Static task
static1
Behavioral task
behavioral1
Sample
30bc10954a94c68ba56d3e805861693b0180e03280f310a1a3e0015a26078cf2.exe
Resource
win10v2004-20230220-en
General
-
Target
30bc10954a94c68ba56d3e805861693b0180e03280f310a1a3e0015a26078cf2
-
Size
781KB
-
MD5
a4fa625cd869da2c61391726f87712d5
-
SHA1
6ce47759a42f9837bd8a11db3b2c1830df2c30d3
-
SHA256
30bc10954a94c68ba56d3e805861693b0180e03280f310a1a3e0015a26078cf2
-
SHA512
3cd854bb201b48c31df4f14d184570ca867f7fa9f5e5fd63f82a0a8307ca34e85d3681f8777fa4c29c8fcbfe35556c068bb6d2d138efba052a84e576dd1731b7
-
SSDEEP
12288:Ud8RAnO05qcjZdT+qXM1zgH0yqRCG4kcw9dKK8Sb8SB/xIPD:UFrD+qXM1ByqRZUw9dF8E8StxIP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 30bc10954a94c68ba56d3e805861693b0180e03280f310a1a3e0015a26078cf2
Files
-
30bc10954a94c68ba56d3e805861693b0180e03280f310a1a3e0015a26078cf2.exe windows x86
90a8b2b6ad978d000a5ba3658ad3f7fb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedDecrement
UnlockFile
GetModuleHandleW
GetTickCount
GetConsoleAliasesA
GetDateFormatA
CreateActCtxW
GetVolumePathNameW
FindResourceExA
GlobalAlloc
LoadLibraryW
SetCommConfig
GetCalendarInfoW
FormatMessageW
WriteConsoleOutputA
FindNextVolumeW
WriteConsoleW
GetACP
GetStringTypeExA
GetProfileIntA
SetCurrentDirectoryA
GetLogicalDriveStringsA
GetLastError
GetCurrentDirectoryW
SetLastError
ReadConsoleA
VirtualAlloc
IsValidCodePage
ReadFileEx
LoadLibraryA
OpenMutexA
BeginUpdateResourceA
GetModuleFileNameA
QueryMemoryResourceNotification
PurgeComm
OpenSemaphoreW
FindFirstVolumeA
GetVersionExA
ReadConsoleInputW
GetWindowsDirectoryW
GetCurrentProcessId
AddConsoleAliasA
CommConfigDialogW
CreateFileA
GetConsoleOutputCP
WriteConsoleA
CloseHandle
SetUnhandledExceptionFilter
CreateTimerQueue
GetProcAddress
SetProcessAffinityMask
FlushFileBuffers
GetConsoleMode
GetConsoleCP
InterlockedIncrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
HeapFree
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RtlUnwind
RaiseException
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetCPInfo
ExitProcess
WriteFile
GetStdHandle
HeapAlloc
HeapCreate
VirtualFree
HeapReAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapSize
SetHandleCount
GetFileType
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetOEMCP
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetLocaleInfoW
user32
LoadMenuW
GetSysColorBrush
GetCaretPos
CharUpperBuffW
CharToOemBuffW
gdi32
GetTextExtentPointW
advapi32
ReportEventA
ReadEventLogW
winhttp
WinHttpSetDefaultProxyConfiguration
WinHttpOpen
WinHttpCheckPlatform
Sections
.text Size: 666KB - Virtual size: 666KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 4.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ