Static task
static1
Behavioral task
behavioral1
Sample
0f092bfc9f9adaf93750df4ae3cdc0f7.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0f092bfc9f9adaf93750df4ae3cdc0f7.exe
Resource
win10v2004-20230220-en
General
-
Target
0f092bfc9f9adaf93750df4ae3cdc0f7.bin
-
Size
465KB
-
MD5
0f092bfc9f9adaf93750df4ae3cdc0f7
-
SHA1
e2f191b251ba5c57cdbb5a6d3bfab57957900fcf
-
SHA256
a4ea3462bd5aedccc783d18d24589018c257b2a6e092164c01de067a8e3cd649
-
SHA512
ae553968006b5ace8a510fc9b8b6c4e16abbfdb9e1009473eb75a305660f5cf058d9ea210fbe0c423786e02eb47ea320ea5d0b19a13e2935d748d0a57c9b00df
-
SSDEEP
6144:FuOL0c+U6ySxPnl+wd65HFFiQgJHEZeh2X9VZH0HnFhHsHk2b4:/L0NvySxPl+wkZWQgJHUltVZUHFyk2b4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f092bfc9f9adaf93750df4ae3cdc0f7.bin
Files
-
0f092bfc9f9adaf93750df4ae3cdc0f7.bin.exe windows x86
3467de584b3a55eac81df455719c062a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStdHandle
GetConsoleMode
TlsGetValue
GetConsoleWindow
GetLastError
SetLastError
RaiseException
GetTickCount
ExitProcess
GetStartupInfoA
GetCommandLineA
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
ReadProcessMemory
GetModuleFileNameA
GetModuleHandleA
WriteFile
ReadFile
CloseHandle
SetFilePointer
SetEndOfFile
GetSystemInfo
LoadLibraryW
GetProcAddress
FreeLibrary
FormatMessageW
DeleteFileW
CreateFileW
GetFileAttributesW
GetCurrentDirectoryW
GetFullPathNameW
GetConsoleOutputCP
GetOEMCP
GetProcessHeap
HeapAlloc
HeapFree
TlsAlloc
TlsSetValue
CreateThread
ExitThread
LocalAlloc
LocalFree
Sleep
SuspendThread
ResumeThread
TerminateThread
WaitForSingleObject
SetThreadPriority
GetThreadPriority
GetCurrentThread
OpenThread
IsDebuggerPresent
CreateEventA
ResetEvent
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
SetConsoleCtrlHandler
RtlUnwind
EnumResourceTypesA
EnumResourceNamesA
EnumResourceLanguagesA
FindResourceA
FindResourceExA
LoadResource
SizeofResource
LockResource
FreeResource
GetEnvironmentVariableA
GetWindowsDirectoryA
CreateDirectoryA
DeleteFileA
CopyFileA
FindFirstFileA
FindNextFileA
GetVersionExA
CompareStringA
GetLocaleInfoA
EnumCalendarInfoA
ReadConsoleInputA
WriteConsoleOutputCharacterA
ScrollConsoleScreenBufferA
CreateProcessW
FindNextFileW
CompareStringW
GetLocaleInfoW
FindFirstFileExW
VirtualFree
TerminateProcess
GetExitCodeProcess
GetLogicalDrives
DeviceIoControl
FindClose
DuplicateHandle
GetSystemTime
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FileTimeToDosDateTime
CreatePipe
PeekNamedPipe
GetCPInfo
GetThreadLocale
SetThreadLocale
GetUserDefaultLCID
WriteConsoleOutputAttribute
GetNumberOfConsoleInputEvents
GetConsoleScreenBufferInfo
GetConsoleCursorInfo
SetConsoleMode
SetConsoleCursorPosition
SetConsoleOutputCP
CreateToolhelp32Snapshot
Process32First
Process32Next
shlwapi
PathFindExtensionA
winhttp
WinHttpGetIEProxyConfigForCurrentUser
oleaut32
SysAllocStringLen
SysFreeString
SysReAllocStringLen
user32
MessageBoxA
CharUpperBuffW
CharLowerBuffW
CharUpperA
CharUpperBuffA
CharLowerA
CharLowerBuffA
ShowWindow
GetSystemMetrics
SetActiveWindow
MessageBeep
advapi32
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegFlushKey
wininet
InternetOpenA
InternetCloseHandle
InternetConnectA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestA
Sections
.text Size: 214KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 11KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stab Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.stabstr Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ