Static task
static1
Behavioral task
behavioral1
Sample
877e01dd251b9a25a9c32bf6b72b58f6f47bc7a6c93127c87cd01a1406e705ea.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
877e01dd251b9a25a9c32bf6b72b58f6f47bc7a6c93127c87cd01a1406e705ea.exe
Resource
win10v2004-20230220-en
General
-
Target
877e01dd251b9a25a9c32bf6b72b58f6f47bc7a6c93127c87cd01a1406e705ea
-
Size
1.2MB
-
MD5
69c9bfea62bbd5a36945a0a94225a52b
-
SHA1
7766cbc2cb634e8e10fa8f8b94c16a21b87a626a
-
SHA256
877e01dd251b9a25a9c32bf6b72b58f6f47bc7a6c93127c87cd01a1406e705ea
-
SHA512
40504111768876fca56305713431db9e546b50eaccdb3fbf089772432920ba9d19e0d42ac4c0c0ee66f74f78cfdb439442b3e2bf721648de06b6cb926d31913d
-
SSDEEP
24576:NmLvfW3Hne6p/JlJu1DIhnTEf1BJGciC4g0qhXoyATIVeYXdNWkC3R4T69l:EbOX7p/ThnTEgciCLbXoIjNNWkC3R4Tu
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 877e01dd251b9a25a9c32bf6b72b58f6f47bc7a6c93127c87cd01a1406e705ea
Files
-
877e01dd251b9a25a9c32bf6b72b58f6f47bc7a6c93127c87cd01a1406e705ea.exe windows x86
be02b013b3617f0cc224f1de4d859dfa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadFile
FlushFileBuffers
FindClose
CloseHandle
ConnectNamedPipe
DisconnectNamedPipe
CreateMutexA
LoadLibraryA
GetModuleFileNameA
GetModuleHandleW
GetCommandLineW
SetEnvironmentVariableA
ExpandEnvironmentStringsA
FindResourceW
GetTempPathA
SetCurrentDirectoryA
RemoveDirectoryA
CreateFileA
SetFileAttributesA
GetFileAttributesA
DeleteFileA
FindFirstFileA
FindNextFileA
CopyFileA
MoveFileA
MoveFileExA
CreateNamedPipeA
CallNamedPipeA
WaitNamedPipeA
GetVersionExW
GetVolumePathNameA
WTSGetActiveConsoleSessionId
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetLongPathNameA
LocalAlloc
DeviceIoControl
FindResourceExW
GetSystemDirectoryA
GetDiskFreeSpaceExW
CreateFileW
GetVolumeInformationW
InterlockedDecrement
OutputDebugStringW
SetEndOfFile
WriteConsoleW
WriteFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
GetOEMCP
IsValidCodePage
SetStdHandle
MoveFileExW
DeleteFileW
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
SizeofResource
LoadResource
Sleep
WaitForSingleObject
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetCurrentProcessId
GetCurrentProcess
OpenProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LocalFree
GetProcAddress
FreeLibrary
LockResource
FreeResource
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
ExitProcess
GetModuleHandleExW
ResumeThread
ExitThread
GetACP
GetFileType
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
LoadLibraryExW
GetModuleHandleA
DecodePointer
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
FormatMessageW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
TryEnterCriticalSection
GetCPInfo
EncodePointer
SetLastError
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
user32
GetSystemMetrics
shell32
SHCreateDirectoryExA
ShellExecuteExA
SHGetFolderPathA
SHGetSpecialFolderPathA
SHFileOperationA
CommandLineToArgvW
ole32
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize
CoCreateGuid
CoInitialize
oleaut32
SysFreeString
VariantInit
VariantClear
SysAllocString
advapi32
OpenSCManagerW
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
QueryServiceStatusEx
OpenServiceA
OpenProcessToken
DeleteService
CloseServiceHandle
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CheckTokenMembership
DuplicateTokenEx
CreateProcessAsUserA
FreeSid
shlwapi
PathRemoveBackslashA
PathFileExistsA
PathCanonicalizeA
PathAppendA
PathRemoveFileSpecA
StrCmpNIA
PathAddBackslashA
wtsapi32
WTSQueryUserToken
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
winhttp
WinHttpCrackUrl
ws2_32
getnameinfo
__WSAFDIsSet
closesocket
connect
freeaddrinfo
getaddrinfo
WSAStringToAddressA
WSASocketW
WSAGetLastError
WSACleanup
WSAStartup
setsockopt
send
ioctlsocket
getpeername
getsockopt
recv
select
iphlpapi
GetAdaptersInfo
version
GetFileVersionInfoSizeA
VerQueryValueA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA
Sections
.text Size: 960KB - Virtual size: 960KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 205KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 18KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 68KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE