Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
302da867ea2e582c2b28f1c29e6e98db009b300079d1af6deac5b4931e20e96f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
302da867ea2e582c2b28f1c29e6e98db009b300079d1af6deac5b4931e20e96f.exe
Resource
win10v2004-20250314-en
General
-
Target
302da867ea2e582c2b28f1c29e6e98db009b300079d1af6deac5b4931e20e96f
-
Size
272KB
-
MD5
70480b615e6973c94971faadce2394b1
-
SHA1
fdcfb9387e064c715cf18704847342fb93120066
-
SHA256
302da867ea2e582c2b28f1c29e6e98db009b300079d1af6deac5b4931e20e96f
-
SHA512
0d2fa0fa70c07a1becfb41db1972b4f6641dc407dff43ab3e38768861c32a75b31c0bf0eff8e13ae5ca6390992d41ce5cd841496c550f1f1bc9e28ba63bec7e9
-
SSDEEP
6144:4AA0qfdcpUwtyla3MZ9Ic/aw0kkv15WlEbZteHr8zTIw:4rbFcpUIylV9IkDkv14CneHgAw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 302da867ea2e582c2b28f1c29e6e98db009b300079d1af6deac5b4931e20e96f
Files
-
302da867ea2e582c2b28f1c29e6e98db009b300079d1af6deac5b4931e20e96f.exe windows:4 windows x86 arch:x86
de7cf7881e91cc8ab9ad0fe7af7c65fa
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameW
GetLastError
GetTickCount
GetCurrentProcess
MultiByteToWideChar
GetSystemDirectoryW
GetVersionExA
GetProcessHeap
GetStartupInfoW
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
TlsAlloc
GetCurrentThreadId
HeapCreate
ExitProcess
GetModuleFileNameA
GetEnvironmentStringsW
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetStringTypeA
GetStringTypeW
Sleep
GetLocaleInfoA
InitializeCriticalSection
LoadLibraryA
BeginUpdateResourceW
GetProcAddress
user32
GetSystemMetrics
RegisterClassW
LoadBitmapA
GetMessageA
ShowCaret
GetMenuItemCount
LoadImageW
wvsprintfW
SetCapture
GetMenuItemID
ShowWindow
CharLowerA
LoadBitmapW
SetDlgItemTextW
GetAsyncKeyState
OffsetRect
IsChild
SetWindowTextW
AdjustWindowRect
IsIconic
LoadCursorA
advapi32
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
CloseServiceHandle
StartServiceW
OpenServiceW
OpenSCManagerW
mssip32
CryptSIPGetSignedDataMsg
CryptSIPGetInfo
gdi32
CreatePen
GetEnhMetaFileA
UpdateICMRegKeyW
GetTextExtentPointW
UpdateICMRegKeyA
CreateMetaFileA
GetMetaFileW
rnr20
NSPStartup
Sections
CODE Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.I Size: 3KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.mSPErh Size: 1024B - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.l Size: 2KB - Virtual size: 125KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.qacf Size: 5KB - Virtual size: 795KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 100KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.m Size: 3KB - Virtual size: 456KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 9KB - Virtual size: 335KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.YQIQUm Size: 5KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 116KB - Virtual size: 118KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.HZ Size: 5KB - Virtual size: 614KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ