Static task
static1
Behavioral task
behavioral1
Sample
API (1).exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
API (1).exe
Resource
win10v2004-20230703-en
General
-
Target
API (1).exe
-
Size
41.8MB
-
MD5
3b0d5aad8555e481f6cf500cce2b97a1
-
SHA1
3404ed8105e5667d39741f9904a544a09a7226f5
-
SHA256
d85a7de674dc386189c63be39ba2a555a2d54137f263fda2258f299c08f574b1
-
SHA512
de824825756e2c2b7660d27b4748a6940f01cc046f1e44a8fee075265a60d0c974e4c26852f504b20a38b1974fb8c15c81842cbf96009fd66a5e7c733639e7aa
-
SSDEEP
786432:rEv/zSuPpIx2kFGzFKTFIq/tsW8/IL9lRWaxrHB:QDW2kg0Iq/M/IL7RWaxF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource API (1).exe
Files
-
API (1).exe.exe windows x64
5a1d466347be910cbf0d4b74739db779
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
getsockopt
wldap32
ord32
crypt32
CertGetCertificateContextProperty
advapi32
RegCreateKeyA
kernel32
EncodePointer
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetUserObjectInformationW
shell32
SHGetSpecialFolderPathA
shlwapi
PathCombineA
userenv
UnloadUserProfile
rpcrt4
UuidCreate
ntdll
RtlInitAnsiString
dbghelp
ImageDirectoryEntryToData
bcrypt
BCryptGenRandom
Sections
.text Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 822KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 197KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.boot0 Size: - Virtual size: 25.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.boot1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot2 Size: 41.8MB - Virtual size: 41.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 300B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ