Behavioral task
behavioral1
Sample
472aadddf73c6162d696660015d5a0437ebde29d6a62b076d5e90dcea35bd0f1N.exe
Resource
win7-20240903-en
General
-
Target
472aadddf73c6162d696660015d5a0437ebde29d6a62b076d5e90dcea35bd0f1N
-
Size
240KB
-
MD5
ee7cfd4024624af27934e41b68040f90
-
SHA1
0d42fa6401a1d57f65f9ec4dc1a854aaacafba74
-
SHA256
472aadddf73c6162d696660015d5a0437ebde29d6a62b076d5e90dcea35bd0f1
-
SHA512
1ef14bc5091328f5de4eebfcde511ee79188f78c7260af5316ac980a769f5aea030d8955cef809b85b72b6d92dbfbb6ff007384d85f646d649702e695f25d84f
-
SSDEEP
3072:QogRVVuUDpN49H5/p92CsF7uImfW/Fu7utQy7GpdRMKx:XgNDXwH5i970+/Fu4Li0
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 472aadddf73c6162d696660015d5a0437ebde29d6a62b076d5e90dcea35bd0f1N
Files
-
472aadddf73c6162d696660015d5a0437ebde29d6a62b076d5e90dcea35bd0f1N.exe windows:4 windows x86 arch:x86
9292a46482db4ec4ffaec2540564b15e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryA
Sleep
SetErrorMode
GetModuleFileNameA
GetProcAddress
SuspendThread
GetSystemDirectoryA
GetWindowsDirectoryA
ReadFile
FlushFileBuffers
GetModuleHandleA
CreateProcessA
GetFileSize
MoveFileA
GetFileAttributesA
ExpandEnvironmentStringsA
MoveFileExA
GetProfileStringA
WritePrivateProfileStringA
WriteProfileStringA
GetEnvironmentVariableA
WriteFile
GetCurrentProcess
GetLastError
lstrcpyA
lstrcatA
SetCurrentDirectoryA
RemoveDirectoryA
DeleteFileA
GetVersionExA
CreateThread
ResumeThread
GetDiskFreeSpaceA
GetDriveTypeA
lstrlenA
CreateFileA
lstrcpynA
SetFilePointer
FileTimeToSystemTime
CompareFileTime
SetFileTime
GetShortPathNameA
LocalFileTimeToFileTime
GetLocalTime
DosDateTimeToFileTime
FileTimeToLocalFileTime
lstrcmpA
lstrcmpiA
FindFirstFileA
CreateDirectoryA
FindNextFileA
FindClose
SetFileAttributesA
GetTempFileNameA
GetPrivateProfileStringA
GetExitCodeProcess
WaitForSingleObject
OpenProcess
HeapReAlloc
RtlUnwind
VirtualFree
VirtualAlloc
CloseHandle
HeapCreate
HeapDestroy
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
HeapFree
HeapAlloc
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
SetStdHandle
advapi32
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerA
RegDeleteKeyA
RegCloseKey
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegEnumValueA
RegDeleteValueA
gdi32
StretchDIBits
CreatePalette
CreateSolidBrush
SelectPalette
GetTextMetricsA
SetTextColor
TextOutA
SelectObject
CreateFontIndirectA
SetTextAlign
DeleteDC
BitBlt
SetBkMode
CreateRectRgn
CreateCompatibleBitmap
SelectClipRgn
DeleteObject
RealizePalette
GetTextExtentPoint32A
CreateCompatibleDC
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
UnRegisterTypeLi
LoadTypeLi
RegisterTypeLi
SysFreeString
shell32
SHChangeNotify
SHBrowseForFolderA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
user32
ShowWindow
SetCursor
EndDialog
SetWindowTextA
SetDlgItemTextA
GetDlgItem
PostMessageA
IsIconic
DialogBoxParamA
LoadCursorA
InflateRect
CheckDlgButton
SendMessageA
GetDC
ReleaseDC
ExitWindowsEx
MessageBoxA
wsprintfA
SetTimer
KillTimer
SetForegroundWindow
UnhookWindowsHookEx
EnableWindow
IsDlgButtonChecked
CallNextHookEx
GetFocus
GetForegroundWindow
SetWindowsHookExA
DestroyWindow
SendDlgItemMessageA
BeginPaint
EndPaint
SetFocus
GetDlgItemTextA
DefWindowProcA
ScreenToClient
InvalidateRect
GetSysColor
DrawTextA
GetSysColorBrush
UnregisterClassA
FindWindowA
RegisterClassExA
GetSystemMetrics
CreateWindowExA
UpdateWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
GetClientRect
PostQuitMessage
DrawIcon
MessageBeep
CreateDialogParamA
LoadIconA
GetWindowRect
FillRect
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
UPX0 Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE