Static task
static1
Behavioral task
behavioral1
Sample
b107ade58802a3becf92a63aecc827feb876329503f5b23462b878355a2a2f53.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
b107ade58802a3becf92a63aecc827feb876329503f5b23462b878355a2a2f53.exe
Resource
win10v2004-20230703-en
General
-
Target
b107ade58802a3becf92a63aecc827feb876329503f5b23462b878355a2a2f53
-
Size
137KB
-
MD5
26aa0ebeaa70ff6d71636874f6588d94
-
SHA1
67d9664190e3757002c7cc58528810decbe5c3f3
-
SHA256
b107ade58802a3becf92a63aecc827feb876329503f5b23462b878355a2a2f53
-
SHA512
34e4ed2e133eb390f0e6a5e43fc4bfe81140230d871632708d734dc578da9713b901c391c65ca049415c7a290530cbe305c8d549b1798f796e11d6272eec47ed
-
SSDEEP
768:504HdxToV26CiWHTnyr9ZC7tj82FGrNAzMKzcMEuwJaWlqKXDmGL/WWXy:mA49fIDKiy2sizMbuwJaWlqKXyGL/W
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b107ade58802a3becf92a63aecc827feb876329503f5b23462b878355a2a2f53
Files
-
b107ade58802a3becf92a63aecc827feb876329503f5b23462b878355a2a2f53.exe windows x86
adfad1cf4fbf20a9c37e8cf5063f20c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CloseHandle
CreateFileW
CreateProcessW
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FormatMessageW
FreeLibrary
GetCommandLineW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStdHandle
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
QueryPerformanceCounter
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
msvcrt
__dllonexit
__getmainargs
__initenv
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_fmode
_initterm
_iob
_lock
_onexit
_unlock
_vsnwprintf
_waccess
_wcsdup
_wcsicmp
_wcsnicmp
abort
calloc
exit
fprintf
free
fwprintf
fwrite
isalpha
isspace
malloc
memcpy
memmove
realloc
signal
strlen
strncmp
swprintf
vfprintf
wcscat
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsstr
shell32
CommandLineToArgvW
shlwapi
PathAppendW
PathRemoveFileSpecW
user32
LoadStringW
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 385KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 512B - Virtual size: 53B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ