Behavioral task
behavioral1
Sample
4389868722d0904b7a3ee449b0d183e83efae1f1a482b3c8d16a45a4346159dfN.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4389868722d0904b7a3ee449b0d183e83efae1f1a482b3c8d16a45a4346159dfN.exe
Resource
win10v2004-20240802-en
General
-
Target
4389868722d0904b7a3ee449b0d183e83efae1f1a482b3c8d16a45a4346159dfN
-
Size
246KB
-
MD5
f2abbc80f3db55a507797fda5cfbbe50
-
SHA1
7e4ff3677d73dc49edd28c53751333af7456b1cf
-
SHA256
4389868722d0904b7a3ee449b0d183e83efae1f1a482b3c8d16a45a4346159df
-
SHA512
9eaa022cb565e8e25d44b7616a13de2208a429fafce80a46e5e45635a3b80cf80201628163f5b93857537fca229c9e8590cdc88ac7e843f206c171a25ebc17c2
-
SSDEEP
6144:heEUq3/sSzA7pfXG7m9ln3T4Y9qd4yqUTJ7nTti:lM7p0mnn3kYYdeUTtpi
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4389868722d0904b7a3ee449b0d183e83efae1f1a482b3c8d16a45a4346159dfN
Files
-
4389868722d0904b7a3ee449b0d183e83efae1f1a482b3c8d16a45a4346159dfN.exe windows:4 windows x86 arch:x86
b58b33fee3515f8f9be18210cf425a28
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetErrorMode
GlobalAlloc
CreateEventW
OpenEventW
GetCurrentProcessId
CreateSemaphoreW
GetSystemTime
GetModuleFileNameW
GetProcessHeap
HeapCreate
lstrlenA
ExitProcess
GetShortPathNameA
GetModuleFileNameA
MultiByteToWideChar
CreateMutexW
FreeLibrary
LoadLibraryW
GetSystemInfo
GetVersionExA
ExpandEnvironmentStringsW
CreateDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemDirectoryW
LoadLibraryA
GetVolumeInformationW
LocalFree
WaitForMultipleObjects
OpenEventA
GetLastError
GetFileAttributesW
Sleep
InitializeCriticalSection
GetCurrentThread
GetTickCount
SetEvent
WaitForSingleObject
GetCurrentProcess
lstrcpynA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetStartupInfoA
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
GetEnvironmentStringsW
BeginUpdateResourceW
GetProcAddress
user32
CharPrevA
CharUpperA
advapi32
AccessCheck
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsA
GetTraceLoggerHandle
GetTraceEnableFlags
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
ReportEventW
DeregisterEventSource
RegisterEventSourceW
DuplicateToken
RevertToSelf
ImpersonateLoggedOnUser
AdjustTokenPrivileges
GetNamedSecurityInfoW
LookupPrivilegeValueA
MapGenericMask
TraceMessage
OpenThreadToken
OpenProcessToken
rpcrt4
RpcServerRegisterIf
RpcServerListen
RpcMgmtStopServerListening
RpcImpersonateClient
RpcServerUnregisterIf
RpcRevertToSelf
RpcServerUseProtseqEpA
NdrServerCall2
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
inseng
DownloadFile
DllGetClassObject
mf3216
Mf3216DllInitialize
Sections
.text Size: 13KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 102KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 115KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ