Static task
static1
Behavioral task
behavioral1
Sample
dcc76cb0143d1fc4c00501745e302bfc58b06267f28dda3d5ab7da9823855678.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dcc76cb0143d1fc4c00501745e302bfc58b06267f28dda3d5ab7da9823855678.exe
Resource
win10v2004-20230220-en
General
-
Target
dcc76cb0143d1fc4c00501745e302bfc58b06267f28dda3d5ab7da9823855678
-
Size
263KB
-
MD5
8dad301c809a9c6e4b92b80edb06d4f5
-
SHA1
5eee2ed753cbe8e75a3d7b7bcf16786178fb47da
-
SHA256
dcc76cb0143d1fc4c00501745e302bfc58b06267f28dda3d5ab7da9823855678
-
SHA512
0f924359c6224ab329b8e9b2ecfeb974db4cd4de95d125626520da87933fcc0a953d0e291208b7d978fd88daebacff2e375e7d867b3f3dd2b5c37d195dc66a22
-
SSDEEP
6144:ruRIdqSVpEM1ttx2gYVAjclDygHUpvi2t/woI9L:KRIdfbLYlDygHUJi2p9I9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dcc76cb0143d1fc4c00501745e302bfc58b06267f28dda3d5ab7da9823855678
Files
-
dcc76cb0143d1fc4c00501745e302bfc58b06267f28dda3d5ab7da9823855678.exe windows x64
2c5c2ddd4982745463abefdb97376d3c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
Process32NextW
LockResource
Process32FirstW
HeapReAlloc
CloseHandle
CreateThread
LoadResource
FindResourceW
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
GetTickCount
LoadLibraryExW
GetACP
LoadLibraryW
LocalFree
ExitProcess
ExitThread
VirtualFree
HeapSize
GetTempPathW
CompareStringOrdinal
LoadLibraryExA
GetFinalPathNameByHandleW
SizeofResource
HeapFree
FindStringOrdinal
WTSGetActiveConsoleSessionId
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
advapi32
RegEnumValueW
ConvertSidToStringSidW
RegDeleteValueW
LookupAccountNameW
RegOpenKeyExW
RegDeleteKeyValueW
RegQueryInfoKeyW
RegCloseKey
RegGetValueW
ntdll
NtQueryDirectoryFile
NtShutdownSystem
H��H�H��1
RtlAdjustPrivilege
RtlCompareUnicodeString
NtDeleteKey
NtOpenProcessToken
NtQueryVirtualMemory
NtSetIoCompletion
NtCreateSection
_wcsicmp
RtlRandomEx
swprintf_s
sprintf_s
NtQueryInformationProcess
NtDeleteFile
NtQueryInformationToken
strncpy
NtClose
NtCreateEvent
NtCreateKey
NtWaitForSingleObject
NtOpenFile
NtLoadDriver
NtQuerySystemInformation
NtTerminateThread
NtCreateIoCompletion
wintrust
WinVerifyTrust
l� �1
WTSQuerySessionInforma H��H;�|�A�T
|�A�T
Sections
.text Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ