Static task
static1
Behavioral task
behavioral1
Sample
9a9fb69a67ecc96fff76647e3f18ff426c12cfa0cfa6534e1a0cd9f55ec59ddf.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9a9fb69a67ecc96fff76647e3f18ff426c12cfa0cfa6534e1a0cd9f55ec59ddf.exe
Resource
win10v2004-20240508-en
General
-
Target
9a9fb69a67ecc96fff76647e3f18ff426c12cfa0cfa6534e1a0cd9f55ec59ddf
-
Size
397KB
-
MD5
ada94401da7e756ac2099de37d545f48
-
SHA1
1149dbf0fc469de5ce0ed8bedbe87fbefdba6974
-
SHA256
9a9fb69a67ecc96fff76647e3f18ff426c12cfa0cfa6534e1a0cd9f55ec59ddf
-
SHA512
5421eb07e5f55c4051ba3c0ae514fa6f24b2940f1188c0e066d7f469c84b5d0956a4218e0b345c78ef2eef7ecd320a1f9652560c84d288ebf29f219ecc543a91
-
SSDEEP
3072:Cl/39AB3MUcBBEcPprLOyIYGuzSjoqkr72JPOeDrqXCPbBTo99dTGSa:ClP9A07zTNJsHrqXCtTo99dTxa
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9a9fb69a67ecc96fff76647e3f18ff426c12cfa0cfa6534e1a0cd9f55ec59ddf
Files
-
9a9fb69a67ecc96fff76647e3f18ff426c12cfa0cfa6534e1a0cd9f55ec59ddf.exe windows:4 windows x86 arch:x86
cee084317ff26f337f23228e5faba6ec
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
dbscreen
DFDBESET
DFDBFNTX
DFISTERMINAL
DFINITSCREENINIT
DFINITSCREENON
DFINITSCREENUPD
xpprt1
?prepareBinaryOpStack
?prepareUnaryOpStack
?ehIsError
?ehSetContext
?setjmp
?exeNativeError
?exeStackUnwind
?momSOn
?symContextInit
__vft18ConUndefinedObject10AtomObject
?conNAllocL
?momSOff
SETAPPWINDOW
?retStackItem
?conNRelease
?conNReleaseL
?frameExit
?ehUnwind
SET
?retNil
?domNot
?retStackValue
?passParameter
PCOUNT
PVALUE
?pushCodeBlock
VALTYPE
?domAssign
EVAL
?conNewCon
DLLLOAD
?callStack
?domAdd
DOSERROR
STR
ALLTRIM
MSGBOX
?conRelease
BREAK
ERRORBLOCK
DLLCALL
?ehUnsetContext
?ehGetBreakContainer
__vft19ConNumericIntObject10AtomObject
__vft21ConNumericFloatObject10AtomObject
__vft20ConStringConstObject10AtomObject
__vft14ConStringShort10AtomObject
APPNAME
?domValXEql
LEFT
_BREAK
?domRefElem
ACREATE
EMPTY
FILE
FOPEN
CHR
__vft14ConLogicObject10AtomObject
FCLOSE
?domGetElem
?andShortCut
?domAnd
?domNEql
?conNewNil
?conSendItem
?orShortCut
UPPER
?domXEql
?domOr
AEVAL
?domGCmp
FERASE
DLLPREPARECALL
LEN
FCREATE
MEMOREAD
STRTRAN
?domValSubStr
MEMOWRIT
DLLUNLOAD
APPDESKTOP
DIRECTORY
?domSubStr
ASCAN
DLLEXECUTECALL
FWRITE
SUBSTR
RAT
RIGHT
?domAddEqu
?domGECmp
AT
AADD
CONFIRMBOX
?domInc
?domLECmp
SPACE
FREAD
BIN2L
BIN2W
ARRAY
?domValLCmp
?domSub
?domValGCmp
?domMul
FSEEK
PAD
?nomClassLock
?nomClassUnlock
?retObject
?nomCreateClass
?nomDefineVar
?nomDefineMethod
?nomDefineVarMethod
?nomEndClassDefinition
?conNewExtObject
?nomCallInitClass
?conGetSelfClass
?conGetClass
?conAssignRefWMember
?domValEql
?conMemberToItem
?conOpNewInt
?domEql
?conNewString
BIN2U
TRIM
?floadTos
BIN2VAR
GETENV
L2BIN
VAR2BIN
?domValNEql
ASORT
?domLCmp
_iniExitProcedureList
___iniStart
___iniGetDLLInitHook
__This_executable_needs_version_1_50_0
___xpprt1Version
DBCOMMITALL
DBCLOSEALL
LTRIM
APPTYPE
ROW
COL
ALERT
SETPOS
ERRORLEVEL
_QUIT
PROCNAME
PROCLINE
ROOTCRT
PADL
TONE
QOUT
OUTERR
REPLICATE
DATE
TIME
VERSION
OS
VAR2CHAR
QQOUT
Sections
.text Size: 154KB - Virtual size: 154KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpp Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 213KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ