Static task
static1
Behavioral task
behavioral1
Sample
810b988809cf7bd87aea3b3cbd8e6d5f638f1ad7523c94845873b481f32c1864.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
810b988809cf7bd87aea3b3cbd8e6d5f638f1ad7523c94845873b481f32c1864.exe
Resource
win10v2004-20230220-en
General
-
Target
810b988809cf7bd87aea3b3cbd8e6d5f638f1ad7523c94845873b481f32c1864
-
Size
2.5MB
-
MD5
8843cfdc891a11ab0215f86383e8e0e3
-
SHA1
b67b0989b1de46511fdad3b17ef98af11ba90b84
-
SHA256
810b988809cf7bd87aea3b3cbd8e6d5f638f1ad7523c94845873b481f32c1864
-
SHA512
1f0518f664032ecf7180c59029166f80635709c649b2da632b9832e18848ac0c0dd2166db16851b84b6e8144d73216be5335315ccf878cff5d46aad69ea8fc0b
-
SSDEEP
24576:CixFXlYJyUfQmMrm1RFjUTDYGOfa1nlLokqZO6:Cixl+JOmMrm1RF4c01qkqr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 810b988809cf7bd87aea3b3cbd8e6d5f638f1ad7523c94845873b481f32c1864
Files
-
810b988809cf7bd87aea3b3cbd8e6d5f638f1ad7523c94845873b481f32c1864.exe windows x86
ba90ad34d445f6ef742e06891b3f8020
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
QueryPerformanceCounter
GetCommandLineW
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
CreateProcessW
lstrcmpiW
lstrcpynW
CopyFileW
FormatMessageW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
CreateDirectoryW
OutputDebugStringW
lstrcmpW
CompareStringW
GetSystemDefaultLangID
GetLastError
GetCurrentProcess
GetTickCount
GetStartupInfoA
user32
LoadKeyboardLayoutW
UnloadKeyboardLayout
advapi32
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
imm32
ImmInstallIMEW
ole32
CoInitialize
CoUninitialize
shlwapi
SHDeleteKeyW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
msvcrt
exit
_vsnwprintf
memmove
wcsstr
_c_exit
_except_handler3
_XcptFilter
_cexit
_exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 430KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ