Static task
static1
Behavioral task
behavioral1
Sample
Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe
Resource
win10v2004-20230621-en
General
-
Target
Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe
-
Size
7.9MB
-
MD5
07cadbe7bc8b5498b6f7979a03064609
-
SHA1
2bddc858100e13bdbfac0d1c24f538e9caac5168
-
SHA256
77a4fd0f80e216e87a2351174bbc558ad5a172addd3a2d9def3a17dcb527105e
-
SHA512
d6dc261f7818cc6e922ea7723d778f0a238b4ce53438764a0507305a6a1752476dafeb084398166d00afd22b29b5c8ec8b873207f709b7021868eee9bd74e441
-
SSDEEP
49152:uW5u9t4HMIHFIdoWYvK6I8RnSMMCs7n4ce2GJ/Dful4mjpqVemmwQYdecHu/gePj:3ytSM14g8iKjHigy9xzWNK7sH8bVwza
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe
Files
-
Malicious_5e12ab49e48b8a54b24e42c50137df4b08e9a4798ec81cb65106c49ae214a71e.exe.exe windows x86
8c1f25eacb6be958ac99363b44f7685a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
FreeLibrary
Sleep
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
SetEnvironmentVariableW
GetSystemInfo
GetComputerNameW
CreateFileW
FlushFileBuffers
SetFilePointer
WriteFile
SetEvent
GetStdHandle
DuplicateHandle
GetLastError
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetStartupInfoW
GetCurrentThreadId
SetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
MoveFileExW
GetCurrentDirectoryW
GetTempPathW
WideCharToMultiByte
CreateEventW
ReadFile
FindClose
FindFirstFileW
FindNextFileW
ResetEvent
CreateMutexW
LocalFree
FormatMessageW
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetProcessHeap
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
HeapReAlloc
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
ExitProcess
GetFullPathNameA
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
GetModuleHandleA
CreateThread
GetConsoleMode
SetConsoleMode
GetFileType
SetLastError
GetVersionExA
GetModuleHandleW
LoadLibraryExW
GetCommandLineW
GetCurrentDirectoryA
IsValidCodePage
IsDBCSLeadByteEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
ReadConsoleW
GetFileSizeEx
GetConsoleOutputCP
SetStdHandle
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetProcAddress
GetWindowsDirectoryW
SetCurrentDirectoryW
LoadLibraryA
GetModuleFileNameW
GetModuleFileNameA
GetExitCodeThread
UnlockFileEx
WaitForSingleObject
user32
ShowWindow
CreateWindowExA
GetClassInfoA
MoveWindow
DefWindowProcA
SendMessageA
LoadCursorA
GetActiveWindow
MessageBoxA
RegisterClassA
LoadIconA
gdi32
GetStockObject
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
Sections
.text Size: 5.4MB - Virtual size: 5.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 270KB - Virtual size: 580KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ