Static task
static1
Behavioral task
behavioral1
Sample
c559251abc43b8681450c97f6aaf5466.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
c559251abc43b8681450c97f6aaf5466.exe
Resource
win10v2004-20230220-en
General
-
Target
c559251abc43b8681450c97f6aaf5466.bin
-
Size
604KB
-
MD5
c559251abc43b8681450c97f6aaf5466
-
SHA1
b3f752d1cb35236544158e08641e4f77a5a9c5d2
-
SHA256
cc7279465ff8365a814bac6f5b6602ad8d265c47831ce51ae603956e2a2c4550
-
SHA512
b059f0e9e9e1ae74a71b1344fd9dfb9a717e01864a5972077c0799b1e2c23ed8d6c396b79e6d3328db15c62781364abac0dedf79a834dab2db8aefee592d6a01
-
SSDEEP
6144:VdDGePJDTb+HdtH9Wd1yxBMfLeVCDY2cZ5DwK3bHqpnobns+NOYuR6FCHkjyh0XL:VpJj+Hdsy7MfKVWcZV3LHnY6FCEjq0XL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c559251abc43b8681450c97f6aaf5466.bin
Files
-
c559251abc43b8681450c97f6aaf5466.bin.exe windows x86
775270e9d5a44b260d80ead41d168f95
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
EnumServicesStatusExA
GetServiceDisplayNameA
GetServiceKeyNameA
OpenSCManagerA
OpenServiceA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
IcmpCreateFile
IcmpSendEcho
kernel32
AddVectoredExceptionHandler
CheckRemoteDebuggerPresent
CloseHandle
CreateEventA
CreateFileA
CreateMutexA
CreateProcessA
CreateThread
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
CreateWaitableTimerA
DebugActiveProcess
DebugActiveProcessStop
DeleteCriticalSection
DeleteTimerQueue
DeviceIoControl
EnterCriticalSection
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetBinaryTypeA
GetCommandLineA
GetComputerNameA
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetDiskFreeSpaceExA
GetEnvironmentVariableA
GetExitCodeProcess
GetLastError
GetLocalTime
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetThreadContext
GetTickCount
GetVersionExA
GetWriteWatch
GlobalGetAtomNameA
GlobalMemoryStatusEx
HeapQueryInformation
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
K32EnumDeviceDrivers
K32EnumProcessModules
K32EnumProcesses
K32GetDeviceDriverBaseNameA
K32GetModuleBaseNameA
LeaveCriticalSection
LoadLibraryA
LocalAlloc
LocalFree
LocalSize
MultiByteToWideChar
OpenProcess
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadProcessMemory
ResetWriteWatch
SetConsoleCtrlHandler
SetConsoleTextAttribute
SetEvent
SetHandleInformation
SetThreadContext
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
TlsGetValue
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
lstrcmpiA
lstrlenA
msvcrt
__getmainargs
__initenv
__mb_cur_max
__p__acmdln
__p__commode
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_errno
_initterm
_iob
_lock
_onexit
_snwprintf
_vsnwprintf
_stricmp
_unlock
_vsnprintf
abort
atoi
calloc
exit
fclose
fgetwc
fopen
fprintf
fputc
free
fwrite
getc
getchar
localeconv
malloc
memcmp
memcpy
memset
puts
realloc
setlocale
signal
strchr
strerror
strlen
strncat
strncmp
strstr
system
vfprintf
wcscmp
wcslen
ole32
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoUninitialize
oleaut32
SysAllocString
SysFreeString
shell32
StrStrIA
slwga
SLIsGenuineLocal
user32
BlockInput
CreateDesktopA
DispatchMessageA
FindWindowA
GetCursorPos
GetLastInputInfo
GetMessageA
GetShellWindow
GetWindowThreadProcessId
KillTimer
SetTimer
SwitchDesktop
winmm
timeGetSystemTime
timeGetTime
timeSetEvent
Sections
.text Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 2KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/14 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/29 Size: 122KB - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/41 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/55 Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/67 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/78 Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/89 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ