Static task
static1
Behavioral task
behavioral1
Sample
2315b5fa9423d0538154c84333a95d3fcea5011f9fb3b1585608b3ffcd70d4ca.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2315b5fa9423d0538154c84333a95d3fcea5011f9fb3b1585608b3ffcd70d4ca.exe
Resource
win10v2004-20230703-en
General
-
Target
2315b5fa9423d0538154c84333a95d3fcea5011f9fb3b1585608b3ffcd70d4ca.exe.exe
-
Size
145KB
-
MD5
30b8e89d006911aedd4ddd9f199cea4b
-
SHA1
fdb6adf5fee95333a5f0811249ef35a9b0a6a5a4
-
SHA256
2315b5fa9423d0538154c84333a95d3fcea5011f9fb3b1585608b3ffcd70d4ca
-
SHA512
022eaffd80029c29b110967cb2ee7df50bee5544a64b6ccb4e71ded5f968e0abcdb4d048a6dbf81a89a5548e90d6b8ba021e60c76ddf1ee784c87fd76b296fed
-
SSDEEP
384:YsjQQs+IoTeJ5hv4UCYte0I+eTUsRZXvXshycJuOCqzGGd:YsMQs+IZHfM0xeTUiXUxJuOdV
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2315b5fa9423d0538154c84333a95d3fcea5011f9fb3b1585608b3ffcd70d4ca.exe.exe
Files
-
2315b5fa9423d0538154c84333a95d3fcea5011f9fb3b1585608b3ffcd70d4ca.exe.exe.exe windows x86
f85297283baf098bf5fa8be9bc88cd5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCurrentProcess
Sleep
GetLastError
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
GetSystemDirectoryA
GetWindowsDirectoryA
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CloseHandle
FreeResource
SetFileAttributesA
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
InterlockedExchange
GetSystemTimeAsFileTime
advapi32
RegQueryValueExA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
msvcr90
fclose
fwrite
remove
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_crt_debugger_hook
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
strlen
memset
strcpy
strcat
fopen
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ