Static task
static1
Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20230221-en
General
-
Target
sample.exe
-
Size
90KB
-
MD5
25a6fdda5e3f0c7ca91be1090997d9cc
-
SHA1
19e0dd4f8e6b631ad4a223d767be726b0284f21f
-
SHA256
d7b14a634313a0aacbc543c68538da9762902314be1bfecc2070c9214b03ea25
-
SHA512
7625c8a252880b3ee32f9230e85a868655053b7269afddeb6881b44ca9d73d599b415eca42e17d2222e71866f93850f0084b024d4fceeaea1840a679d1e01fd9
-
SSDEEP
1536:7QxhttG9OcKGZDujOW87DW0YeFQTO2hQu62MxqtwoFdouEvmXnYXG1sWsbcdaZZB:7QxhG9OXGZD0OW8hQTO2hQu7MxUw1uE9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sample.exe
Files
-
sample.exe.exe windows x86
79c9f037f5da57435230c2fa35020e73
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Module32FirstW
CreateFileW
Sleep
GetVolumeInformationW
CreateMutexW
GetLastError
GetLongPathNameW
Process32NextW
FindClose
CopyFileW
OutputDebugStringW
CreateProcessW
GetFileAttributesW
CreateDirectoryW
WriteConsoleW
FindFirstFileW
CloseHandle
SetFilePointerEx
Process32FirstW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
GetStringTypeW
GetFileType
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
CreateToolhelp32Snapshot
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindFirstFileExW
FindNextFileW
IsValidCodePage
DecodePointer
hid
HidD_GetAttributes
setupapi
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
user32
BeginPaint
DefWindowProcW
DestroyWindow
DialogBoxParamW
RegisterDeviceNotificationW
EndPaint
RegisterClassExW
PostQuitMessage
LoadIconW
UnregisterDeviceNotification
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
LoadStringW
PostMessageW
EndDialog
LoadCursorW
CreateWindowExW
advapi32
GetUserNameW
shell32
SHGetPathFromIDListW
SHGetSpecialFolderLocation
wtsapi32
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
Sections
.text Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ