Static task
static1
Behavioral task
behavioral1
Sample
97b2cf87489857dd47af7dbda3da5edd6e9ddc0c5cecbed9b74105a46cebe7e1.exe
Resource
win7-20230621-en
General
-
Target
49ee8deeb69f94cd14a9e69fc1490b81.bin
-
Size
233KB
-
MD5
2b8ed8034f413faef234cf7d2040fd66
-
SHA1
276e2788d74071b5e926cedf1c4fd18ecbbec832
-
SHA256
8828c096a79cb10456e7faf2660b56f2b06268efdc1f476a041022cd6562c4db
-
SHA512
fbeb3f9d674c938f0602e157a1fbe2c68ac76f8f32d187bea38f93b2475b097a1e7f9bd48ba60b4b9601e273ffa2f31e3f82eab5bf48c77d42a6dcf7ba3a1bd9
-
SSDEEP
6144:iNEcE25VsAUHDMxPIIH9cJz+6ejefqjllo:iNk25GAo4xN9cJiEKo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/97b2cf87489857dd47af7dbda3da5edd6e9ddc0c5cecbed9b74105a46cebe7e1.exe
Files
-
49ee8deeb69f94cd14a9e69fc1490b81.bin.zip
Password: infected
-
97b2cf87489857dd47af7dbda3da5edd6e9ddc0c5cecbed9b74105a46cebe7e1.exe.exe windows x86
Password: infected
735a07b48377a1865081819d76cd8354
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
AllocConsole
ConvertThreadToFiber
GetConsoleAliasExesLengthA
InterlockedIncrement
OpenJobObjectA
InterlockedDecrement
WriteConsoleInputA
FreeEnvironmentStringsA
GetModuleHandleW
GetTickCount
GetCurrentThread
GetWindowsDirectoryA
WaitNamedPipeW
EnumTimeFormatsA
GetCommandLineA
GetPriorityClass
GetVolumePathNameW
GlobalAlloc
SetFileShortNameW
GetCalendarInfoA
LeaveCriticalSection
CreateSemaphoreA
GetFileAttributesW
WriteConsoleW
GetCompressedFileSizeA
GetVolumePathNameA
CreateMailslotW
InterlockedExchange
GetCPInfoExW
GetCurrentDirectoryW
SetLastError
GetProcAddress
GetConsoleAliasesLengthW
GlobalGetAtomNameA
SearchPathA
GlobalFree
GetTempFileNameA
OpenWaitableTimerA
LoadLibraryA
OpenThread
SetCalendarInfoW
MoveFileA
GetNumberFormatW
BeginUpdateResourceA
VirtualLock
AddAtomA
HeapWalk
OpenJobObjectW
GetPrivateProfileSectionNamesA
FindNextFileA
EnumDateFormatsA
GetModuleHandleA
GetStringTypeW
GetCurrentDirectoryA
CompareStringA
GetShortPathNameW
GetCPInfoExA
GetVolumeNameForVolumeMountPointW
GetFileInformationByHandle
DebugBreak
ReadConsoleOutputCharacterW
OpenFileMappingA
LocalFileTimeToFileTime
CloseHandle
CreateFileW
MoveFileW
CreateMutexW
GetLastError
WideCharToMultiByte
MultiByteToWideChar
HeapReAlloc
HeapSetInformation
GetStartupInfoW
RaiseException
HeapAlloc
HeapFree
IsProcessorFeaturePresent
EnterCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
HeapCreate
SetFilePointer
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
RtlUnwind
LCMapStringW
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
LoadLibraryW
ReadFile
user32
GetAltTabInfoW
advapi32
ReadEventLogW
Sections
.text Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 198KB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dozig Size: 1024B - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ