Static task
static1
Behavioral task
behavioral1
Sample
03165499.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
03165499.exe
Resource
win10v2004-20230220-en
General
-
Target
03165499.exe
-
Size
1.5MB
-
MD5
1e7d19e107b13ee923f071ee213abc6e
-
SHA1
d20cc061d5cf335f2826bddba95477ee27bf51d7
-
SHA256
3e21b44137dbef218111841e205f7db8ede7a0cbe3da3e8317fb2645f29fadc8
-
SHA512
1abb9e26f9e6c70353f4bc10d20934bcffb1c332fbdaaddff967107f7fcf8a7315476c21d4555ecb82d06b4fa314fb64b46ee66d8af1ec0a91538c66f26b8710
-
SSDEEP
24576:9PMBema065G4nP2wHz4cevXsmvKjOFY0r+toUh4MCYMmSUijS53guWLdhfvVSZMT:9PMUW65T2wkcezv+8QRRCRhhjS8HMMpU
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 03165499.exe
Files
-
03165499.exe.exe windows x86
e153554be2e2c872a457437a0e01e938
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleMode
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
PostThreadMessageA
CharUpperBuffW
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorW
ws2_32
shutdown
mswsock
AcceptEx
ole32
CoUninitialize
oleaut32
SysFreeString
shlwapi
SHDeleteKeyW
crypt32
CertFreeCertificateContext
Sections
Gj*Djnp` Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
)/=2^e_A Size: - Virtual size: 319KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ccsW%BUF Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qjP\#G`/ Size: - Virtual size: 698KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
L09M_ZMV Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Mv?hL#Ru Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
?Y!DLL"= Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
o)N),C`R Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ