Static task
static1
Behavioral task
behavioral1
Sample
198a8782618bcea8b74600d72c8e7393d9f77f36b10c52c46b7c688beac530b4N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
198a8782618bcea8b74600d72c8e7393d9f77f36b10c52c46b7c688beac530b4N.exe
Resource
win10v2004-20241007-en
General
-
Target
198a8782618bcea8b74600d72c8e7393d9f77f36b10c52c46b7c688beac530b4N
-
Size
1.3MB
-
MD5
f6ee54bd981a6c4d19e6c64d2aeaf1d0
-
SHA1
2d3de695f7f144f5e5452dfde5a6845066858b32
-
SHA256
198a8782618bcea8b74600d72c8e7393d9f77f36b10c52c46b7c688beac530b4
-
SHA512
fec145ff5e4397eb6103973cfae67514da4885be8d8c8d95cbd508c58e7979fb2ed41451bd7955a81d92bf0f05366d077100e799ce7a26610654571ec9a88d32
-
SSDEEP
12288:8jbesYNb/1/TBsQm2W8C3aQ0w1VTThpioSfoS8qoSfoSjoSfoSZoSfoS3oSfoS4V:8mFW8C3VjThpzm+oWvmWbHTrl1Pj
Malware Config
Signatures
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 198a8782618bcea8b74600d72c8e7393d9f77f36b10c52c46b7c688beac530b4N
Files
-
198a8782618bcea8b74600d72c8e7393d9f77f36b10c52c46b7c688beac530b4N.exe windows:5 windows x86 arch:x86
a416203dbdc92024e72964fb1746807a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
CloseHandle
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetTickCount
WideCharToMultiByte
ReadFile
WriteFile
GetFileSize
lstrlenA
GetCurrentThreadId
SetLastError
GetTempPathA
CopyFileA
MoveFileA
DeleteFileA
GetFileAttributesA
GetModuleFileNameA
CreateThread
GlobalAlloc
GlobalFree
SetEndOfFile
SetFilePointer
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
MultiByteToWideChar
lstrlenW
InterlockedIncrement
InterlockedDecrement
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
FindResourceA
LoadLibraryExA
InterlockedExchangeAdd
TerminateThread
WaitForMultipleObjects
SetConsoleTextAttribute
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
WriteConsoleOutputA
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleMode
GetStdHandle
ScrollConsoleScreenBufferA
GetProcAddress
GetStringTypeW
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
FindNextFileA
FlushFileBuffers
GetConsoleCP
SetHandleCount
LoadLibraryW
HeapCreate
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
CreateFileA
GetLastError
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateFileW
GetStartupInfoW
HeapSetInformation
GetCommandLineA
SetStdHandle
RaiseException
FindFirstFileExA
FindClose
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ExitProcess
InterlockedCompareExchange
InterlockedPushEntrySList
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
HeapDestroy
HeapReAlloc
HeapSize
Sleep
RtlUnwind
GetSystemTimeAsFileTime
DecodePointer
EncodePointer
VirtualProtect
GetModuleHandleW
GetSystemInfo
VirtualQuery
WriteConsoleW
GetFileType
GetModuleFileNameW
user32
GetMonitorInfoA
MonitorFromWindow
GetWindowRect
GetWindow
DestroyWindow
GetClientRect
MapWindowPoints
SetWindowPos
GetParent
UnregisterClassA
SetWindowLongA
SetTimer
KillTimer
SendDlgItemMessageA
SetDlgItemTextA
SendMessageA
EndDialog
PeekMessageA
RegisterClassExA
CreateWindowExA
DefWindowProcA
CreateDialogParamA
CharNextA
IsDialogMessageA
GetMessageA
TranslateMessage
DispatchMessageA
ShowWindow
MessageBoxA
GetSystemMetrics
GetActiveWindow
DialogBoxParamA
SendNotifyMessageA
PostQuitMessage
LoadImageA
GetWindowLongA
advapi32
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyW
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
shell32
ShellExecuteA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VarUI4FromStr
shlwapi
PathRemoveFileSpecA
comctl32
InitCommonControlsEx
wininet
HttpOpenRequestA
HttpQueryInfoA
InternetReadFile
HttpSendRequestA
InternetCrackUrlA
InternetCloseHandle
InternetConnectA
InternetSetOptionA
InternetOpenA
urlmon
ObtainUserAgentString
Sections
.text Size: 173KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 975KB - Virtual size: 976KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.elw Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE