Static task
static1
Behavioral task
behavioral1
Sample
381a38d455d313445dad517b31270ca331a7a49cfbc8a25dcd56897da560f696.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
381a38d455d313445dad517b31270ca331a7a49cfbc8a25dcd56897da560f696.exe
Resource
win10v2004-20230220-en
General
-
Target
381a38d455d313445dad517b31270ca331a7a49cfbc8a25dcd56897da560f696
-
Size
116KB
-
MD5
3ea164f945e009b3b95d73239fa15e74
-
SHA1
9e277b7097e84e4b460c337030e06f80be14cd5a
-
SHA256
381a38d455d313445dad517b31270ca331a7a49cfbc8a25dcd56897da560f696
-
SHA512
620ee851daec5779df45a819bdec454eaec51c1459233329a0c12380949d759a8f7fb142686eaa97633d1d3a7f60cba69e593511d7f3748e4aad6db1dfaa2f6b
-
SSDEEP
3072:fOwmoMZvqfOznntZAUo9UW7PMVt1LpH1:moMZifUntMMVt1VV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 381a38d455d313445dad517b31270ca331a7a49cfbc8a25dcd56897da560f696
Files
-
381a38d455d313445dad517b31270ca331a7a49cfbc8a25dcd56897da560f696.exe windows x86
9838f0022dd9e11901773cf7d15ad3b9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualAlloc
GetPrivateProfileIntW
MultiByteToWideChar
lstrlenW
GetCommandLineW
FlushFileBuffers
CloseHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
SetConsoleCtrlHandler
ReadFile
SetEndOfFile
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetProcAddress
GetOEMCP
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
CreateFileW
SetStdHandle
LCMapStringW
HeapFree
HeapReAlloc
HeapAlloc
RtlUnwind
GetCommandLineA
GetVersion
ExitProcess
GetLastError
WideCharToMultiByte
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
GetACP
IsBadWritePtr
LCMapStringA
FreeEnvironmentStringsW
WriteFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
IsValidCodePage
GetEnvironmentStrings
GetEnvironmentStringsW
GetCPInfo
IsValidLocale
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetFilePointer
user32
LoadStringW
shell32
CommandLineToArgvW
odbc32
ord119
ord72
ord12
ord3
ord111
ord4
ord13
ord16
ord110
ord2
ord1
ord15
ord150
ord107
ord14
ord139
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
efulntg Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE