Static task
static1
Behavioral task
behavioral1
Sample
3b9ee4f50fe7c081323b4e22952d836f1934c888765bac85c526fb9d7e4b6091.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3b9ee4f50fe7c081323b4e22952d836f1934c888765bac85c526fb9d7e4b6091.exe
Resource
win10v2004-20230220-en
General
-
Target
3b9ee4f50fe7c081323b4e22952d836f1934c888765bac85c526fb9d7e4b6091.bin
-
Size
2.3MB
-
MD5
a1ab570d92d19918e5a7bf77bb0b9100
-
SHA1
e52c01e927260084eae63810af09a06206bfd757
-
SHA256
3b9ee4f50fe7c081323b4e22952d836f1934c888765bac85c526fb9d7e4b6091
-
SHA512
21fa18ad053f433f1e285cda8ce2b567cf6d4884b6d764508a4a5133ba8199536fb69a52cfb1868d6b3a8e199a1ae1d6449a2ac16a76df4ae2d0e83f4d9d75e7
-
SSDEEP
49152:XO1dS41VC0FXPWoyGktvn2xCEDcyAFcAZRHMjShch8PbcJ4ExNn7KLW7R8:XOSoyGSCnuLP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b9ee4f50fe7c081323b4e22952d836f1934c888765bac85c526fb9d7e4b6091.bin
Files
-
3b9ee4f50fe7c081323b4e22952d836f1934c888765bac85c526fb9d7e4b6091.bin.exe windows x64
0284cc6052391a2b5d3a85278e6af539
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
htons
connect
WSAStartup
socket
send
recv
inet_addr
crypt32
CryptStringToBinaryA
kernel32
WriteConsoleW
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
SetEnvironmentVariableA
ReadConsoleW
RtlCaptureContext
VirtualAlloc
CreateThread
Sleep
WriteFile
ReadFile
CreateFileA
FreeLibrary
GetProcAddress
HeapFree
GetProcessHeap
GetLastError
WideCharToMultiByte
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
SetEndOfFile
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapReAlloc
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
GetTimeZoneInformation
user32
MessageBoxW
ole32
CoCreateGuid
Sections
.text Size: 949KB - Virtual size: 949KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 534KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ