Static task
static1
Behavioral task
behavioral1
Sample
sc_serv.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sc_serv.exe
Resource
win10v2004-20230220-en
General
-
Target
sc_serv.exe
-
Size
152KB
-
MD5
78f54ffb6c38b9f64a6774781bbfe55e
-
SHA1
57df978df3cff92beae82cbd4aa314cb670094da
-
SHA256
fc440249ce234612174f0b7ba6140be5138552d90f400880d7b3f86c8a2e2cea
-
SHA512
dbac2c1d087778edd649983e877b1c201822f11fce4617ca246ea846e4f799e019aea5841b37d04d053c3464c58165fb1bf9475ebcb4e7c7cf5a2c7edd06618b
-
SSDEEP
3072:CKiD6JxlYiT34MDbikZJg37NRVD1yvUzs3NZ2roD4oQYak:CKp/lF6NRVD1103erYak
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource sc_serv.exe
Files
-
sc_serv.exe.exe windows x86
58194b12e65aeb67bb504627ae7edfcd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
InitializeCriticalSection
ExitProcess
DeleteCriticalSection
GetModuleHandleA
lstrcpynA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
CreateFileA
SetStdHandle
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
RtlUnwind
TlsGetValue
SetLastError
TlsAlloc
GetCurrentThreadId
UnhandledExceptionFilter
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
ReadFile
HeapAlloc
HeapFree
GetLastError
DeleteFileA
GetTimeZoneInformation
GetSystemTime
GetLocalTime
SetConsoleCtrlHandler
ResumeThread
CreateThread
TlsSetValue
ExitThread
CloseHandle
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersion
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStdHandle
GetFileType
SetFilePointer
FlushFileBuffers
WriteFile
user32
ShowWindow
SendMessageA
SetTimer
MessageBoxA
SetDlgItemTextA
LoadIconA
GetDlgItem
SetForegroundWindow
KillTimer
SetClassLongA
DialogBoxParamA
shell32
Shell_NotifyIconA
ShellExecuteA
wsock32
gethostbyname
ioctlsocket
socket
connect
recv
send
ntohl
accept
WSAGetLastError
gethostbyaddr
WSACleanup
WSAStartup
inet_ntoa
closesocket
shutdown
bind
listen
WSASetLastError
htons
Sections
.text Size: 96KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ