Static task
static1
Behavioral task
behavioral1
Sample
72aed8825aa87b7464f1ebfe094843b5f6388937f6377eb39c43c178a1ea2810.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
72aed8825aa87b7464f1ebfe094843b5f6388937f6377eb39c43c178a1ea2810.exe
Resource
win10v2004-20230220-en
General
-
Target
72aed8825aa87b7464f1ebfe094843b5f6388937f6377eb39c43c178a1ea2810
-
Size
1.2MB
-
MD5
8effba620640f65179b9bee54cb87f1b
-
SHA1
04c06c1e541c28caf87d7777b2d810c85b8ab0ab
-
SHA256
72aed8825aa87b7464f1ebfe094843b5f6388937f6377eb39c43c178a1ea2810
-
SHA512
976eb765b81245d0b42c0a8ddc0a80c03a668b0e6d6b65e007d2a5209393603896b8d72244b589d141380fc6f0819d61c9bac2495fcc5b8b88ef548c31c13958
-
SSDEEP
24576:K8UtleYRMQYUQK25Q3c/Kqt3KFXMeJgMQT9NQN9MWmfn:QlZLYULip3KFXMeJgMQT9NQTMWmfn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 72aed8825aa87b7464f1ebfe094843b5f6388937f6377eb39c43c178a1ea2810
Files
-
72aed8825aa87b7464f1ebfe094843b5f6388937f6377eb39c43c178a1ea2810.exe windows x86
8869276eb0e2a3f0de7742daa57a3c5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
CloseHandle
HeapAlloc
GetCurrentProcess
HeapFree
GetModuleHandleW
GetProcessHeap
GetModuleFileNameW
GetFileSize
SetFilePointer
OpenMutexW
CreateFileW
RemoveDirectoryW
CreateProcessW
lstrcmpiW
GetCurrentProcessId
FindFirstFileW
FileTimeToSystemTime
FindClose
WritePrivateProfileStringW
LoadLibraryW
GetPrivateProfileStringW
FreeLibrary
WriteFile
SetErrorMode
SetEnvironmentVariableA
FlushFileBuffers
ReadConsoleW
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetFileAttributesW
ExpandEnvironmentStringsW
CreateMutexW
WaitForSingleObject
Sleep
GetLastError
ReleaseMutex
GetLongPathNameW
GetFileAttributesExW
FindResourceW
LoadResource
GetVersionExW
LockResource
GetSystemInfo
OpenProcess
QueryDosDeviceW
WideCharToMultiByte
GetACP
MultiByteToWideChar
FindNextFileW
GetEnvironmentVariableW
GetCurrentThreadId
LocalFree
SetEndOfFile
SetFileTime
ReadFile
GetFileTime
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
lstrlenW
GetFileSizeEx
DeleteFileW
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
GetSystemDirectoryW
CopyFileW
GetTempPathW
GetCurrentDirectoryW
MoveFileW
GetWindowsDirectoryW
SetFileAttributesW
GetLogicalDriveStringsW
LoadLibraryExW
GetTickCount
FormatMessageW
GlobalMemoryStatusEx
SetEvent
WaitForMultipleObjects
ResetEvent
CreateEventW
InterlockedExchangeAdd
InterlockedExchange
SetLastError
InitializeCriticalSectionAndSpinCount
ResumeThread
GetExitCodeProcess
DeviceIoControl
EncodePointer
DecodePointer
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
CreateThread
ExitThread
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
IsValidCodePage
GetOEMCP
GetCPInfo
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
OutputDebugStringW
shlwapi
SHGetValueW
Sections
.text Size: 884KB - Virtual size: 883KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 162KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 163KB - Virtual size: 162KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ