Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20230220-en
General
-
Target
sample.exe
-
Size
35KB
-
MD5
19bac15e861239376dc6b63d41930fae
-
SHA1
c2802e9e6de2c64d65c18509f874358dc06d24f3
-
SHA256
da4995b36e54d196dc81597805755864db079f182aae10669b23de4e37439457
-
SHA512
ec39fa9922280a873429d685aeb48765390a406443ea3312b48b869e97c6f6b334c191402ba5020bc568bb9a9453c7e27644da850a72bc6acb5bf6b9812ed7c0
-
SSDEEP
384:rI04qVGwMsTpvIR4iqdZpgLRBZD5EQDSBLN2PrZUUt1mKDPdraNXRE+yRSiDTH7J:r9ZMSxIR4iqSD5wMPrmtAAQLLYBz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sample.exe
Files
-
sample.exe.exe windows x86
881d2948609e0a760529f04c8f858791
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlAllocateHeap
RtlCreateHeap
RtlFreeHeap
NtWaitForSingleObject
NtTerminateThread
RtlCreateUserThread
RtlNormalizeProcessParams
memcpy
RtlInitAnsiString
RtlAnsiStringToUnicodeString
NtDisplayString
RtlFreeUnicodeString
RtlInitUnicodeString
NtCreateFile
_snprintf
NtDelayExecution
_wtoi
NtDeleteFile
NtClose
NtQuerySystemTime
RtlTimeToTimeFields
NtWriteFile
wcstombs
isalnum
strchr
atoi
NtReadFile
NtQueryInformationFile
mbstowcs
NtQueryVolumeInformationFile
NtDeviceIoControlFile
_snwprintf
NtCancelIoFile
NtCreateEvent
NtOpenProcessToken
NtAdjustPrivilegesToken
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtQueryPerformanceCounter
sprintf
_alldiv
_allrem
_aulldiv
_chkstk
memset
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ