Static task
static1
Behavioral task
behavioral1
Sample
2358599bd8767c6fd1655487f4fb22adc65c607ad33651565a6900092834d859.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
2358599bd8767c6fd1655487f4fb22adc65c607ad33651565a6900092834d859.exe
Resource
win10v2004-20230621-en
General
-
Target
2358599bd8767c6fd1655487f4fb22adc65c607ad33651565a6900092834d859
-
Size
11KB
-
MD5
fc1641e48041221b6d61f4ceb0449844
-
SHA1
11978698abb4a80e29768aeb69692077535ae654
-
SHA256
2358599bd8767c6fd1655487f4fb22adc65c607ad33651565a6900092834d859
-
SHA512
a68b25d379d8cd7bb6b03314f4290bd974cfebd2ccc2a069aeef345cd4a8baa28f4a1c0b248a6ebdbfb42e048597251311296bb5c8585c40e8665d6147059612
-
SSDEEP
192:D1c2hLi+wf1pHZT5+X4Q0P+NZoJJREqqPHLNz:xcGLi+wf1HYX4PP+NeV2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2358599bd8767c6fd1655487f4fb22adc65c607ad33651565a6900092834d859
Files
-
2358599bd8767c6fd1655487f4fb22adc65c607ad33651565a6900092834d859.exe windows x86
8b38d031051b8368f9a8ebdaef5e3ab5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
GetSystemDirectoryA
MoveFileExA
GetSystemTimeAsFileTime
IsDebuggerPresent
lstrlenA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceCounter
user32
wsprintfA
advapi32
RegOpenKeyA
RegOpenKeyExA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
shlwapi
SHDeleteValueA
SHDeleteKeyA
msvcr90
_initterm_e
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
__initenv
exit
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_stricmp
_configthreadlocale
memcpy
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 578B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.ropf Size: 512B - Virtual size: 72B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ