Static task
static1
Behavioral task
behavioral1
Sample
Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe
Resource
win10v2004-20230621-en
General
-
Target
Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe
-
Size
7.9MB
-
MD5
76e776ccb691ba1c5cf8bc6a155b6140
-
SHA1
6739535b1c5b19d3dd487196a9fce7376ac4d293
-
SHA256
5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e
-
SHA512
7132223e45d7833f2719e97a1d930f06f7eb81fb47dcf68a7763d8bc24732b998ace45842bd5b8c9398518cb3d8c9118bafdc0664aa1896190ae825742b655a8
-
SSDEEP
49152:uW5u9t4HMIHFIdoWYvK6I8RnSMMCs7n4ce2GJ/Dful4mjpqVemmwQYdecHu/gePO:3ytSM14g8iKjHigy9xzWNK7sH8bVwz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe
Files
-
Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe.exe windows x86
8c1f25eacb6be958ac99363b44f7685a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
FreeLibrary
Sleep
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
SetEnvironmentVariableW
GetSystemInfo
GetComputerNameW
CreateFileW
FlushFileBuffers
SetFilePointer
WriteFile
SetEvent
GetStdHandle
DuplicateHandle
GetLastError
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetStartupInfoW
GetCurrentThreadId
SetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
MoveFileExW
GetCurrentDirectoryW
GetTempPathW
WideCharToMultiByte
CreateEventW
ReadFile
FindClose
FindFirstFileW
FindNextFileW
ResetEvent
CreateMutexW
LocalFree
FormatMessageW
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetProcessHeap
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
HeapReAlloc
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
ExitProcess
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
GetModuleHandleA
CreateThread
GetConsoleMode
SetConsoleMode
GetFileType
SetLastError
GetVersionExA
GetModuleHandleW
LoadLibraryExW
GetCommandLineW
GetCurrentDirectoryA
IsValidCodePage
IsDBCSLeadByteEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
ReadConsoleW
GetFileSizeEx
GetConsoleOutputCP
SetStdHandle
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetProcAddress
GetWindowsDirectoryW
SetCurrentDirectoryW
LoadLibraryA
GetModuleFileNameW
GetModuleFileNameA
GetExitCodeThread
UnlockFileEx
WaitForSingleObject
user32
ShowWindow
CreateWindowExA
GetClassInfoA
MoveWindow
DefWindowProcA
SendMessageA
LoadCursorA
GetActiveWindow
MessageBoxA
RegisterClassA
LoadIconA
gdi32
GetStockObject
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
Sections
.text Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 270KB - Virtual size: 580KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ