Static task
static1
Behavioral task
behavioral1
Sample
9b998a1acd7a742c94cacc6886174e27165c54b11370c7ed9da9f0434d3f7864.exe
Resource
win7-20230220-en
General
-
Target
9b998a1acd7a742c94cacc6886174e27165c54b11370c7ed9da9f0434d3f7864
-
Size
576KB
-
MD5
09f6480abb1244d51d10088898c4d056
-
SHA1
36390612acc6ce069c94a5b0033eae577492768d
-
SHA256
9b998a1acd7a742c94cacc6886174e27165c54b11370c7ed9da9f0434d3f7864
-
SHA512
6a52156f0923fea52c5934a9295404c6694c8e080e6004e08d0d22beaf09ca0ea9f2a1e9c65e6a342fad0d2cec11dc9172025459d277802ca97b60ef6e6ad780
-
SSDEEP
12288:fiiUP7uII7WPIHFZQWoW1lADk6rOkEx5o7pKyskZWNCGNF+0W:fiiSu78mZncDkYC5up6kENFfE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9b998a1acd7a742c94cacc6886174e27165c54b11370c7ed9da9f0434d3f7864
Files
-
9b998a1acd7a742c94cacc6886174e27165c54b11370c7ed9da9f0434d3f7864.exe windows x86
b5716f980292d102efd44d2356bcd9ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
HeapSize
HeapReAlloc
HeapDestroy
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
ReadFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
WaitForSingleObject
CreateProcessA
GetExitCodeProcess
SetFilePointerEx
LocalFree
GetModuleFileNameA
GetTempPathA
FindResourceExA
SetLastError
GetLastError
GetTempFileNameA
lstrcmpA
CreateDirectoryA
CloseHandle
SizeofResource
FindResourceA
LoadResource
GetVersionExA
WriteFile
RaiseException
LockResource
FormatMessageA
CreateFileA
RemoveDirectoryA
DeleteFileA
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
OutputDebugStringA
msvcrt
_lock
_unlock
??3@YAXPAX@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
memcmp
strtol
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_XcptFilter
_controlfp
_cexit
__getmainargs
free
memmove
memcpy
memset
_ismbblead
_errno
__CxxFrameHandler
__dllonexit
_onexit
realloc
_exit
shlwapi
PathQuoteSpacesA
ole32
CoInitializeEx
CoUninitialize
user32
CharNextA
MessageBoxA
CharLowerBuffA
UnregisterClassA
wvsprintfA
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 542KB - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ