Static task
static1
Behavioral task
behavioral1
Sample
d4516f3f6e73fcf4801181ccbec0a84bf0fbb2192c848590ec2272916915a029.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
d4516f3f6e73fcf4801181ccbec0a84bf0fbb2192c848590ec2272916915a029.exe
Resource
win10v2004-20230703-en
General
-
Target
d4516f3f6e73fcf4801181ccbec0a84bf0fbb2192c848590ec2272916915a029
-
Size
154KB
-
MD5
04e8994c4a774b260f95c5ce6bb33989
-
SHA1
952a98fccb3bff5fd30e74e331aeda28453af2f9
-
SHA256
d4516f3f6e73fcf4801181ccbec0a84bf0fbb2192c848590ec2272916915a029
-
SHA512
f24afcc628647dcbc40213e414ee9d3a497e70d05af25465b5f7d13633dcb3daa0bb7d35f72c300c93a86321e7695fc56cef825046153a1addbb3ab6e8c24e02
-
SSDEEP
3072:dzEKRXvMHOkSbqyiFasLmCIZwCT34khqKQPauRZKMnXxcn8BtsI3PKo9wRE5LZJW:doKISWF5SC+wCj4khNqRZLEdIfg+H7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d4516f3f6e73fcf4801181ccbec0a84bf0fbb2192c848590ec2272916915a029
Files
-
d4516f3f6e73fcf4801181ccbec0a84bf0fbb2192c848590ec2272916915a029.exe windows x86
9c8decf3582072f6edfc385a689f44f4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateDirectoryA
CreateFileA
DeleteFileA
ExitProcess
FreeLibrary
GetCommandLineA
GetFileTime
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetTempPathA
GetWindowsDirectoryA
LoadLibraryA
lstrcatA
lstrcmpiA
RemoveDirectoryA
SetFileTime
VirtualAlloc
VirtualFree
WriteFile
Sections
pec1 Size: 106KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pec Size: 1KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 26KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
pebundle Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE