Static task
static1
Behavioral task
behavioral1
Sample
Challenge_Benign_53a849369d6f70f9bbd7a0dae096bdb213a92f6229ce1f624eea0c8e3c9e47b5.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Challenge_Benign_53a849369d6f70f9bbd7a0dae096bdb213a92f6229ce1f624eea0c8e3c9e47b5.exe
Resource
win10v2004-20230703-en
General
-
Target
Challenge_Benign_53a849369d6f70f9bbd7a0dae096bdb213a92f6229ce1f624eea0c8e3c9e47b5.exe
-
Size
77KB
-
MD5
09cdb032c8ef29d3ab456b0bda783aac
-
SHA1
05c746c45f19010132dbb821f9f7d96e20c2b0fc
-
SHA256
b3746a11f9356ad8278b927e6ff601b2b930ac91c498b6b80f93066434e1db70
-
SHA512
8e94a7ca4dd370c695ce1a54d3d474e72160a64e97badedd695189f95cfe9ffc0e20c5cc8892e7817c92998d7ea067a5d1db12a075d65f39d38c2b507bc03b8e
-
SSDEEP
1536:UiTe4LxtdbC+2kYtKW0F+xnUDipOLq7yrx5nsbDWu/XTvlTgrsbDWu/X376rare:HTe4LbdbC+2kYtEFCAipOLq7y7e6rare
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Challenge_Benign_53a849369d6f70f9bbd7a0dae096bdb213a92f6229ce1f624eea0c8e3c9e47b5.exe
Files
-
Challenge_Benign_53a849369d6f70f9bbd7a0dae096bdb213a92f6229ce1f624eea0c8e3c9e47b5.exe.exe windows x86
247d2f1e48398c3827503373fce846d5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_vsnwprintf
wcsrchr
_except_handler3
_c_exit
_exit
_XcptFilter
_cexit
exit
_controlfp
_onexit
__dllonexit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_vsnprintf
advapi32
SetSecurityDescriptorOwner
StartServiceCtrlDispatcherW
OpenThreadToken
RevertToSelf
GetTokenInformation
MakeAbsoluteSD
RegGetKeySecurity
GetSecurityDescriptorOwner
EqualSid
RegisterServiceCtrlHandlerW
SetServiceStatus
RegEnumKeyExW
CreateServiceW
OpenSCManagerW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
CloseServiceHandle
SetThreadToken
RegEnumKeyW
RegOpenKeyExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GetLengthSid
AllocateAndInitializeSid
FreeSid
MakeSelfRelativeSD
GetSecurityDescriptorLength
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAce
AddAccessAllowedAce
InitializeAcl
RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
kernel32
CompareStringW
GetFileType
GetStdHandle
GetCommandLineW
ExitProcess
SetConsoleCtrlHandler
CreateThread
GetUserDefaultLangID
GetSystemDirectoryW
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
SetUnhandledExceptionFilter
GetModuleHandleA
GetStartupInfoA
GlobalAlloc
lstrlenW
lstrcmpiW
InterlockedExchange
GetLastError
CloseHandle
GetCurrentProcess
Sleep
GetVersionExW
GetEnvironmentVariableW
GetProcAddress
LoadLibraryW
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
lstrcpynW
lstrcpynA
WideCharToMultiByte
SetLastError
GetCurrentThread
GlobalFree
FreeLibrary
UnhandledExceptionFilter
WaitForSingleObject
CreateProcessW
GetModuleFileNameW
lstrcmpW
FormatMessageA
GetSystemDefaultLangID
LoadLibraryExW
WriteFile
FormatMessageW
GetLocaleInfoW
GetACP
GetUserDefaultUILanguage
SetCurrentDirectoryW
OutputDebugStringW
LeaveCriticalSection
EnterCriticalSection
OpenProcess
CreateEventW
OpenEventW
user32
PostQuitMessage
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessageW
IsCharAlphaNumericW
PostThreadMessageW
MsgWaitForMultipleObjects
ntdll
NtQueryInformationProcess
ole32
CoUninitialize
StgOpenStorage
CoInitialize
CoRevokeClassObject
CoRegisterClassObject
msi
ord197
ord280
ord190
ord70
ord141
ord199
ord88
ord131
ord184
ord175
ord240
ord222
ord196
ord169
ord78
ord148
ord136
ord8
ord228
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE