Static task
static1
Behavioral task
behavioral1
Sample
6e49699c896bcec4c611bc6f0bd125587edbf0066c3ec34b82653fe7787a79bc.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
6e49699c896bcec4c611bc6f0bd125587edbf0066c3ec34b82653fe7787a79bc.exe
Resource
win10v2004-20230621-en
General
-
Target
6e49699c896bcec4c611bc6f0bd125587edbf0066c3ec34b82653fe7787a79bc
-
Size
2.4MB
-
MD5
f0b5eff7c44a76605fbead4b0bda71d6
-
SHA1
4da3ff5cd44f8ceeb370f210c02f2fd1ec95f5bc
-
SHA256
6e49699c896bcec4c611bc6f0bd125587edbf0066c3ec34b82653fe7787a79bc
-
SHA512
53c9605c621df53260f1ba678e832fa82db6e6777d27ea3f1c181a731d6eaec0efaecdd43975254afaf15100a8d9650c1fe6d682cd0984d73dca3d29cb87e18e
-
SSDEEP
49152:3Yk+xcqDp6DDMYDEBK1yzzhUxAO2Q29o3OMzgMDFlZyuaaaaaaaBqqqqqqqq:ok+xcqogM3aaaaaaaUqqqqqqq
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6e49699c896bcec4c611bc6f0bd125587edbf0066c3ec34b82653fe7787a79bc
Files
-
6e49699c896bcec4c611bc6f0bd125587edbf0066c3ec34b82653fe7787a79bc.exe windows x64
1670df281cfe17fb13096fa2e296cd16
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
htons
connect
inet_addr
WSAStartup
socket
send
recv
crypt32
CryptStringToBinaryA
kernel32
WriteConsoleW
SetEndOfFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
SetEnvironmentVariableA
HeapSize
IsDebuggerPresent
VirtualAlloc
CreateThread
Sleep
WriteFile
ReadFile
CreateFileA
FreeLibrary
GetProcAddress
HeapFree
GetProcessHeap
GetLastError
WideCharToMultiByte
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapReAlloc
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
GetTimeZoneInformation
ole32
CoCreateGuid
Sections
.text Size: 1007KB - Virtual size: 1007KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 521KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 200KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ