Static task
static1
Behavioral task
behavioral1
Sample
6116809acfac6247dd333b7ae37eece0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6116809acfac6247dd333b7ae37eece0N.exe
Resource
win10v2004-20240802-en
General
-
Target
6116809acfac6247dd333b7ae37eece0N
-
Size
4.5MB
-
MD5
6116809acfac6247dd333b7ae37eece0
-
SHA1
1afd901a233f96840d6b74c433865b946797eddc
-
SHA256
5e322915c06b8a233e8b37c05be3e2df7ea0a6ed6629b708c4606bdb41beb14e
-
SHA512
5dbf6e1dfab1d8bffb80568cdb7fa18dbdd6276895b587f6410dd124932dc4f9a965cc8464a673b528e1919109ea288374f2cf38b6904ebde3fb08939e2928ee
-
SSDEEP
98304:P9ldHPQj6QtL0Vwghfks7UtY3wcfGunyzHCd0sy+IhCxpDh:P9lxYDLRcfks7KYgclVpDh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6116809acfac6247dd333b7ae37eece0N
Files
-
6116809acfac6247dd333b7ae37eece0N.exe windows:4 windows x86 arch:x86
8da224bdff448e8d8146edee8d6fbc2d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FlushFileBuffers
FlushInstructionCache
FreeResource
GetACP
GetCurrentDirectoryW
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetExitCodeThread
GetFileAttributesW
GetLastError
GetLocaleInfoA
GetLocalTime
GetLogicalDriveStringsW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetProcessHeap
GetProcessTimes
GetStartupInfoW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadLocale
GetThreadPriority
GetVersionExA
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalDeleteAtom
GlobalFree
GlobalGetAtomNameW
GlobalLock
GlobalUnlock
HeapAlloc
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsProcessorFeaturePresent
GetSystemPowerStatus
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFileTimeToFileTime
LocalFree
LockResource
lstrcmpiW
lstrcpyW
lstrlenA
lstrlenW
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenEventW
OpenFileMappingW
OpenMutexW
OpenProcess
OutputDebugStringA
OutputDebugStringW
QueryDosDeviceW
QueryPerformanceCounter
RaiseException
ReadFile
FindResourceW
ReleaseMutex
RemoveDirectoryW
ResetEvent
ResumeThread
SetCurrentDirectoryW
SetEndOfFile
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SuspendThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitNamedPipeW
WideCharToMultiByte
WinExec
WriteFile
WritePrivateProfileSectionW
WritePrivateProfileStringW
WriteProcessMemory
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Module32FirstW
GetOEMCP
GetCPInfo
GetStringTypeW
GetStringTypeA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetCurrentProcess
TlsGetValue
TlsAlloc
TlsSetValue
HeapCreate
GetEnvironmentVariableA
LCMapStringW
LCMapStringA
ExitProcess
GetVersion
GetStartupInfoA
RtlUnwind
FindResourceExW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
ExpandEnvironmentStringsW
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateRemoteThread
CreateProcessW
CreateMutexW
CreateFileW
CreateFileMappingW
CreateFileA
CreateProcessA
GetCommandLineA
InitializeCriticalSection
EnterCriticalSection
GetTickCount
LeaveCriticalSection
GetCommandLineW
GetFileType
GetConsoleMode
LoadLibraryA
GetProcAddress
ReadProcessMemory
FreeLibrary
user32
SendMessageW
SetActiveWindow
SetCapture
SetCursor
SetFocus
SetForegroundWindow
SetRectEmpty
SetTimer
SetWindowLongW
SetWindowPos
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
ShowWindow
SystemParametersInfoW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassA
UpdateWindow
WindowFromPoint
wsprintfW
ReleaseCapture
RegisterWindowMessageW
RegisterClassExW
ScreenToClient
PostThreadMessageW
PostQuitMessage
PostMessageW
PeekMessageW
OffsetRect
MoveWindow
MapWindowPoints
LoadImageW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsWindowVisible
IsWindowEnabled
IsIconic
IsDialogMessageW
IsChild
InvalidateRect
IntersectRect
InflateRect
GetWindowThreadProcessId
GetWindowRect
GetWindowLongW
GetSystemMetrics
GetScrollPos
PtInRect
ReleaseDC
GetParent
GetNextDlgTabItem
GetMessageW
GetKeyState
GetForegroundWindow
GetFocus
GetDlgItem
GetDesktopWindow
GetDC
GetCursorPos
GetClientRect
GetClassInfoExW
GetActiveWindow
FindWindowW
FindWindowExW
FindWindowA
ExitWindowsEx
EqualRect
EnumDisplaySettingsW
EnableWindow
DrawTextW
DrawIconEx
DispatchMessageW
DestroyWindow
DestroyIcon
DefWindowProcW
CreateWindowExW
CopyRect
ClientToScreen
CharNextW
CharLowerW
MessageBoxA
GetDialogBaseUnits
GetDlgCtrlID
CallWindowProcW
advapi32
AdjustTokenPrivileges
CloseServiceHandle
CreateProcessAsUserW
DuplicateTokenEx
GetSecurityDescriptorSacl
GetTokenInformation
InitializeSecurityDescriptor
LookupPrivilegeValueW
OpenProcessToken
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExA
RegEnumKeyExW
RegOpenKeyExA
RegOpenKeyExW
RegOpenKeyW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegSetValueExW
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
ChangeServiceConfigW
shell32
CommandLineToArgvW
Sections
.text Size: 2.4MB - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.hss3 Size: 12KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 4.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 192KB - Virtual size: 191KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.iss3 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE