Static task
static1
Behavioral task
behavioral1
Sample
d5d506f616d8c1eecaf2f8daafe1e95c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d5d506f616d8c1eecaf2f8daafe1e95c.exe
Resource
win10v2004-20230703-en
General
-
Target
d5d506f616d8c1eecaf2f8daafe1e95c.exe
-
Size
315KB
-
MD5
d5d506f616d8c1eecaf2f8daafe1e95c
-
SHA1
7dea2493c2b708e5581a763313001dc81402b3ef
-
SHA256
3e53b145657f33357a41f79761757404be0d8814f5c290633eced02eb60c105b
-
SHA512
9b1c4b7652be3722487d866c040a45a99eaa0176dac20fa057224744893eeecfef19c95b8848f5a5101448b9f0158a7bb8c63484428b72a2c57598219c47dc83
-
SSDEEP
6144:Xcbwp64Ojt1blbSiXsitti/jOmaxutrgno:IwrO3lpsdirEP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d5d506f616d8c1eecaf2f8daafe1e95c.exe
Files
-
d5d506f616d8c1eecaf2f8daafe1e95c.exe.exe windows x64
7cd0bbb42d4b316f99f5cabd76b4bcaa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetCurrentProcess
CloseHandle
GetCurrentThread
TerminateProcess
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
RtlCaptureContext
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlLookupFunctionEntry
GetLastError
FormatMessageW
FreeLibrary
GetProcessHeap
HeapFree
HeapAlloc
WaitForSingleObject
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
SetThreadContext
GetCommandLineW
GetStdHandle
GetCurrentProcessId
QueryPerformanceCounter
TryAcquireSRWLockExclusive
HeapReAlloc
AcquireSRWLockShared
GetModuleHandleW
GetModuleFileNameW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetConsoleMode
WriteConsoleW
GetThreadContext
GetSystemInfo
GetProcAddress
GetModuleHandleA
LoadLibraryExW
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
GetCurrentThreadId
advapi32
RegQueryValueExW
RegOpenKeyExW
SystemFunction036
psapi
EnumProcessModulesEx
GetModuleBaseNameW
user32
GetSystemMetrics
bcrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom
api-ms-win-crt-string-l1-1-0
strcpy_s
wcsncmp
api-ms-win-crt-runtime-l1-1-0
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_set_app_type
__p___argc
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
__p___argv
_initterm
_c_exit
_cexit
abort
_initterm_e
_exit
exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
calloc
malloc
_set_new_mode
free
Sections
.text Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ