Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
de34152e824e68b5cd99e13dac3d56512d56558a670d5323d0abd7651e1d3ddd.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
de34152e824e68b5cd99e13dac3d56512d56558a670d5323d0abd7651e1d3ddd.exe
Resource
win10v2004-20250314-en
General
-
Target
de34152e824e68b5cd99e13dac3d56512d56558a670d5323d0abd7651e1d3ddd
-
Size
302KB
-
MD5
72b985c2adb9854dd129108dcb91ce65
-
SHA1
3a8363e337e64345bc8141e8929142b86817ef88
-
SHA256
de34152e824e68b5cd99e13dac3d56512d56558a670d5323d0abd7651e1d3ddd
-
SHA512
356777dd226f48fa2b324773139ac87687be3ba005b8e4fdaf6b77c875a2f3f81c3298e6bcbbbd31665b010b454d036cc0f620619eef10b549de7cfe5c1d2a43
-
SSDEEP
6144:6r7beYd6upMOOsrLJffxOD3pZSVrdoTeJsVkbE9ucqe7fWJGflTvuLE:6r7yFf0LJffxOD5ZSRdoTeq59ufe7fWK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource de34152e824e68b5cd99e13dac3d56512d56558a670d5323d0abd7651e1d3ddd
Files
-
de34152e824e68b5cd99e13dac3d56512d56558a670d5323d0abd7651e1d3ddd.exe windows:5 windows x86 arch:x86
3c82a3e3d902843c8be455bba2a0507b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetUnhandledExceptionFilter
ReadFile
VirtualFree
QueryDosDeviceA
GetFileSize
DeviceIoControl
FindNextFileA
VirtualAlloc
GetFullPathNameA
WriteFile
CloseHandle
RtlUnwind
CreateEventA
GetTimeZoneInformation
FreeLibrary
DuplicateHandle
GetLogicalDrives
ResetEvent
GetCurrentThreadId
OutputDebugStringA
DeleteFileA
FlushFileBuffers
WideCharToMultiByte
CreateFileA
CreateThread
IsBadCodePtr
GetSystemTime
WaitForSingleObject
SystemTimeToFileTime
EnterCriticalSection
FindClose
SetFilePointer
GetFileTime
DeleteCriticalSection
LeaveCriticalSection
FindFirstFileA
GetSystemTimeAsFileTime
GetModuleHandleA
UnhandledExceptionFilter
FileTimeToSystemTime
CreateMutexA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
ole32
CoInitialize
CoUninitialize
user32
GetUserObjectInformationA
MessageBoxA
GetProcessWindowStation
msvcrt
_XcptFilter
malloc
fopen
_snprintf
swprintf
fflush
wcsncpy
_purecall
__CxxFrameHandler
printf
localtime
rand
strncmp
_errno
ctime
fseek
toupper
wcsstr
memmove
free
strncpy
strstr
time
fprintf
_CxxThrowException
_splitpath
memcpy
vsprintf
_initterm
ftell
fread
_wcsicmp
fclose
_strupr
_stricmp
srand
_amsg_exit
calloc
sprintf
memset
esent
JetCreateIndex
JetDelete
JetOpenFileSectionInstance
JetOpenTempTable
JetCreateIndex2
JetAddColumn
JetOSSnapshotFreeze
JetEnableMultiInstance
JetOpenFile
JetDeleteColumn2
JetDBUtilities
JetBeginTransaction
JetGetSecondaryIndexBookmark
JetOpenTempTable3
JetRestore
JetRestoreInstance
JetExternalRestore2
JetSetCurrentIndex
JetGetTableIndexInfo
JetMakeKey
JetDetachDatabase
JetStopServiceInstance
iprtprio
GetPriorityInfo
SetPriorityInfo
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 275KB - Virtual size: 461KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ