Static task
static1
Behavioral task
behavioral1
Sample
5b1fa517b2946aaffef1dab95a7b9410N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b1fa517b2946aaffef1dab95a7b9410N.exe
Resource
win10v2004-20240802-en
General
-
Target
5b1fa517b2946aaffef1dab95a7b9410N.exe
-
Size
1.2MB
-
MD5
5b1fa517b2946aaffef1dab95a7b9410
-
SHA1
7c6bc6c83ac3252e991e4d46ce2290e22a015bf9
-
SHA256
a596b2c0bae2f64fd73c7a037b358a79370a31634e787487c1b0c7f438a7a506
-
SHA512
8e6630fa0f3f1915a121f60134c3ca3400c9a7a6bed3cd03654bfd2ebeddcbae7d225aaf09a1a830ace2a9730b0391b779688c198682ba56fb17329c4823ae4e
-
SSDEEP
24576:BgbWallHsaG3vzH5lEy249GX1Vxb2Fzcpj1:BgS0lmzZNGsFU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b1fa517b2946aaffef1dab95a7b9410N.exe
Files
-
5b1fa517b2946aaffef1dab95a7b9410N.exe.exe windows:4 windows x86 arch:x86
78f2c304291eac3b2984858058531b26
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
memset
setlocale
wcslen
wcscpy
wcsncpy
wcscat
wcschr
_wcsicmp
memcpy
malloc
free
memmove
strncmp
isdigit
sprintf
strcpy
memcmp
sscanf
_stricmp
strlen
strcat
fread
longjmp
_setjmp3
fseek
ftell
_wfopen
fclose
_wcsdup
strstr
_strnicmp
strcmp
strncpy
wcscmp
wcsncmp
floor
tolower
pow
??3@YAXPAX@Z
wcsstr
_isnan
_wcsnicmp
swscanf
getenv
__p__iob
fprintf
realloc
frexp
modf
_CIpow
fopen
_errno
strerror
abort
atof
gmtime
fflush
fwrite
exit
ferror
calloc
strchr
strtol
strtoul
strrchr
qsort
fputs
strpbrk
_access
_read
_write
atoi
memchr
fputc
fgets
strspn
strcspn
isupper
_stati64
time
_ftime
_vsnwprintf
ceil
kernel32
GetModuleHandleW
HeapCreate
CreateMutexW
GetLastError
HeapDestroy
ExitProcess
HeapFree
CreateFileW
GetFileSize
HeapAlloc
ReadFile
CloseHandle
HeapReAlloc
WriteFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
CreateThread
Sleep
GetCurrentProcessId
GetCurrentThreadId
MultiByteToWideChar
GetCommandLineW
GetCurrentProcess
DuplicateHandle
CreatePipe
GetStdHandle
CreateProcessW
WideCharToMultiByte
SetFilePointer
SetEndOfFile
DeleteFileW
FreeLibrary
LoadLibraryExW
GetProcAddress
GetVersionExW
GetModuleFileNameW
GlobalLock
GlobalSize
GlobalUnlock
GlobalAlloc
GlobalFree
QueryPerformanceFrequency
QueryPerformanceCounter
GetTickCount
SetLastError
MulDiv
GetCurrentDirectoryW
GetDriveTypeW
FindFirstFileW
FindClose
GetFileAttributesW
CopyFileW
MoveFileW
SetFileAttributesW
FindNextFileW
CreateDirectoryW
TlsAlloc
HeapSize
TlsFree
TlsGetValue
TlsSetValue
DeleteCriticalSection
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
GetModuleHandleA
LoadLibraryA
GetSystemDirectoryA
VerSetConditionMask
VerifyVersionInfoA
SleepEx
ExpandEnvironmentStringsA
FormatMessageA
CreateFileA
GetFileSizeEx
UnregisterWait
GetCurrentThread
RegisterWaitForSingleObject
user32
GetDC
SetWindowLongW
LoadIconW
SetClassLongW
GetWindowLongW
SendMessageW
InvalidateRect
UpdateWindow
CallWindowProcW
MessageBoxW
PostMessageW
GetForegroundWindow
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
SystemParametersInfoW
ShowWindow
GetWindow
CreateWindowExW
GetParent
SetWindowTextW
GetWindowRect
MapWindowPoints
MoveWindow
RedrawWindow
GetWindowTextLengthW
GetWindowTextW
SetFocus
GetSysColor
GetSysColorBrush
SetRect
DrawTextW
GetSystemMetrics
ReleaseDC
SetPropW
GetPropW
RemovePropW
GetAsyncKeyState
GetIconInfo
ReleaseCapture
BeginPaint
DrawStateW
EndPaint
SetCapture
ScreenToClient
SetScrollPos
InflateRect
GetWindowDC
GetClientRect
GetFocus
FrameRect
DrawFocusRect
ValidateRect
RegisterClassExW
PeekMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
FillRect
GetScrollPos
DrawFrameControl
GetClassNameW
EnumPropsExW
SetActiveWindow
DestroyIcon
LoadCursorW
DestroyAcceleratorTable
CreateAcceleratorTableW
GetMenu
IsZoomed
IsIconic
MsgWaitForMultipleObjects
GetMessageW
GetActiveWindow
TranslateAcceleratorW
RegisterClassW
AdjustWindowRectEx
UnregisterClassW
GetKeyState
IsChild
EnumChildWindows
DefFrameProcW
RegisterWindowMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CreateIconFromResourceEx
CreateIconFromResource
CharLowerW
gdi32
GetDeviceCaps
DeleteObject
GetStockObject
CreateFontIndirectW
SetTextColor
SetBkColor
SelectObject
GetTextExtentPoint32W
GetObjectType
GetObjectW
ExcludeClipRect
CreateRectRgn
SelectClipRgn
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC
CreateDCW
CreatePen
MoveToEx
LineTo
CreateDIBSection
CreateRectRgnIndirect
GetClipRgn
ExtSelectClipRgn
CreateSolidBrush
GetDIBits
SetStretchBltMode
SetBrushOrgEx
StretchBlt
CreateBitmap
SetPixel
CreateFontW
ole32
CoInitialize
CoTaskMemFree
OleInitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
RevokeDragDrop
OleCreate
OleSetContainedObject
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
ws2_32
closesocket
WSACleanup
WSAStartup
socket
recv
WSAGetLastError
send
ntohs
WSASetLastError
getsockopt
setsockopt
getpeername
getsockname
htons
bind
connect
WSAIoctl
select
__WSAFDIsSet
getaddrinfo
freeaddrinfo
htonl
listen
accept
ioctlsocket
gethostname
ntohl
crypt32
CertFreeCertificateContext
CertOpenStore
CryptStringToBinaryA
CertFindCertificateInStore
CertCloseStore
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateChain
CryptQueryObject
CertAddCertificateContextToStore
CertGetNameStringA
winmm
timeBeginPeriod
msimg32
AlphaBlend
gdiplus
GdipDeleteFont
GdipDeleteGraphics
GdipDeletePath
GdipDeleteMatrix
GdipDeletePen
GdipDeleteStringFormat
GdipFree
GdipGetDpiX
GdipGetDpiY
uxtheme
SetWindowTheme
advapi32
RegCreateKeyExW
RegSetValueExW
RegCloseKey
SystemFunction036
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
comctl32
InitCommonControlsEx
ImageList_Replace
ImageList_Add
ImageList_ReplaceIcon
ImageList_Remove
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ImageList_GetIconSize
oleaut32
SysFreeString
VariantInit
DispGetParam
SysAllocString
VariantClear
SysStringLen
Sections
.code Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 845KB - Virtual size: 845KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 119KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ