f90b9c83485e313f07833f02c2b
-
SHA256
7c671cc10d3bf8436f973d4204d735130f1212b16ca31b6f259a767dd4382cb5
-
SHA512
cd7b4650b71a69ae46f12ae309ea34a0e093699cc104ada70408d3d8e28f453d0f912d426661fafcc7996ee97850803a07540cdaf3c8b66469439e4e862df64e
-
SSDEEP
196608:Uzhff2Vmtq0qQelwgssK4PTbTJJrjQeq1y91s:3QtqBQelXsUJe1yI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7c671cc10d3bf8436f973d4204d735130f1212b16ca31b6f259a767dd4382cb5
Files
-
7c671cc10d3bf8436f973d4204d735130f1212b16ca31b6f259a767dd4382cb5.exe windows:4 windows x86 arch:x86
13b4dac404c7bca8f5143c8a24f053bb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
Sleep
SetCurrentDirectoryA
GetModuleFileNameA
TerminateThread
OpenEventA
MultiByteToWideChar
GetEnvironmentVariableA
FreeLibrary
MoveFileExA
GetCommandLineA
WritePrivateProfileStringA
CreateThread
DeleteFileA
GetSystemDirectoryA
GetTempPathA
OpenMutexA
GetTickCount
LoadLibraryA
CloseHandle
GetLocalTime
SetDllDirectoryA
ResetEvent
SetEvent
GetTempFileNameA
GetExitCodeProcess
WaitForSingleObject
GetFileAttributesA
GetProcAddress
GetLastError
CreateEventA
GetCurrentProcessId
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlUnwind
OpenFileMappingA
FlushFileBuffers
GetFileAttributesExA
FormatMessageA
WriteFile
CreateFileA
GetFileSize
SetFilePointer
GetCurrentThreadId
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
GetVersion
Process32Next
GetCurrentProcess
QueryDosDeviceA
Process32First
TerminateProcess
ReadFile
GetModuleHandleA
GetWindowsDirectoryA
CreateMutexA
GetCurrentDirectoryA
GetStdHandle
CreateToolhelp32Snapshot
OpenProcess
SetLastError
SetFileTime
RemoveDirectoryA
CopyFileA
LocalFileTimeToFileTime
SetFileAttributesA
SetEndOfFile
FindClose
CreateFileMappingA
SystemTimeToFileTime
MoveFileA
FindNextFileA
CreateDirectoryA
GetFileTime
FindFirstFileA
InitializeCriticalSection
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileStringA
GetVersionExA
GetSystemInfo
GetProcessHeap
HeapReAlloc
HeapSize
HeapAlloc
HeapFree
DosDateTimeToFileTime
GetSystemTimeAsFileTime
GetStartupInfoA
InterlockedIncrement
InterlockedDecrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
ExitProcess
SetEnvironmentVariableA
SetEnvironmentVariableW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
user32
SetWindowTextA
EndDialog
GetSystemMetrics
ExitWindowsEx
DialogBoxParamA
MessageBoxExA
SendDlgItemMessageA
MessageBoxA
GetDlgItemTextA
advapi32
SetSecurityDescriptorDacl
AllocateAndInitializeSid
LookupPrivilegeValueA
FreeSid
GetTokenInformation
OpenProcessToken
CheckTokenMembership
GetSidSubAuthority
CreateProcessWithLogonW
AdjustTokenPrivileges
RegEnumKeyExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
CreateServiceA
ControlService
QueryServiceConfigA
QueryServiceStatusEx
QueryServiceStatus
OpenServiceA
CloseServiceHandle
OpenSCManagerA
DeleteService
ChangeServiceConfigA
StartServiceA
InitializeSecurityDescriptor
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
psapi
GetModuleFileNameExA
shlwapi
StrStrIA
ws2_32
select
socket
htons
__WSAFDIsSet
connect
gethostbyname
WSAGetLastError
WSASetLastError
ntohs
ntohl
recvfrom
sendto
setsockopt
closesocket
htonl
inet_addr
WSAStartup
bind
ole32
CoCreateInstance
CoUninitialize
CoInitialize
Sections
.text Size: 156KB - Virtual size: 152KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ