Static task
static1
Behavioral task
behavioral1
Sample
9c890e1b2b4f2723a68fc905268ee010cae232be.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9c890e1b2b4f2723a68fc905268ee010cae232be.exe
Resource
win10v2004-20230221-en
General
-
Target
9c890e1b2b4f2723a68fc905268ee010cae232be.txt
-
Size
1.3MB
-
MD5
65affc4e1d5242a9c3825ce51562d596
-
SHA1
e8ec4884ef797d46461aece68c488addbda96ac4
-
SHA256
f4d60dde0ba2d06e34adb688c135613077659b2b7c0770b09a083b25168048f1
-
SHA512
2d144c26755258bca2b2936e77cbcb23394784d9869438814ca77d1f45ae28698d6ac19bd75f329cdb5640ef09316b6c6985d22627320b30091cc708a9bd16b8
-
SSDEEP
24576:52LKUuNgh53YPF97T2mT0Hi9/ckBJzXTUWmDoJV2IbTBQ4w095KQ0owGqwu6/t5o:52+/nPF97T2mzjzXTUWmDe9Pwyr0ocwU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9c890e1b2b4f2723a68fc905268ee010cae232be.txt
Files
-
9c890e1b2b4f2723a68fc905268ee010cae232be.txt.exe windows x64
b35b1f08a1b9a6968383e69cdf648407
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
FindFirstFileA
FindNextFileA
GetEnvironmentVariableA
CreateMutexA
lstrcatA
MultiByteToWideChar
Sleep
GetLastError
CreateFileA
LoadLibraryA
GetProcAddress
SetEnvironmentVariableA
FreeLibrary
WideCharToMultiByte
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
SetFileInformationByHandle
SetFilePointerEx
DeviceIoControl
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
LCMapStringEx
InitializeCriticalSectionEx
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
GetConsoleMode
ReadConsoleW
GetFileType
GetFileSizeEx
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetTimeZoneInformation
IsValidCodePage
GetACP
RtlUnwind
shell32
SHGetFolderPathA
shlwapi
SHGetValueA
Sections
.text Size: 950KB - Virtual size: 949KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 355KB - Virtual size: 355KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ