Static task
static1
Behavioral task
behavioral1
Sample
e20a4470a42b066e361d77da7ebebe0411cce549dc73746e44b472cd6b481aef.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e20a4470a42b066e361d77da7ebebe0411cce549dc73746e44b472cd6b481aef.exe
Resource
win10v2004-20230220-en
General
-
Target
e20a4470a42b066e361d77da7ebebe0411cce549dc73746e44b472cd6b481aef
-
Size
3.7MB
-
MD5
5d81420a27c899a5c7cca428718d21ce
-
SHA1
fbe1369ffed34397520ecb81e8d4ecdf4adb83e0
-
SHA256
e20a4470a42b066e361d77da7ebebe0411cce549dc73746e44b472cd6b481aef
-
SHA512
59b107382084a0b776e54954749b8e28bab8eb8984a13853780ede1572f5006ea85a53fd925d4664dfb1f270f419885b85987134cd4b1f6734e56c7f22cbce34
-
SSDEEP
6144:PSnHHq1+Kpu7kYfl2qJtM7NIUeFFThohalLpBM:yHHq13pu7kYfl2at6IUetomNB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e20a4470a42b066e361d77da7ebebe0411cce549dc73746e44b472cd6b481aef
Files
-
e20a4470a42b066e361d77da7ebebe0411cce549dc73746e44b472cd6b481aef.exe windows x64
9035d9f0b4181ed7d24e6f327adb2027
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcess
HeapAlloc
GetCurrentProcessId
GetProcessHeap
GetModuleHandleA
FlushInstructionCache
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindNextFileW
HeapFree
SetConsoleTitleW
GetConsoleWindow
LocalSize
FormatMessageW
MultiByteToWideChar
GetStdHandle
lstrlenW
LoadLibraryA
GetProcAddress
VerifyVersionInfoW
GetModuleHandleW
VerSetConditionMask
LocalFree
CloseHandle
GetLastError
CreateFileW
LocalAlloc
FindClose
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetFileAttributesExW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
LCMapStringW
CompareStringW
WriteConsoleW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetOEMCP
GetACP
FindFirstFileExW
IsValidCodePage
GetFileType
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
WriteFile
GetModuleHandleExW
ExitProcess
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
user32
MoveWindow
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
ole32
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx
oleaut32
SysFreeString
VariantClear
SysAllocString
shlwapi
StrStrIW
setupapi
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
Sections
.text Size: 181KB - Virtual size: 180KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ