Static task
static1
Behavioral task
behavioral1
Sample
d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59.exe
Resource
win10-20230703-en
Behavioral task
behavioral2
Sample
d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59.exe
Resource
win10v2004-20230703-en
General
-
Target
d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59.exe
-
Size
843KB
-
MD5
a61d1724e03bc2d75cc52115b64e1bb1
-
SHA1
0a9da914b2b2ed147f9ff1b286d9c2977cfe5937
-
SHA256
d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59
-
SHA512
1375305a95804bd67b30caa69044637d399905f49e0d0b69b7dcc606c70ccdff0dd3e491745548b324fbd9a10feca35582745fd0f027fa26b4a2676dc7e7e0ce
-
SSDEEP
24576:3QZ1knLkB4qet7cAlI7/xXBMSgm0Eyt2y:3QekGPlUXd07t2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59.exe
Files
-
d57847db5458acabc87daee6f30173348ac5956eb25e6b845636e25f5a56ac59.exe.exe windows x86
e510e9335b660ca763f9d3f6f3bd2c11
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileA
CopyFileA
WideCharToMultiByte
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
SetDllDirectoryA
CreateFileA
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
WaitForSingleObjectEx
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetDiskFreeSpaceA
FormatMessageW
FindFirstFileA
MultiByteToWideChar
HeapSize
HeapValidate
GetVersionExW
GetFileAttributesW
CreateFileW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
InterlockedCompareExchange
WriteFile
GetFullPathNameW
HeapCreate
ReadFile
AreFileApisANSI
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
DeleteFileA
GetTempPathA
GetEnvironmentVariableA
CreateProcessA
LoadLibraryA
lstrlenA
lstrcpynA
lstrcmpA
HeapAlloc
FindClose
GetStdHandle
WaitForSingleObject
LocalFree
GetProcAddress
FreeLibrary
GetVersionExA
GetFileAttributesA
CloseHandle
GetLastError
GetCurrentProcess
GetProcessHeap
DecodePointer
WriteConsoleW
GetConsoleCP
SetStdHandle
HeapFree
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
GetModuleFileNameW
RaiseException
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameA
GetCommandLineA
GetCommandLineW
GetACP
GetStringTypeW
GetFileType
CompareStringW
LCMapStringW
ReadConsoleW
SetFilePointerEx
GetTimeZoneInformation
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
advapi32
RegCloseKey
SystemFunction036
CredFree
CredEnumerateA
RegEnumValueA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegQueryValueExA
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
shell32
SHGetFolderPathA
ole32
CoUninitialize
CoCreateInstance
CLSIDFromString
CoInitialize
crypt32
CryptUnprotectData
oleaut32
GetErrorInfo
Sections
.text Size: 597KB - Virtual size: 597KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 47KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ