Static task
static1
Behavioral task
behavioral1
Sample
fde9b68566d7dd06cda962c5b5fc3964be130480edccde10a7009c244f3cfba7.exe
Resource
win10v2004-20230220-en
General
-
Target
fde9b68566d7dd06cda962c5b5fc3964be130480edccde10a7009c244f3cfba7
-
Size
5.6MB
-
MD5
64a30db275f270e4d7b0ad7e568cfd36
-
SHA1
4f159c15fa9d7aa53c7f79fdee8566b305047284
-
SHA256
fde9b68566d7dd06cda962c5b5fc3964be130480edccde10a7009c244f3cfba7
-
SHA512
34efecc24d533aa5c9b00ffcff53a705b6e3a8f705cc1ce61da6c61cfa0dea441213d03446b0173172ee50e6d4f47ab8f78b55c4a48278bd464754c63c91abba
-
SSDEEP
49152:bRgepwuWlv9/ll5xRHnb0CuamXHT80sZ0eZ/Z74qR+WaYVNUbuofcCrPfcAVfU50:baFxlLO15AZ5xNCuo5rHxyWQ5HolZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fde9b68566d7dd06cda962c5b5fc3964be130480edccde10a7009c244f3cfba7
Files
-
fde9b68566d7dd06cda962c5b5fc3964be130480edccde10a7009c244f3cfba7.exe windows x64
ac736e50a441f678b7e94d5a21434881
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CopyFileA
GetLastError
Process32NextW
GlobalSize
GetSystemDirectoryA
GlobalAlloc
Process32FirstW
CloseHandle
Sleep
WinExec
GlobalUnlock
WriteConsoleW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateToolhelp32Snapshot
CreateMutexA
GlobalLock
GetModuleFileNameA
MultiByteToWideChar
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
AreFileApisANSI
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
GetStringTypeW
LCMapStringEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapFree
HeapReAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
SetEndOfFile
user32
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
advapi32
RegCreateKeyExA
RegSetValueExA
RegCloseKey
Sections
.text Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 161KB - Virtual size: 161KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
hnjgybtf Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.0Dev Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
hnjgybtf Size: 258KB - Virtual size: 258KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ