b681b3fe1539d6565e1358840c56a68ff5800c2f87e98cdf2740e8e41109c8e2 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

b681b3fe15...e2.exe

windows7-x64

b681b3fe15...e2.exe

windows10-2004-x64

3

Sharing

Static task

static1

Behavioral task

behavioral1

Sample

b681b3fe1539d6565e1358840c56a68ff5800c2f87e98cdf2740e8e41109c8e2.exe

Resource

win7-20220812-en

evasion persistence trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

b681b3fe1539d6565e1358840c56a68ff5800c2f87e98cdf2740e8e41109c8e2.exe

Resource

win10v2004-20220901-en

windows10-2004-x64

1 signatures

150 seconds

General

Target

b681b3fe1539d6565e1358840c56a68ff5800c2f87e98cdf2740e8e41109c8e2
Size

536KB
MD5

2526d7fa2c0baba127c23df930e9d7ce
SHA1

0c91f77e9220b1d178e10bcf353a6dd7de0016e8
SHA256

b681b3fe1539d6565e1358840c56a68ff5800c2f87e98cdf2740e8e41109c8e2
SHA512

e46822a20d4cd0761ebc6eea05a3acad392a395a8710e702d6a5049d51a062099273e25f2bd8add335c69b923a0db1a7fa0bb6dc04b5b28e31f4d464171296aa
SSDEEP

12288:DH2xM5f1yt0PM6l6DHXPBfJVOXaP/jPt00/3ZP8:LYM5f1ytgBl6bFJVOXaDF00u

Score

N/A

Malware Config

Signatures

Files

b681b3fe1539d6565e1358840c56a68ff5800c2f87e98cdf2740e8e41109c8e2
.exe windows x86

b479a5d4fccee03e0908edd206611adc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileTime
Sleep
GetModuleHandleA
CloseHandle
CreateFileW
DeviceIoControl
IsDebuggerPresent
CloseHandle
GetConsoleTitleA
HeapCreate
DeleteFileA
GlobalSize
GetCommandLineA
GetDriveTypeW
lstrlenA
LocalFlags
CreateFileMappingW
FindClose
GetStartupInfoA
GetModuleFileNameW

user32

FillRect
GetWindowLongW
DestroyMenu
DestroyWindow
BeginPaint
DispatchMessageA
IsWindow
CallWindowProcW
LoadImageA
DispatchMessageA
DrawTextW
IsZoomed
PeekMessageA

dssec

DSEditSecurity
DSEditSecurity
DSEditSecurity
DSEditSecurity

imagehlp

ImageUnload

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 529KB - Virtual size: 528KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.