Static task
static1
Behavioral task
behavioral1
Sample
bab5238b20dd7f549ae3082a6ded0b64572a660fe8814b574cd09a8d81772496.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
bab5238b20dd7f549ae3082a6ded0b64572a660fe8814b574cd09a8d81772496.exe
Resource
win10v2004-20230703-en
General
-
Target
bab5238b20dd7f549ae3082a6ded0b64572a660fe8814b574cd09a8d81772496
-
Size
574KB
-
MD5
b05be8d006512e45932290f0139b7951
-
SHA1
6d646667af1b0d9381c318498b73fcc31a375995
-
SHA256
bab5238b20dd7f549ae3082a6ded0b64572a660fe8814b574cd09a8d81772496
-
SHA512
5f455e28c97821aa9d47b89110fc86cff642469e41aa0c72db97d96099ae39649ac8c91874c45d12acc5f4f049f7846454d52eb482eda2ea32f92abd2854a64a
-
SSDEEP
12288:9MBCr1zaCaKJ+oKawLXN49o5TNVrcbuJgkCbINiAyMQLSDpVixurBx:9MBCr1z1N5otgMgSBtx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bab5238b20dd7f549ae3082a6ded0b64572a660fe8814b574cd09a8d81772496
Files
-
bab5238b20dd7f549ae3082a6ded0b64572a660fe8814b574cd09a8d81772496.exe windows x86
7479a2a25e67bcb51631a0ae521145b3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wldap32
ord200
ord301
ord35
ord30
ord79
ord33
ord50
ord60
ord211
ord46
ord32
ord27
ord26
ord22
ord143
ord41
crypt32
CertFreeCertificateContext
kernel32
VirtualAllocEx
CreateRemoteThread
HeapFree
GetCurrentProcess
WaitForSingleObject
OpenProcess
CloseHandle
HeapAlloc
GetCurrentProcessId
GetProcessHeap
CreateDirectoryW
ReadFile
WriteFile
SetFilePointer
CreateFileW
GetFileAttributesW
MultiByteToWideChar
LocalFileTimeToFileTime
GetCurrentDirectoryW
SystemTimeToFileTime
WideCharToMultiByte
DeleteFileW
SetFileAttributesW
GetLocalTime
GetFileSize
SetEndOfFile
OutputDebugStringW
WriteProcessMemory
FindNextFileW
lstrcpynW
InitializeCriticalSectionEx
FreeLibrary
GetProcAddress
GetTickCount64
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
SleepEx
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
VerifyVersionInfoA
FormatMessageA
WaitForSingleObjectEx
GetStdHandle
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
SetStdHandle
ExitProcess
GetFullPathNameW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetTimeZoneInformation
HeapSize
WriteConsoleW
FindClose
DecodePointer
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
FlushFileBuffers
GetFileSizeEx
LCMapStringW
CompareStringW
HeapReAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
SetFilePointerEx
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RaiseException
RtlUnwind
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeSListHead
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegCreateKeyA
RegCloseKey
RegQueryValueExW
shell32
SHGetSpecialFolderPathW
shlwapi
PathFileExistsW
PathAppendW
ws2_32
select
__WSAFDIsSet
recv
WSACleanup
WSAStartup
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
WSASetLastError
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
htonl
ntohl
WSAGetLastError
Sections
.text Size: 407KB - Virtual size: 407KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE