Static task
static1
Behavioral task
behavioral1
Sample
5286002bef5ad2exeexeexeex.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
5286002bef5ad2exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
5286002bef5ad2exeexeexeex.exe
-
Size
376KB
-
MD5
5286002bef5ad2bc1d7794089d85db63
-
SHA1
fc94df1a424b998531dcf57d40dae1c817a4f605
-
SHA256
04f4f6a073455fa67ed3cc8a3e6ba6d44d67ee039b4d732ec80c24b2dadc4feb
-
SHA512
b9f9db1e0d2142d69fc439059c7be1f0cdb7aca7eb92f64244e891cb52d4951028cc02a18fda1db1a2b8b68ad7381a1562b4a474fb53b0e25bc724155827ba17
-
SSDEEP
6144:adNNwhsccifICm+iCCCHn5dJ2teNdz3ncWjt:ausccEIAiCCCH/J2tkdzMWjt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5286002bef5ad2exeexeexeex.exe
Files
-
5286002bef5ad2exeexeexeex.exe.exe windows x86
4b3a3fa2e0d8b094f802c36c1ca2f505
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW
InternetConnectW
InternetReadFile
InternetQueryDataAvailable
InternetOpenW
psapi
GetModuleFileNameExW
kernel32
Sleep
GetLastError
GetTempFileNameW
CreateProcessW
WaitForSingleObject
GetModuleHandleW
OpenProcess
GetProcessHeap
HeapAlloc
CreateEventA
HeapFree
SetEvent
GetTempPathW
CloseHandle
GetCurrentProcessId
lstrcpyW
GetFileAttributesW
DeviceIoControl
DeleteFileW
RemoveDirectoryW
AreFileApisANSI
ExitThread
CreateThread
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
CompareStringW
SetHandleCount
FormatMessageA
LocalFree
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetCPInfo
RaiseException
RtlUnwind
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
SetEnvironmentVariableA
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetProcAddress
ExitProcess
ReadFile
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapSize
GetModuleFileNameW
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
LoadLibraryW
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetModuleHandleA
ReleaseSemaphore
SetWaitableTimer
WaitForSingleObjectEx
OpenEventA
ResetEvent
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjectsEx
CreateWaitableTimerA
user32
DestroyWindow
GetMessageW
PostQuitMessage
LoadCursorW
BeginPaint
TranslateMessage
RegisterClassExW
LoadIconW
EndPaint
LoadBitmapW
CreateDialogParamW
EnableWindow
SetWindowTextW
DefWindowProcW
DispatchMessageW
GetDlgItem
SendMessageW
UpdateWindow
ShowWindow
gdi32
DeleteDC
SelectObject
CreateCompatibleDC
GetObjectW
GetStockObject
BitBlt
comdlg32
GetSaveFileNameW
shell32
ShellExecuteW
Sections
.text Size: 257KB - Virtual size: 256KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ