Static task
static1
Behavioral task
behavioral1
Sample
ee1a7366583000add321abdd79949f01.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ee1a7366583000add321abdd79949f01.exe
Resource
win10v2004-20230220-en
General
-
Target
ee1a7366583000add321abdd79949f01.exe
-
Size
438KB
-
MD5
ee1a7366583000add321abdd79949f01
-
SHA1
db9201bf7bb4345670b1aaf0b89937099f8bb1e6
-
SHA256
bc1e4e6dd1eec20e8b6685d7e844a0ad045c0700210ef40f451e51dd9fa00910
-
SHA512
ab580e02bb8c0d70ac5edfa8f59848df029f724fbb00b6c92075a9e0497fb1559ece07cd95e5a59b85f05060c76290247dd4265ad41dd045b3af8a13cd5e8372
-
SSDEEP
12288:avBo236cRReRKARDf6U0m7e5J1NezYneTIR7q6wNvJ:aJ3XReRZfH0m7e5J7STIRO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ee1a7366583000add321abdd79949f01.exe
Files
-
ee1a7366583000add321abdd79949f01.exe.exe windows x86
9b2989d99e2629f49acf09b8f648e077
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SearchPathW
ConvertThreadToFiber
GetConsoleAliasExesLengthA
InterlockedIncrement
SetComputerNameW
FreeEnvironmentStringsA
GetTickCount
GetCurrentThread
EnumCalendarInfoExW
SetFileTime
WaitNamedPipeW
EnumTimeFormatsW
GetCommandLineA
GlobalAlloc
GetPrivateProfileIntA
GetSystemDirectoryW
SetFileShortNameW
GetSystemPowerStatus
GetCalendarInfoW
FreeConsole
LeaveCriticalSection
GetFileAttributesA
WriteConsoleW
SetSystemPowerState
TerminateProcess
CompareStringW
GetVolumePathNameA
FindNextVolumeMountPointW
GetShortPathNameA
EnumSystemLocalesA
GetLastError
GetCurrentDirectoryW
GetProcAddress
BeginUpdateResourceW
MoveFileW
SetFileAttributesA
LoadLibraryA
OpenThread
InterlockedExchangeAdd
OpenWaitableTimerW
DeleteTimerQueue
GetNumberFormatW
AddAtomW
SetFileApisToANSI
OpenJobObjectW
GetPrivateProfileStructA
GetModuleHandleA
GetProcessAffinityMask
FindNextFileW
SetCalendarInfoA
GetVolumeNameForVolumeMountPointW
DeleteFileW
GetCurrentProcessId
OpenFileMappingA
MoveFileA
MultiByteToWideChar
HeapSetInformation
GetStartupInfoW
RaiseException
HeapAlloc
HeapFree
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetCPInfo
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcess
EnterCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
CloseHandle
ExitProcess
WriteFile
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetSystemTimeAsFileTime
LCMapStringW
GetStringTypeW
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
SetStdHandle
FlushFileBuffers
HeapSize
LoadLibraryW
HeapReAlloc
CreateFileW
DeleteFileA
Sections
.text Size: 79KB - Virtual size: 79KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 298KB - Virtual size: 23.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vob Size: 1024B - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ