Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230703-en
General
-
Target
file.exe
-
Size
1016KB
-
MD5
e8fa74f4c311b7b81c65c31be3f27bf0
-
SHA1
2152a68d666039e737b2b4d2f1389334bd6fc763
-
SHA256
9246fb98c415ca4531a663cd71a3fa2a09843fe8ca84520891eda8fb57d42b31
-
SHA512
9bd2eaf423d9b8d111c08d4b78a9bdbe5dba89f4ce93a83b5588251680d46f904626c1b2d3ed5b3ad73cf786675e72f1f4d62e1739509123e7f9337c70818283
-
SSDEEP
24576:h9z62mzCIUOk/nZTdqWYPEdx5Vdj1nhTN:P62nIDstgPwp1hTN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource file.exe
Files
-
file.exe.exe windows x86
7d778758ec3a7b9a67aee00a1e103889
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GetProcAddress
lstrlenA
GetModuleFileNameW
GetLastError
WideCharToMultiByte
MultiByteToWideChar
RaiseException
LoadLibraryExW
VirtualQuery
GetModuleHandleExW
FreeLibrary
ExitProcess
Sleep
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
msvcrt
_msize
?terminate@@YAXXZ
realloc
?_set_new_mode@@YAHH@Z
free
_errno
_wcmdln
__wgetmainargs
__set_app_type
_XcptFilter
_controlfp_s
__p__commode
_set_fmode
__CxxFrameHandler3
_amsg_exit
strcpy_s
strcat_s
_wmakepath_s
_wsplitpath_s
wcscpy_s
_initterm_e
_initterm
_except_handler4_common
memset
Sections
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gehcont Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 425KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
l9jNQKB Size: 556KB - Virtual size: 560KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ