Static task
static1
Behavioral task
behavioral1
Sample
0e41fe22e0b950985bb4131dbd288200N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0e41fe22e0b950985bb4131dbd288200N.exe
Resource
win10v2004-20240709-en
General
-
Target
0e41fe22e0b950985bb4131dbd288200N.exe
-
Size
112KB
-
MD5
0e41fe22e0b950985bb4131dbd288200
-
SHA1
ae65dfbf31833da464f24a13def1b7b0bc108530
-
SHA256
7f30cad483dab68a005058170db9ca72a0f743ad81abb6be412907b8462d500b
-
SHA512
62261e9451fb2c5ec4e6d095f5a358b453343f61983d7221b99efc338e918e2adf6fc6f7a55242979eed4b8297aca740821563c89ae4a372789763c2fdc88688
-
SSDEEP
3072:pl78rm/tZ4+92xe+o9I6xWJYU8bvbfMJw:pl78Kq+9Oe+oHxMYU8bvb
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e41fe22e0b950985bb4131dbd288200N.exe
Files
-
0e41fe22e0b950985bb4131dbd288200N.exe.exe windows:4 windows x86 arch:x86
97e97c8d043f493a96116127f9fb5097
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
asctime
localtime
sprintf
__p__commode
strncat
memcpy
_controlfp
_except_handler3
__set_app_type
__p__fmode
time
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p__acmdln
exit
_XcptFilter
_exit
malloc
free
strlen
strcpy
strncmp
sscanf
_ftol
__p___mb_cur_max
_isctype
__p__pctype
atol
atof
strncpy
strcat
_splitpath
memset
printf
_stricmp
strcmp
kernel32
GlobalFree
LocalFree
LocalUnlock
LocalLock
LocalAlloc
GetModuleFileNameA
GlobalLock
GlobalAlloc
GetModuleHandleA
GlobalUnlock
GetStartupInfoA
user32
PeekMessageA
DestroyWindow
LoadIconA
LoadCursorA
RegisterClassA
CreateMenu
AppendMenuA
MessageBeep
InvalidateRect
DrawMenuBar
InsertMenuA
GetDesktopWindow
GetWindowRect
CreateWindowExA
SetWindowLongA
SendMessageA
ShowWindow
UpdateWindow
DispatchMessageA
ReleaseDC
GetDC
PostMessageA
TranslateMessage
SetWindowTextA
MoveWindow
GetFocus
MessageBoxA
EndDialog
BeginPaint
RegisterWindowMessageA
SetMessageQueue
SetDlgItemTextA
RemoveMenu
ReleaseCapture
DialogBoxParamA
EndPaint
GetWindowLongA
SetCapture
SetCursor
DefWindowProcA
WinHelpA
DrawTextA
nlsrtl33
ord4
ord2
ord3
ord6
ord117
ord175
ord201
ord203
ord11
ord127
ord233
ord227
ord237
ord179
ord276
ord248
ord246
ord281
ord174
ord268
ord279
ord231
ord215
ord214
ord224
ord278
ord277
nn60
ord132
ord131
ord85
ord4
ord136
ord28
uiw60
ord8002
ord1351
ord1021
ord1483
ord1461
ord8003
ord1077
ord1466
ord8005
ord1358
ord1267
ord1270
ord8011
ord1451
ord1486
ord8001
ord1477
ord11006
ord1269
ord8010
ord1277
ord1481
ord8006
gdi32
Rectangle
LineTo
GetDeviceCaps
SetROP2
SelectObject
MoveToEx
GetTextExtentPointA
GetTextMetricsA
DeleteObject
GetStockObject
CreatePen
ca60
ord107
ord2
ord60
ord92
ord345
ord99
ord98
ord5
ord3
ord421
ord95
ord94
ord101
ord340
ord77
ord56
ord59
ord69
ord54
ord526
ord527
ord487
ord354
ord346
ord106
ord75
ord492
ord485
ord489
ord484
de60
ord5422
ord481
ord5608
ord301
ord5599
ord3457
ord105
ord5598
ord190
ord3478
ord5070
ord709
ord3477
ord3374
ord214
ord210
mmi60
ord2
ord1
mms60
ord2
mmv60
ord2
mmw60
ord41
ora805
slgfn
slfnp
uirem60
ord250
ord174
ord184
ord255
ord195
sqllib80
SQLRCXGet
sqloew
sqlu2s
sqlcps
sqliap
sqlclu
sqls2u
sqloer
sqlexp
sqlcln
sqlofftb
sqltex
sqlret
sqlprc
sqgrct
sqgctx
sqlald
sqlcxt
qmg60
rwosk2nocomm
utc60
ord10
ord13
ord14
utl60
ord39
ord38
rwlib60
rxbcod
ruerformat
ruereget
rstmrut
rwffmdestroy
rstmst
ruereset
ropsdf
ropintcbs
rrrpensr
rxmbtc
rxglermcc
rxslrunprd
rimfr
rrdlba
rimal
ropintcp
srufrn
rxmcofcp
rrofnshd
rrodap
rxnname
rroahp
roulgs
relgtan
srwbcdcreate
relgtmn
rxmbtcrun
rxtdes
ropindeu
rwnole_InitWinOleInfo
rwnole_DestroyWinOleInfo
ropfin
rwbmas
rwbmnds
rwbmnhr
rwbmnmk
rwbwttl
rrrpensd
rimrat
rimfrt
rwbmngt
rxierr
rxmcmlgl
relgtsn
rxicep
rxslattach
rxglerclm
rxiefm
rxsldetach
rxmcmlfl
rxinit
rxfini
riulgf
rxmcmlf
rxmcml
rolgro
rwbmlo
riulgo
rxticl
rimalt
rrdps2put
ropubput
rrdps1get
ropubget
zrc60
zrcctcr_Create
zrcctco_Connect
zrcctgo_GetOutput
zrcctrs_RunReportSync
zrcctsa_SetAuthId
zrcctra_RunReportAsync
zrcctde_Destroy
zrcctdi_Disconnect
zrcctgg_GetOutputGeneral
Sections
.text Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ