Static task
static1
Behavioral task
behavioral1
Sample
82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe
Resource
win10v2004-20230220-en
General
-
Target
82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a
-
Size
2.3MB
-
MD5
66d9374cb8b23b992bc8708a92fd2e38
-
SHA1
ab43568aa7f05d659baa6e8ed694c14ebba20220
-
SHA256
82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a
-
SHA512
81a4756b51a66802512ca5c2d68fd8d0a18d4e7d66f4734eeef05a53b695f7eb907150464c4ce8025bfc3cd825d41e81a830691ccf00b5d53441081be9bfad85
-
SSDEEP
24576:q9JJd3n+Otv2K5iP7iQ96H00A0xDoJJJJJJJUh9JJd3n+Otv2K5iP7i:qOyCPOdHEiOyCPO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a
Files
-
82ca26a495c39e05a9efe89602421776c27055d7c842d88d5d536bab1cb2274a.exe windows x86
ba90ad34d445f6ef742e06891b3f8020
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExW
FreeLibrary
GetProcAddress
LoadLibraryW
QueryPerformanceCounter
GetCommandLineW
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
TerminateProcess
CreateProcessW
lstrcmpiW
lstrcpynW
CopyFileW
FormatMessageW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
CreateDirectoryW
OutputDebugStringW
lstrcmpW
CompareStringW
GetSystemDefaultLangID
GetLastError
GetCurrentProcess
GetTickCount
GetStartupInfoA
user32
LoadKeyboardLayoutW
UnloadKeyboardLayout
advapi32
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegCloseKey
imm32
ImmInstallIMEW
ole32
CoInitialize
CoUninitialize
shlwapi
SHDeleteKeyW
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
msvcrt
exit
_vsnwprintf
memmove
wcsstr
_c_exit
_except_handler3
_XcptFilter
_cexit
_exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Sections
.text Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 430KB - Virtual size: 431KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ