Static task
static1
Behavioral task
behavioral1
Sample
8031a21c0f24ae9030cc43d764879314408bdfca07bd91cf59381ee30d0ce682.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8031a21c0f24ae9030cc43d764879314408bdfca07bd91cf59381ee30d0ce682.exe
Resource
win10v2004-20230220-en
General
-
Target
8031a21c0f24ae9030cc43d764879314408bdfca07bd91cf59381ee30d0ce682
-
Size
1.3MB
-
MD5
6e2431dcf1b671368207083e7498e04f
-
SHA1
05cf52453c98d07c1719f78f250361e648e67ddb
-
SHA256
8031a21c0f24ae9030cc43d764879314408bdfca07bd91cf59381ee30d0ce682
-
SHA512
d93ef6ca7e100b0db834591d954a39adca3c7b6c612b16095524899b57713aa4bc9c1b66c290edc0f5ca4a8bb18690b60017da17df10314a47a4b697dbb5d5dc
-
SSDEEP
24576:+lSa1SDqmTBczJdN81MJMddcA0D2itrqE:L4SDqCBKA0D2itrqE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8031a21c0f24ae9030cc43d764879314408bdfca07bd91cf59381ee30d0ce682
Files
-
8031a21c0f24ae9030cc43d764879314408bdfca07bd91cf59381ee30d0ce682.exe windows x86
ba90ad34d445f6ef742e06891b3f8020
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
QueryPerformanceCounter
GetCommandLineW
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
CreateProcessW
lstrcmpiW
lstrcpynW
CopyFileW
FormatMessageW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
CreateDirectoryW
OutputDebugStringW
lstrcmpW
CompareStringW
GetSystemDefaultLangID
GetLastError
GetCurrentProcess
GetTickCount
GetStartupInfoA
user32
LoadKeyboardLayoutW
UnloadKeyboardLayout
advapi32
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
imm32
ImmInstallIMEW
ole32
CoInitialize
CoUninitialize
shlwapi
SHDeleteKeyW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
msvcrt
exit
_vsnwprintf
memmove
wcsstr
_c_exit
_except_handler3
_XcptFilter
_cexit
_exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 430KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ