Static task
static1
Behavioral task
behavioral1
Sample
Wares.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Wares.exe
Resource
win10v2004-20230621-en
General
-
Target
Wares.exe
-
Size
454KB
-
MD5
6c63ba0cc1e74357babc9d260703d630
-
SHA1
27cac9c3cd7244467bb702a866e9458a4287120a
-
SHA256
3cea23cac60b3f6f124b347fb6b8a901cca8be87a9d7579ba1e6df0e3584d488
-
SHA512
483bb0d67f26eeb27416d0cc1ba411f71382d007f75bf21bc8098355406cb86b003a348c4dff2f29fc00e892305b940bc65e03bc3c5ddd613daca1fdf3233007
-
SSDEEP
12288:0uu73DygRHJnGycyyzoKCSW7JuPXmnhI7kF:0uu73OMpG9yyzoKXPXD7kF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Wares.exe
Files
-
Wares.exe.exe windows x86
aca35d13adb97d2c480a39887a5f629a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
wsock32
gethostbyname
winmm
mixerOpen
version
VerQueryValueA
comctl32
ord6
psapi
GetModuleBaseNameA
wininet
InternetOpenA
user32
GetDC
gdi32
BitBlt
comdlg32
GetSaveFileNameA
advapi32
RegCloseKey
shell32
DragFinish
ole32
CoGetObject
oleaut32
SafeArrayGetLBound
Sections
.MPRESS1 Size: 298KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE