Static task
static1
Behavioral task
behavioral1
Sample
a7006bfc620c21f628081ec8de3451aef79b623e4e5ba12212b2acfd2f4b5a8f.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
a7006bfc620c21f628081ec8de3451aef79b623e4e5ba12212b2acfd2f4b5a8f.exe
Resource
win10v2004-20230703-en
General
-
Target
a7006bfc620c21f628081ec8de3451aef79b623e4e5ba12212b2acfd2f4b5a8f
-
Size
6.3MB
-
MD5
b43b59b1517137dc3cd55f0d40f061b9
-
SHA1
762fd6d35c95a01dbb3f5567774810813c506c85
-
SHA256
a7006bfc620c21f628081ec8de3451aef79b623e4e5ba12212b2acfd2f4b5a8f
-
SHA512
fc1c3545a70d653c91b837cd6921f22f3d684b6fe05fc727c83bbdd1de405236f3ca311cad180dde72b7fa9fcb889bfa10c4f8db866e899b43a98fbe73440b3b
-
SSDEEP
196608:FcPTjtx3AZEnPrauVfQNCz6x1XMIZDghvxJQH38:FsTjtxAwGqHzXvHQX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a7006bfc620c21f628081ec8de3451aef79b623e4e5ba12212b2acfd2f4b5a8f
Files
-
a7006bfc620c21f628081ec8de3451aef79b623e4e5ba12212b2acfd2f4b5a8f.exe windows x86
aa930f38bfea4982bbbd7ca0b4ba0350
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointerEx
WideCharToMultiByte
SetFilePointer
GetLastError
MultiByteToWideChar
GetSystemTime
SetCurrentDirectoryW
GetCurrentDirectoryW
RemoveDirectoryW
GetTempPathW
GetModuleFileNameA
WaitForSingleObjectEx
CreateThread
SetThreadPriority
GetThreadPriority
TerminateThread
GetExitCodeThread
SuspendThread
ResumeThread
GetLocalTime
SetErrorMode
FreeLibrary
GetProcAddress
LoadLibraryW
InitializeCriticalSection
EnterCriticalSection
CloseHandle
TryEnterCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventA
CreateSemaphoreA
CreateMutexA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
DebugBreak
ReleaseMutex
WaitForSingleObject
GetFullPathNameW
GetTempFileNameA
GlobalAlloc
LocalFree
FormatMessageW
GetTempPathA
GetStdHandle
ReadFile
DuplicateHandle
CreatePipe
GetCurrentProcess
DeleteFileW
CopyFileW
CreateProcessA
HeapSize
CreateFileA
FindClose
SetEndOfFile
WriteFile
FindNextFileW
LeaveCriticalSection
FindFirstFileW
SwitchToThread
GetCurrentThread
GetCurrentThreadId
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
RaiseException
GetFileType
GetModuleHandleExW
WriteConsoleW
CreateFileW
GetDriveTypeW
SetEnvironmentVariableW
CreateDirectoryW
GetFileAttributesExW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExW
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FlushFileBuffers
SetStdHandle
ExitProcess
ExitThread
GetCommandLineA
GetCommandLineW
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetFileSizeEx
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
advapi32
LookupAccountSidA
RegQueryValueExW
RegOpenKeyExA
RegConnectRegistryA
RegCloseKey
GetNamedSecurityInfoA
Sections
.text Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 123KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 213KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ