Static task
static1
Behavioral task
behavioral1
Sample
b9efa23dabf1bdff085a3340fd11bbe78199678ca649fc8aabafd2fd27ed0dd4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b9efa23dabf1bdff085a3340fd11bbe78199678ca649fc8aabafd2fd27ed0dd4.exe
Resource
win10v2004-20230220-en
General
-
Target
612934573cfd4614369ec85a23dcc0ec.bin
-
Size
5KB
-
MD5
4a4d5fdb760619f3e12a176a1f1380e8
-
SHA1
ba0cfae74fa9730a23a2582854d29bc6bcd66a89
-
SHA256
020ba70c1961f632a20900de80c5b1781888dad56bd408bfb0cd9de8e4dcf567
-
SHA512
0cd28dacfec2b578d20aee96cf6e8dec9ce04987d22bd8ced1998fcba0d7d7aef39ec8e89b10069a140a8dc304468445e639265ee88d1d63b7a6d1914a8d5095
-
SSDEEP
96:3XWfH4bkO4X4J2vApjEWNZTFWYT/MDP7cZadvEvSw53BOa6M/1G/L9X8pFv:nWfVO4oyIjEWNloYTEP7cZadvELBok1P
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/b9efa23dabf1bdff085a3340fd11bbe78199678ca649fc8aabafd2fd27ed0dd4.exe
Files
-
612934573cfd4614369ec85a23dcc0ec.bin.zip
Password: infected
-
b9efa23dabf1bdff085a3340fd11bbe78199678ca649fc8aabafd2fd27ed0dd4.exe.exe windows x86
Password: infected
cf40cb9a5bbc1733822d364b22182af8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
SHRegEnumUSKeyW
UrlUnescapeW
PathRemoveBlanksA
StrCSpnIA
PathAddBackslashA
PathIsUNCA
kernel32
VirtualProtect
wininet
SetUrlCacheEntryGroup
FindCloseUrlCache
FtpRemoveDirectoryW
wsock32
send
WSACancelAsyncRequest
oleaut32
BSTR_UserSize
QueryPathOfRegTypeLi
VarDateFromUdateEx
SafeArrayAllocDescriptor
msi
ord57
ord77
ord16
ord90
ord42
ord19
ord98
wsnmp32
ord203
ord602
ord204
ord320
ord102
winmm
waveInClose
waveInGetDevCapsA
auxSetVolume
PlaySoundA
user32
GetDC
GrayStringA
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gty Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ