Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20230220-es
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20230220-es
General
-
Target
sample.exe
-
Size
35KB
-
MD5
757d91a05fd6fc46816489b1d3b983c1
-
SHA1
fb1f49f54f49bdef9f3a96bc7357804f6891812a
-
SHA256
fa91561e398b87e5ccac0f9b7a88ec774d0b1d657a221a7e0e66b26f6b31909e
-
SHA512
166ee5c5b0378434d6e66ad221626b2bcee2804fa0d44bb3628640c5b2ffe924c1477d4a25cc6870de93ecdd6e8b0b182a29aaa6e780451734f2480454d6fa75
-
SSDEEP
768:FGwTpmZOB3HXZoIPV5LPLxhjOAeEfOV1sv6noF13EkZhvAFmrHRXf:UwTtXZoqxtsVVBoF1NZAFG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sample.exe
Files
-
sample.exe.exe windows x86
e1b4a6bfd61df7b2ae923b781acfa6e0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
GetUserNameA
RegCloseKey
RegCreateKeyExA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
kernel32
CloseHandle
CopyFileA
CreateFileA
CreateMutexA
CreateThread
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsA
FreeLibrary
GetCommandLineA
GetConsoleWindow
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
ReleaseMutex
SetUnhandledExceptionFilter
Sleep
TerminateThread
TlsGetValue
VirtualProtect
VirtualQuery
Wow64DisableWow64FsRedirection
WriteFile
ucrtbase
__acrt_iob_func
__daylight
__p___argc
__p___argv
__p___wargv
__p__acmdln
__p__commode
__p__environ
__p__fmode
__p__wenviron
__setusermatherr
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
__timezone
__tzname
_cexit
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_initialize_narrow_environment
_initialize_wide_environment
_initterm
_set_app_type
_set_invalid_parameter_handler
_set_new_mode
_tzset
abort
atoi
calloc
exit
free
fwrite
malloc
memcpy
memset
rand
signal
srand
strcat
strchr
strcmp
strlen
strncmp
strncpy
strstr
strtok
shell32
ShellExecuteA
user32
CharUpperBuffA
ShowWindow
wininet
InternetCloseHandle
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetReadFile
ws2_32
WSACleanup
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getsockname
htons
inet_addr
ioctlsocket
listen
recv
select
send
socket
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 5KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ