Static task
static1
Behavioral task
behavioral1
Sample
3320f11728458d01eef62e10e48897ec1c2277c1fe1aa2d471a16b4dccfc1207.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3320f11728458d01eef62e10e48897ec1c2277c1fe1aa2d471a16b4dccfc1207.exe
Resource
win10v2004-20230220-en
General
-
Target
8752a7a052ba75239b86b0da1d483dd7.bin
-
Size
52KB
-
MD5
3e4bdfe289b837d7a0102a57f9c7629e
-
SHA1
ee492aa38b2d07351f46452f9def83a59a007ac0
-
SHA256
dda1f8f776539f93daaa1e1b955d6a395fc689ab31afd8fac54ebdc90e183d71
-
SHA512
e4747c76096d6c70d321c198f292284bd0a82c4af361ba1568eb2824dec69cf43a8cce94053b8643927e619bdc7fce0cd1ee5ca2673d5010b3257b6c311de386
-
SSDEEP
1536:NqkhpIRfr/G0JCeiaGgW6kc3I2pW05r3c:NXjSS0JQItI29tc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/3320f11728458d01eef62e10e48897ec1c2277c1fe1aa2d471a16b4dccfc1207.exe
Files
-
8752a7a052ba75239b86b0da1d483dd7.bin.zip
Password: infected
-
3320f11728458d01eef62e10e48897ec1c2277c1fe1aa2d471a16b4dccfc1207.exe.exe windows x86
Password: infected
ecf8f06eaa7a27093275957985742b1a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatW
GlobalAlloc
DeleteFileW
lstrcpyA
GlobalFree
CloseHandle
CreateThread
MoveFileExW
lstrcpyW
CreateFileMappingW
MapViewOfFile
lstrcmpW
BeginUpdateResourceA
EraseTape
FindFirstVolumeW
GetProfileSectionW
GetCurrentProcess
lstrlenW
CancelDeviceWakeupRequest
TerminateProcess
GlobalUnWire
GetConsoleTitleW
EnumResourceNamesW
CreateMutexW
OpenFile
EnumSystemCodePagesW
CancelThreadpoolIo
GlobalDeleteAtom
QueryMemoryResourceNotification
GetACP
OpenProcess
FindFirstVolumeMountPointA
FindActCtxSectionStringA
CreateToolhelp32Snapshot
Sleep
SetFileAttributesW
GetConsoleAliasesLengthW
CreateFileW
CreateFileA
DefineDosDeviceA
GetSystemFileCacheSize
GetCurrentThread
GetSystemDirectoryA
Process32FirstW
GlobalFindAtomW
QueueUserAPC
LocalSize
FindAtomA
ExitProcess
FreeLibrary
GetSystemTime
GlobalUnlock
GetDriveTypeW
FindFirstFileTransactedA
CreateTimerQueue
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetLastError
UnmapViewOfFile
WaitForSingleObject
ReadFile
FindClose
lstrlenA
SetFilePointer
SetErrorMode
VirtualAlloc
GetProcessHeap
GetStringTypeW
GetFileType
WriteFile
FindNextFileW
VirtualFree
FindFirstFileW
Process32NextW
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
HeapFree
HeapAlloc
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
RaiseException
user32
EqualRect
DestroyIcon
EnumWindows
CharUpperBuffW
GetDesktopWindow
GetWindowTextW
wsprintfW
GetLastActivePopup
gdi32
CreateDIBPatternBrush
advapi32
CryptGenKey
CryptExportKey
CryptEncrypt
CryptAcquireContextW
CryptDestroyKey
CryptReleaseContext
shell32
SHGetSpecialFolderPathW
shlwapi
StrStrW
crypt32
CryptImportPublicKeyInfoEx
CryptStringToBinaryA
CryptDecodeObjectEx
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ