Static task
static1
Behavioral task
behavioral1
Sample
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe
Resource
win10v2004-20230703-en
General
-
Target
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.zip
-
Size
77KB
-
MD5
f60f0b756bda9b6aaff12c9768f0bc1a
-
SHA1
f970234f5b6642fefe056aa11b633be8b958a971
-
SHA256
0a08d9b027457da99725968eb4566eb836a7d503219ad5690f851caecabce93d
-
SHA512
d4ec2faf04836f374cb8ab75ffdfae6e925e97325b380420afdc2a17eb9fd0db7701404cd23268ed45c08cad346a05fa09fb8402e844c87eae0da03e116197b4
-
SSDEEP
1536:kgMqJUnfd1K69eQKqegy4x5PkOtjLUQeAxcGdoZI0jyOrFBCZai38Q7SuMyj:BZUfHKbgy4x2cL3er7I0lrLCZa8/SHyj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666
Files
-
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.zip.zip
Password: infected
-
d4a847fa9c4c7130a852a2e197b205493170a8b44426d9ec481fc4b285a92666.exe windows x64
Password: infected
ad380d353776ceaab3ea64e4fe37c69c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
ShellExecuteW
CommandLineToArgvW
shlwapi
PathFindExtensionW
kernel32
GetStartupInfoW
WriteConsoleW
HeapReAlloc
HeapSize
GetCommandLineW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindFirstVolumeW
FindNextFileW
FindNextVolumeW
FindVolumeClose
GetFileAttributesExW
GetFileSize
GetVolumeInformationW
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
GetVolumePathNamesForVolumeNameW
CloseHandle
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
Sleep
WaitForMultipleObjects
TerminateProcess
CreateThread
CreateProcessA
OpenProcess
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetModuleFileNameA
GetModuleHandleA
lstrcpyA
lstrcpyW
lstrlenA
lstrlenW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
GetStringTypeW
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
GetModuleFileNameW
GetCurrentProcess
ExitProcess
GetModuleHandleExW
LCMapStringW
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
user32
wsprintfA
wsprintfW
rstrtmgr
RmRegisterResources
RmEndSession
RmStartSession
RmGetList
Sections
.text Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ