Static task
static1
Behavioral task
behavioral1
Sample
b247b3f4exe.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
b247b3f4exe.exe
Resource
win10v2004-20230703-en
General
-
Target
b247b3f4exe.exe
-
Size
2.4MB
-
MD5
6078cbe4668c8893c80c6feb497b43ea
-
SHA1
b5cc57a9bae2fba9d52a2f11a4f623c6a3f3f045
-
SHA256
337ba1bd5050c38f5e07f494d4dc0125276b0e0dea09667d86e7d763249c8f30
-
SHA512
5426b1f4d85baebdb8884305ff52c383f986152f29b19673b9e6c59c5e30ad65b6c635154e1834bb9633dac6f1f2b05818604c376f19843e4f7745a579d5e402
-
SSDEEP
49152:iRy8Fji0FXP4Op3BsiBAi/z95pQJuGXq0I7stSgh8PbcLCJr6FbSLWHHOXl:123BsCL4HOXl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b247b3f4exe.exe
Files
-
b247b3f4exe.exe.exe windows x64
8389a06a9956a476e94286bdab2ed4a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
htons
connect
WSAStartup
socket
send
recv
inet_addr
crypt32
CryptStringToBinaryA
kernel32
WriteConsoleW
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
SetEnvironmentVariableA
ReadConsoleW
RtlCaptureContext
VirtualAlloc
CreateThread
Sleep
WriteFile
ReadFile
CreateFileA
FreeLibrary
GetProcAddress
HeapFree
GetProcessHeap
GetModuleHandleA
GetLastError
WideCharToMultiByte
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
SetEndOfFile
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlPcToFileHeader
RaiseException
RtlUnwindEx
LoadLibraryExW
CreateFileW
GetDriveTypeW
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
HeapAlloc
HeapReAlloc
GetStdHandle
GetModuleFileNameA
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
GetTimeZoneInformation
user32
EnumChildWindows
MessageBoxW
ole32
CoCreateGuid
rpcrt4
UuidFromStringA
Sections
.text Size: 953KB - Virtual size: 952KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 534KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 82KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ