Static task
static1
Behavioral task
behavioral1
Sample
30d9653d51410eaa7e3e22b7b8c8fddda54b8217c4f935e84704e38a20bb7914.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
30d9653d51410eaa7e3e22b7b8c8fddda54b8217c4f935e84704e38a20bb7914.exe
Resource
win10v2004-20241007-en
General
-
Target
30d9653d51410eaa7e3e22b7b8c8fddda54b8217c4f935e84704e38a20bb7914
-
Size
965KB
-
MD5
2233ab6858e42155dc642c9e546da05a
-
SHA1
0dc647592477a789bd6474750573fab4bf083f9f
-
SHA256
30d9653d51410eaa7e3e22b7b8c8fddda54b8217c4f935e84704e38a20bb7914
-
SHA512
c49eeaad20639436e1aef1880514b23627b0f4716bc52d6b094ddae128d334ce159ff79c0a689d3870f52de7c20dfd2751a7d848b4b2ba1c47a763581b16a46f
-
SSDEEP
12288:YR3qLaF4PGR2eL1k5WWOgzQ7W+XCra8rqb+1Vb3V1kYI:YZqLaF4PGweL1wzQa+SrHrd3nkJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30d9653d51410eaa7e3e22b7b8c8fddda54b8217c4f935e84704e38a20bb7914
Files
-
30d9653d51410eaa7e3e22b7b8c8fddda54b8217c4f935e84704e38a20bb7914.exe windows:4 windows x86 arch:x86
86cf9c5fe7575b03fdb99ed06c05dad4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetReadFile
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetOpenW
InternetSetOptionW
kernel32
DeleteFileW
GetModuleFileNameA
CreateFileA
GetFileSize
SetFilePointer
ReadFile
GetCurrentThread
FreeLibrary
GetModuleFileNameW
SetLastError
CreateFileW
WriteFile
LoadLibraryA
GetProcAddress
GetModuleHandleA
VirtualProtect
GetCurrentProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
lstrlenA
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
GetACP
FormatMessageW
GetTickCount
Sleep
GetThreadContext
SetThreadContext
VirtualQuery
InterlockedCompareExchange
VirtualFree
FlushInstructionCache
VirtualAlloc
GetCurrentThreadId
SuspendThread
ResumeThread
GetModuleHandleW
SetEndOfFile
CreateDirectoryW
GetFileAttributesW
WaitForSingleObject
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetFileType
SetHandleCount
HeapReAlloc
HeapCreate
HeapDestroy
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStdHandle
HeapSize
TlsFree
TlsSetValue
OutputDebugStringW
CreateProcessW
GetTempFileNameW
GetTempPathW
CloseHandle
OpenMutexW
CreateMutexW
GetLastError
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetThreadLocale
GetLocaleInfoW
TlsAlloc
TlsGetValue
ExitProcess
GetCPInfo
LCMapStringW
LCMapStringA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
user32
UnregisterClassA
CreateWindowExW
RegisterClassW
LoadCursorW
LoadIconW
DefWindowProcW
SetForegroundWindow
SetWindowPos
IsZoomed
AttachThreadInput
GetWindowThreadProcessId
ShowWindow
IsWindowVisible
GetForegroundWindow
IsWindow
MessageBoxW
PostQuitMessage
gdi32
GetStockObject
advapi32
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegEnumValueW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegEnumKeyExW
shell32
SHGetFolderPathW
shlwapi
PathFileExistsW
Sections
.text Size: 229KB - Virtual size: 232KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gms Size: 512B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.APP Size: 656KB - Virtual size: 720KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ