Static task
static1
Behavioral task
behavioral1
Sample
1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677.exe
Resource
win10v2004-20230220-en
General
-
Target
1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677
-
Size
113KB
-
MD5
de96342270a559433babd9a496b0e7a8
-
SHA1
061d614f75e29cc48fe846e06380ee44752e432f
-
SHA256
1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677
-
SHA512
4b2370bfd70ab89d926c960f4c03f55e53a151bafd3f5cd9315bc5511f738a04721a7e01699726845008fa8ec48a0d357e7f5523599e32bc679dbb69be1067a1
-
SSDEEP
3072:W912aHMhsUA9C+6cNtLJ9OnTIfLidKgbkHVGBgrr1P:W9124UAwtcNlOnTIfLidK6jBEp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677
Files
-
1a5566f43e9e8d05cd611f2dcdaf06e09bee0924d98cf040e998e8723eacc677.exe windows x64
ad3aad627a35fcd353271e46b9c297a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CopyFileW
CreateDirectoryW
GetTempPathW
MoveFileExW
GetSystemDirectoryW
ExitProcess
GetTickCount
GetCommandLineW
WinExec
CreateMutexW
OpenMutexW
GetCurrentThreadId
CreateEventW
GetLastError
LocalAlloc
WaitForMultipleObjects
CreateThread
LocalFree
FlushFileBuffers
HeapReAlloc
WriteConsoleW
SetStdHandle
HeapSize
GetStringTypeW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCurrentProcess
GetCurrentProcessId
QueryPerformanceCounter
HeapCreate
GetVersion
HeapSetInformation
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
RaiseException
LCMapStringW
HeapAlloc
FlsAlloc
SetLastError
FlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapFree
FindFirstFileW
FindNextFileW
CreateFileW
GetFileSize
ReadFile
Sleep
OpenProcess
VirtualAlloc
ReadProcessMemory
TerminateProcess
VirtualFree
WideCharToMultiByte
GetModuleFileNameW
SetFileAttributesW
DeleteFileW
lstrlenA
FormatMessageA
CreateProcessA
GetModuleFileNameA
CreateFileA
CloseHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
MultiByteToWideChar
GetSystemTimeAsFileTime
GetStdHandle
WriteFile
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetCommandLineA
RtlUnwindEx
RtlLookupFunctionEntry
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
user32
GetClientRect
BeginPaint
EndPaint
FillRect
SetRect
GetMessageA
SetTimer
KillTimer
GetClassLongPtrA
GetDC
ReleaseDC
WinHelpA
PostQuitMessage
LoadAcceleratorsA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
LoadCursorA
LoadIconA
LoadImageA
RegisterClassExA
MessageBoxA
GetSystemMetrics
ShowWindow
UpdateWindow
GetInputState
PostThreadMessageA
RegisterClassA
FindWindowW
PostMessageA
wsprintfW
OpenClipboard
EmptyClipboard
CloseClipboard
SendMessageA
LoadStringA
EndDialog
GetDlgItem
SetFocus
InvalidateRect
DialogBoxParamA
CreateWindowExA
GetWindowLongPtrA
SetWindowLongPtrA
DefWindowProcA
gdi32
FillRgn
GetStockObject
SetMapMode
SelectPalette
RealizePalette
SetWindowExtEx
SetViewportExtEx
SetViewportOrgEx
CreateSolidBrush
DeleteObject
GetDeviceCaps
CreatePalette
CreateEllipticRgn
comdlg32
GetOpenFileNameA
advapi32
GetUserNameA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegDeleteValueW
RegOpenKeyExW
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExW
RegSetValueExW
RegCloseKey
shell32
ShellExecuteW
SHGetSpecialFolderPathW
ole32
CoInitializeEx
OleRun
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
oleaut32
SysStringLen
SysFreeString
VariantClear
GetErrorInfo
psapi
GetModuleFileNameExW
EnumProcesses
Sections
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ