Static task
static1
Behavioral task
behavioral1
Sample
7a47c279592b84f5edc470c37f17de914ef841e9508e1eec9412f48f3b9f1952.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
7a47c279592b84f5edc470c37f17de914ef841e9508e1eec9412f48f3b9f1952.exe
Resource
win10v2004-20230621-en
General
-
Target
7a47c279592b84f5edc470c37f17de914ef841e9508e1eec9412f48f3b9f1952
-
Size
2.0MB
-
MD5
68ca01f31a853f28b86f3a0df3a6da06
-
SHA1
2627922aed7fc721ee563910962de8d4c9da72eb
-
SHA256
7a47c279592b84f5edc470c37f17de914ef841e9508e1eec9412f48f3b9f1952
-
SHA512
8b9753d972bc6bc33067dcba62ef3cac3b32056eb1fe560391bd050691cb99d09359bda0a85315a479dac521ce131d21783e67f85021b6bd8354e2491e71fa64
-
SSDEEP
24576:8Ht/x0BayJhLFaGDmykErDUEqNm5Y2PCQPCszpj:8TyJhLe2PCQPCS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7a47c279592b84f5edc470c37f17de914ef841e9508e1eec9412f48f3b9f1952
Files
-
7a47c279592b84f5edc470c37f17de914ef841e9508e1eec9412f48f3b9f1952.exe windows x86
414dd7492c0be530e074e8cedbe540d8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
GetEnvironmentVariableA
FindFirstFileA
GetProcAddress
VirtualAlloc
CopyFileA
FindClose
LoadLibraryA
Process32Next
GlobalMemoryStatusEx
GetModuleFileNameA
FindNextFileA
CreateToolhelp32Snapshot
CloseHandle
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
GetConsoleWindow
lstrcpynA
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetTickCount
GetModuleHandleA
FreeConsole
AllocConsole
SetConsoleCtrlHandler
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
LockResource
GlobalAlloc
GlobalReAlloc
GlobalFree
ReadFile
CreateDirectoryW
GetLastError
EncodePointer
DecodePointer
GetFileAttributesExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
HeapAlloc
GetDriveTypeW
GetFullPathNameA
GetSystemTimeAsFileTime
GetModuleHandleExW
AreFileApisANSI
GetCommandLineA
RaiseException
Process32First
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
HeapSize
SetLastError
InterlockedIncrement
GetCurrentThreadId
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
CreateFileW
GetProcessHeap
GetCurrentDirectoryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetModuleHandleW
LoadLibraryExW
GetFileType
InitOnceExecuteOnce
QueryPerformanceCounter
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetConsoleCP
SetFilePointerEx
HeapReAlloc
OutputDebugStringW
LoadLibraryW
CompareStringEx
LCMapStringEx
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetExitCodeProcess
CreateProcessA
SetEndOfFile
ReadConsoleW
SetEnvironmentVariableA
lstrlenA
LocalFree
InterlockedDecrement
ExitProcess
GetLocalTime
RtlUnwind
Sleep
user32
ValidateRect
GetWindowRect
AdjustWindowRectEx
ScreenToClient
LoadCursorA
DestroyIcon
IsWindowVisible
ReleaseDC
SendMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
GetForegroundWindow
SetWindowPos
DestroyWindow
CreateWindowExA
GetAsyncKeyState
GetDC
RegisterClassExA
UnregisterClassA
PostQuitMessage
DefWindowProcA
DrawTextA
ShowWindow
PostMessageA
advapi32
OpenProcessToken
GetLengthSid
ole32
CoInitializeSecurity
CoCreateInstance
CoInitializeEx
shell32
ExtractIconA
oleaut32
SysFreeString
VariantInit
VariantClear
SysAllocString
ws2_32
socket
recv
WSACleanup
htons
inet_addr
WSAStartup
connect
send
closesocket
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ