Static task
static1
Behavioral task
behavioral1
Sample
056ee7d95d61953cf9e6fed5eaf7803ecb9c53b28384ce5ff4928db36fe83fca.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
056ee7d95d61953cf9e6fed5eaf7803ecb9c53b28384ce5ff4928db36fe83fca.exe
Resource
win10v2004-20230703-en
General
-
Target
056ee7d95d61953cf9e6fed5eaf7803ecb9c53b28384ce5ff4928db36fe83fca
-
Size
10.0MB
-
MD5
60f7525816a81db7276644a85bea2a0a
-
SHA1
28619d53a61c04d7d39db944521d3ab550c2a9c5
-
SHA256
056ee7d95d61953cf9e6fed5eaf7803ecb9c53b28384ce5ff4928db36fe83fca
-
SHA512
67581065d675e7e8be1cc8bed3e3807cca8a2f8d4a7beb9c73b5a82f47e65b303a260e446ec975676ba478e2e390a790755b16ee6a84b7b11eb53ab6dc9e555b
-
SSDEEP
196608:KKx0MQNNJnuUlLPC8AamNxAH0yXbGf6gWm0T1hpN6LlZG/dew8Q8Wk:KSLQ3USLPC8XmNx1f6gX0T1UpZG/QW8T
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 056ee7d95d61953cf9e6fed5eaf7803ecb9c53b28384ce5ff4928db36fe83fca
Files
-
056ee7d95d61953cf9e6fed5eaf7803ecb9c53b28384ce5ff4928db36fe83fca.exe windows x86
a82528b5a310d52daa998fed42bffd09
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetProcessImageFileNameW
EnumProcesses
shlwapi
ord176
kernel32
WriteConsoleW
VirtualFree
VirtualAlloc
GetStartupInfoW
SetLastError
GetShortPathNameW
SetEnvironmentVariableW
WaitForSingleObject
GetFileAttributesW
CreateProcessW
GetExitCodeProcess
GetVersionExA
GetModuleHandleA
GetProcAddress
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TerminateProcess
LoadLibraryExA
SetFileTime
FreeConsole
GetTickCount
AllocConsole
GetConsoleScreenBufferInfo
GetCommandLineW
GetCurrentProcess
RemoveDirectoryW
GetEnvironmentVariableW
GetPrivateProfileSectionNamesW
OpenProcess
MultiByteToWideChar
GetPrivateProfileStringW
AttachConsole
DeleteFileW
GetWindowsDirectoryW
GetModuleHandleW
WideCharToMultiByte
GetConsoleWindow
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetStdHandle
CreateDirectoryW
CloseHandle
CreateFileA
GetLastError
CreateFileW
SetFilePointer
WriteFile
ReadFile
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
SetEndOfFile
Sleep
GetProcessHeap
ReadConsoleW
GetCurrentDirectoryW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
ResumeThread
FreeLibraryAndExitThread
SetStdHandle
GetFileAttributesExW
HeapSize
GetFullPathNameW
GetModuleFileNameW
HeapFree
HeapAlloc
DecodePointer
CompareStringW
LCMapStringW
user32
SetDlgItemTextW
MessageBoxW
DialogBoxParamA
LoadStringW
SendMessageA
wsprintfA
advapi32
RegCreateKeyExA
RegCloseKey
AllocateAndInitializeSid
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
FreeSid
CheckTokenMembership
RegOpenKeyExA
RegOpenKeyExW
RegQueryValueExW
shell32
CommandLineToArgvW
SHCreateDirectoryExW
ole32
CoInitializeEx
CoInitialize
StringFromGUID2
CoUninitialize
CoCreateInstance
CoGetObject
oleaut32
SysAllocString
SysFreeString
Sections
.text Size: 195KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 110KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 203KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ