Static task
static1
Behavioral task
behavioral1
Sample
de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0.exe
Resource
win10v2004-20230220-en
General
-
Target
ac2905ab89ac3a775a7b3b729f8f25a4.bin
-
Size
137KB
-
MD5
dc200e8591d4abbc65605d2c10591b4b
-
SHA1
38644d99d88ffbaa8eb6188b5474e39bf09cc7de
-
SHA256
f901695b7a675d77bc7eacb75cf29850dce144997f192e76b56977e6fca06218
-
SHA512
84481f68c867c1c07559dd98e910b8018924bf3499f2f161964de42a0f3d8341206a821406932979b6cce371ebd08e4a4c0083d43ef9e5d3f0e7b177eddf0c1d
-
SSDEEP
3072:hUlW4v6rvtb3A9RfWAXYxOcIECQBRyKahhhGWvp6ilklKFugTGtR25VxGVM:SLAvtb8dWAXYxOcXBRZekMogTGtR25VZ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0.exe
Files
-
ac2905ab89ac3a775a7b3b729f8f25a4.bin.zip
Password: infected
-
de250df1e7489a671f81a4c2e6d8d878fc8e0a31dfe36b6a716fda90d5b16bb0.exe.exe windows x86
Password: infected
7f87b3efdf116f7ab8f1afe2047eb9b9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ConvertThreadToFiber
GetConsoleAliasExesLengthA
InterlockedIncrement
OpenJobObjectA
InterlockedDecrement
SetMailslotInfo
GetLogicalDriveStringsW
FreeEnvironmentStringsA
GetModuleHandleW
GetTickCount
EnumCalendarInfoExW
WaitNamedPipeW
GetDriveTypeA
GetSystemDirectoryW
SetFileShortNameW
LoadLibraryW
GetCalendarInfoA
LeaveCriticalSection
GetFileAttributesA
GetExitCodeProcess
GetFileAttributesW
SetSystemPowerState
WritePrivateProfileSectionW
CompareStringW
GetVolumePathNameA
GetShortPathNameA
GetPrivateProfileIntW
CreateMutexW
GetProcAddress
AttachConsole
MoveFileW
SetComputerNameA
SearchPathA
OpenThread
WriteConsoleA
InterlockedExchangeAdd
OpenWaitableTimerW
LocalAlloc
SetCalendarInfoW
MoveFileA
FindFirstVolumeMountPointW
AddAtomW
SetFileApisToANSI
GetDiskFreeSpaceA
GetPrivateProfileStructA
FindFirstVolumeMountPointA
GetModuleHandleA
CancelTimerQueueTimer
FreeEnvironmentStringsW
FindNextFileW
GetStringTypeW
EnumDateFormatsW
SetThreadAffinityMask
GetCurrentProcessId
EnumSystemLocalesW
DeleteFileA
SetProcessAffinityMask
GetCurrentDirectoryW
GetVolumeNameForVolumeMountPointA
GetLastError
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
HeapAlloc
IsProcessorFeaturePresent
EncodePointer
DecodePointer
HeapCreate
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
EnterCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
ExitProcess
WriteFile
GetModuleFileNameW
GetModuleFileNameA
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetSystemTimeAsFileTime
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
FlushFileBuffers
SetStdHandle
WriteConsoleW
MultiByteToWideChar
LCMapStringW
CloseHandle
CreateFileW
gdi32
GetCharABCWidthsW
SelectObject
Sections
.text Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 78KB - Virtual size: 541KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ