Static task
static1
Behavioral task
behavioral1
Sample
644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1.exe
Resource
win10v2004-20230220-en
General
-
Target
644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1
-
Size
1.8MB
-
MD5
ee9aae527b76d820d8073cfc8aadd2a6
-
SHA1
4173a59c04c8caae5d6dedef6a44eed3563fd07d
-
SHA256
644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1
-
SHA512
83abce43e3dc9392f80325d14aa4f8d57a6e90f6539292d28aa1c743b250df37a7a12202d3d9a5af2053141d0aadca455c4bf2249eabf1155f081ccbac8c5093
-
SSDEEP
49152:br7lvXVA25XQvTL+khaqsw7Srlvg+VenyDw5:xvXVACXQ7qkhaq97KAnyk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1
Files
-
644d7b2a5b77af5c208cd25183d1fd2ef5166839c2527feed817a9edf8428af1.exe windows x64
9fe18d292b258bdcf5aad70fe76cdf38
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
oleaut32
VariantCopy
ole32
CoDisconnectObject
shell32
ShellExecuteA
advapi32
RegOpenKeyExA
winspool.drv
OpenPrinterA
gdi32
CopyMetaFileA
winmm
PlaySoundA
imm32
ImmGetContext
oleacc
CreateStdAccessibleObject
gdiplus
GdipSetInterpolationMode
urlmon
URLDownloadToFileA
uxtheme
GetThemeSysColor
shlwapi
PathFindFileNameA
msimg32
TransparentBlt
user32
GetMenuItemInfoA
kernel32
InitializeCriticalSectionEx
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 494KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: - Virtual size: 574KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ