Static task
static1
Behavioral task
behavioral1
Sample
ad66b891cc6ab6c77bed2bacbf1a6121a4d8ad13c0966faf66fbe855bed26e99N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ad66b891cc6ab6c77bed2bacbf1a6121a4d8ad13c0966faf66fbe855bed26e99N.exe
Resource
win10v2004-20240802-en
General
-
Target
ad66b891cc6ab6c77bed2bacbf1a6121a4d8ad13c0966faf66fbe855bed26e99N
-
Size
128KB
-
MD5
f292da9789bc9905f44d8ae9712a4f30
-
SHA1
161b8d4047fd25b7e6442da5be91a7c0d7af6209
-
SHA256
ad66b891cc6ab6c77bed2bacbf1a6121a4d8ad13c0966faf66fbe855bed26e99
-
SHA512
eac246a7c34c36a38ec9dc6ec37f06b6126caaeae11fd7fe3e291a9e2399e8a0c9c92d2f4bc2751107117dfba15c243e7d331f6d520648acdec378dabbbe00d9
-
SSDEEP
1536:wMJB5S+MokoCWwniPLl6Bh6ZyySRi2OLhHRUtr1CLZxmZ3uENFn:N5QePIVyS6hHGtr1mPaugFn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad66b891cc6ab6c77bed2bacbf1a6121a4d8ad13c0966faf66fbe855bed26e99N
Files
-
ad66b891cc6ab6c77bed2bacbf1a6121a4d8ad13c0966faf66fbe855bed26e99N.exe windows:4 windows x86 arch:x86
daca055f3c647183f6d0b7627a1288fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord8
kernel32
LoadLibraryA
GetProcAddress
FreeLibrary
RemoveDirectoryA
GetFileAttributesA
SetFileAttributesA
lstrcmpiA
lstrlenA
MoveFileExA
GetShortPathNameA
GetWindowsDirectoryA
GetPrivateProfileSectionA
WritePrivateProfileSectionA
GetCurrentProcess
GetLastError
GetModuleFileNameA
GetTickCount
IsDBCSLeadByte
OpenEventA
SetEvent
CloseHandle
OpenProcess
WaitForSingleObject
Sleep
VirtualProtect
WinExec
GlobalSize
CreateFileA
GlobalFree
WriteFile
GetCurrentProcessId
CopyFileA
CreateEventA
CreateProcessA
GetVersionExA
GetFileSize
GlobalAlloc
SetFilePointer
ReadFile
LocalAlloc
LocalFree
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSection
GetSystemTimeAsFileTime
lstrcpyA
DeleteFileA
GetTempFileNameA
GetTempPathA
FindClose
FindNextFileA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpynA
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapAlloc
HeapFree
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
MultiByteToWideChar
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
VirtualFree
VirtualAlloc
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
user32
IsDialogMessageA
DestroyWindow
SetWindowPos
GetWindowLongA
AdjustWindowRect
MapDialogRect
SetRect
IsDlgButtonChecked
GetClientRect
PostQuitMessage
LoadStringA
DispatchMessageA
TranslateMessage
PeekMessageA
GetMessageA
SetDlgItemTextA
CharPrevA
ShowWindow
SendDlgItemMessageA
CreateDialogParamA
MessageBoxA
ExitWindowsEx
wsprintfA
GetDlgItem
SetWindowTextA
comdlg32
GetFileTitleA
advapi32
RegCloseKey
RegEnumKeyExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
RegDeleteKeyA
RegOpenKeyExA
shell32
SHChangeNotify
SHGetPathFromIDListA
SHGetSpecialFolderLocation
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ