Static task
static1
Behavioral task
behavioral1
Sample
eff2cdb8e1bcbaf589d553c884dff0bbbc7fc48733ff404d7c0ef421c45cec6a.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
eff2cdb8e1bcbaf589d553c884dff0bbbc7fc48733ff404d7c0ef421c45cec6a.exe
Resource
win10v2004-20230703-en
General
-
Target
eff2cdb8e1bcbaf589d553c884dff0bbbc7fc48733ff404d7c0ef421c45cec6a
-
Size
383KB
-
MD5
8a7c8ecbc7c4c09d5107eb0b01098f37
-
SHA1
7ef9aaa3a29ae3e2fdbe81df0874fadb9706b826
-
SHA256
eff2cdb8e1bcbaf589d553c884dff0bbbc7fc48733ff404d7c0ef421c45cec6a
-
SHA512
70730d531e48d067d67efe02802d814068eac8ba53efe5f5351b5b5c21bfb264ffed04581deac01000a0bcc0426a662d6625baec112680acb41ceab073e62b9d
-
SSDEEP
6144:X4WATi7l+pss9dhoMLLSATCNxFx3Tys3L:XITigpsWdhosLTCNxi6L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eff2cdb8e1bcbaf589d553c884dff0bbbc7fc48733ff404d7c0ef421c45cec6a
Files
-
eff2cdb8e1bcbaf589d553c884dff0bbbc7fc48733ff404d7c0ef421c45cec6a.exe windows x86
a015389f60165399e844c3b119b7e185
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCrackUrlW
kernel32
HeapSize
GetProcessHeap
GetLastError
DeleteCriticalSection
LoadLibraryW
RtlCaptureContext
GetCurrentProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
GetCurrentThreadId
IsDebuggerPresent
WaitForMultipleObjects
CloseHandle
DuplicateHandle
CreateEventW
GetModuleHandleW
CreateProcessW
SearchPathW
FreeLibrary
VirtualAlloc
VirtualFree
CreateThread
GetFileSize
ReadFile
GetSystemInfo
LoadLibraryExW
CreateFileW
GetVersionExW
GetCommandLineW
WideCharToMultiByte
ExpandEnvironmentStringsW
FindClose
WriteFile
GetPrivateProfileStringW
GetFullPathNameW
FindResourceW
LoadResource
SizeofResource
LocalFree
LockResource
FindResourceExW
LocalAlloc
OpenProcess
GetThreadContext
SetThreadContext
VirtualQuery
InterlockedCompareExchange
FlushInstructionCache
VirtualProtect
ResumeThread
SetLastError
GetSystemDirectoryW
Sleep
DeviceIoControl
GetNativeSystemInfo
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetModuleHandleExA
SetEnvironmentVariableA
WriteConsoleW
SetEndOfFile
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleCP
OutputDebugStringW
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
DecodePointer
MultiByteToWideChar
GetModuleFileNameW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
RaiseException
InterlockedDecrement
InterlockedIncrement
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetConsoleMode
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetFileType
GetStdHandle
GetCurrentDirectoryW
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
IsProcessorFeaturePresent
GetDriveTypeW
GetFullPathNameA
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
user32
GetWindowLongW
SetWindowLongW
DefWindowProcW
CreateWindowExW
SetTimer
PostMessageW
KillTimer
IsWindow
GetWindowThreadProcessId
MessageBoxW
GetActiveWindow
SetForegroundWindow
BringWindowToTop
IsWindowVisible
SetWindowPos
ShowWindow
RegisterClassExW
DestroyWindow
advapi32
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
CommandLineToArgvW
oleaut32
SysFreeString
SysAllocString
SysAllocStringLen
shlwapi
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
netapi32
NetApiBufferFree
NetWkstaTransportEnum
Netbios
Sections
.text Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ