Static task
static1
Behavioral task
behavioral1
Sample
49af32d79deeb7exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
49af32d79deeb7exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
49af32d79deeb7exeexeexeex.exe
-
Size
342KB
-
MD5
49af32d79deeb759d0571722233c913b
-
SHA1
5743a4cab9cd5563a1a4fe9c3c269ecc06e65702
-
SHA256
144455de43d7ba3aa9f0a7b6f0854d8f60fb419ed68eaea213fdbe8db53a9f30
-
SHA512
48f4e3f074baae21e947a3d66e49a172ee4d85101a265015d7f4e5bedc3562d206bcb4308b4f80a231f9e527cca06c52e46edf3d5cbb79cc9b50e8dc5dfda0b2
-
SSDEEP
6144:ygNYi0KqlI9QBXUaN99dDBdkP05AUFuCWdRSJTBqdiGZRmC:RYi0qQ7p/dW05zfWXSJTsdiGZl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49af32d79deeb7exeexeexeex.exe
Files
-
49af32d79deeb7exeexeexeex.exe.exe windows x86
560a7d408776857c35e8ab95a630455d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryA
FindFirstFileA
GetFileAttributesA
SetFileAttributesA
DeleteFileA
FindNextFileA
FindClose
RemoveDirectoryA
CreateFileA
WriteFile
CloseHandle
OutputDebugStringA
GetCurrentThreadId
GetPrivateProfileIntA
MoveFileA
GetPrivateProfileStringA
Sleep
CompareStringW
GetProcessHeap
SetEndOfFile
CreateFileW
CreateProcessA
GetExitCodeProcess
LoadLibraryW
WriteConsoleW
SetStdHandle
HeapReAlloc
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLocaleInfoW
GetModuleFileNameW
HeapSize
HeapCreate
FlushFileBuffers
SetFilePointer
ExitProcess
GetProcAddress
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTickCount
CreateThread
CreateEventA
PulseEvent
WaitForSingleObject
CopyFileA
GetSystemTimeAsFileTime
GetTimeFormatA
GetDateFormatA
GetLastError
HeapFree
HeapAlloc
ExitThread
GetCommandLineW
HeapSetInformation
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
ReadFile
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
SetEnvironmentVariableA
user32
PeekMessageW
GetMessageW
PostThreadMessageW
wininet
InternetCrackUrlA
InternetOpenA
InternetSetOptionA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
shlwapi
PathRemoveFileSpecA
PathAddBackslashA
PathCanonicalizeA
PathIsDirectoryA
PathFileExistsA
ws2_32
send
socket
connect
freeaddrinfo
setsockopt
closesocket
WSAStartup
WSACleanup
WSAGetLastError
recv
__WSAFDIsSet
select
ioctlsocket
getaddrinfo
Sections
.text Size: 268KB - Virtual size: 267KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ